Privacy Policy for Users Submitting Feedback

Last updated: 29th of November, 2025

This Privacy Policy explains how Grasp ("we", "us", or "our") processes information when you submit feedback through a form powered by Grasp.

1. Who Is Responsible for Your Data

When you submit feedback:

• The form owner (the "Admin") is the data controller.
• They decide what information the form collects and how it is used.
• Grasp acts as a data processor.
• We process your data only to deliver the service and forward your feedback to the Admin.

If you want to exercise data rights (access, correction, deletion, etc.), the Admin is the entity legally responsible for handling your request. See below on how to contact them.

2. Information We Collect When You Submit Feedback

The exact information collected depends on how the Admin configured the form.
Grasp processes this information on the Admin's behalf.

Required for all submissions

• Feedback text – anything you type into the form.
• IP address and basic technical logs – collected for security, abuse prevention, and reliable service operation.
  We retain this information for up to 30 days and do not share it with the Admin.

Optional fields (controlled by the Admin)

The Admin may choose to collect:

• Email address
• Phone number
• Marketing consent checkbox
• Any additional fields they configure

All optional fields are voluntary.

3. Voice Input and Transcription (Optional Feature)

If you choose to use voice dictation:

• Your audio recording is sent to OpenAI for transcription.
• OpenAI processes the audio as Grasp's subprocessor.
• OpenAI does not use your data for training.
• OpenAI retains audio for up to 30 days for security and abuse-detection purposes.
• Grasp returns the transcript to your device so you can edit it before submitting.

4. How Your Data Is Used

Grasp processes your data only for purposes necessary to provide the service, including:

• Delivering your feedback to the Admin
• Ensuring the service works reliably
• Detecting fraud, spam, and abuse

Grasp does not sell or share your data for advertising.

5. How Your Data Is Shared

We share data only in these situations:

With the Admin (your form owner)

Information you submit through the form is forwarded to the Admin, including:

• Feedback text
• Name, email and marketing consent if configured in the form

With subprocessors

We use service providers to operate Grasp (e.g., hosting, email delivery, transcription).
A current list is available at: https://grasp.is/privacy/subprocessors

For legal reasons

We may disclose data if required to comply with law or lawful requests from authorities.

6. International Data Transfers

Grasp and its subprocessors may process data outside your country, including in the United States.
Where required by law (e.g., GDPR), data transfers rely on mechanisms such as Standard Contractual Clauses.

7. How to Exercise Your Rights

Because the Admin is the controller, rights requests must be handled by them.

If the form is configured to collect personal information like email or phone numbers, the Admin's email will be provided there.

Otherwise, if no contact details were provided:

• You may contact Grasp at support@grasp.is.
• We will forward your request to the Admin.
• We will not disclose the Admin's identity unless required by law.

Grasp cannot fulfill requests directly unless explicitly authorized by the Admin.

8. Children

Feedback forms are not intended for children under the age defined by local law. Admins are responsible for ensuring they do not solicit data unlawfully.

9. Changes to This Policy

We may update this policy to reflect changes to our practices. We will post updates on this page, and the "Last Updated" date will be updated.