The essentials
We use account information to give you a private workspace, product photos to create your packshots, and payment records to manage your credits. This page explains that processing and your choices.
Who we are
Gridbite is a product photography service based in Copenhagen, Denmark. This notice covers the Gridbite website and studio.
For privacy questions or requests about your personal information, contact info@gridbite.app.
Information we handle
- Account information. When you sign in with Google, we receive your name, email address, profile picture when available, and an identifier that connects your Google account to Gridbite. We store account and session records so you can return to your workspace.
- Your workspace. Uploaded product photos, generated images, product and collection names, and saved editing settings. Photos and filenames may contain personal information, so avoid uploading unnecessary personal or sensitive information.
- Payments and credits. Purchase references, amounts, payment status, credit balances, reservations and credit transactions. Stripe handles payment details through its checkout. Gridbite does not store your full payment card number.
- Service activity. Page visits, sign-in attempts, studio actions, credit-pack interest and export activity associated with random browser and session identifiers. When you sign in, recorded activity can be linked to your account so we can understand conversion and problems in the studio. We also keep generation timings, API usage and limited failure records such as operation, error code and request reference. These analytics records do not contain image contents, generation instructions or payment credentials.
- Trial abuse prevention and regional access. We check your connection's IP address against a locally stored country list and use keyed hashes of your network and first-party browser identifiers to limit repeated free trials. IPv6 addresses are grouped by network. Trial eligibility records retain those hashes and the eligibility decision; they do not contain the raw IP address or browser identifiers. Shared networks can affect trial eligibility. Visitor IP addresses are not sent to the country-list provider.
How and why we use it
We process account information, uploads and settings to provide the studio you request: sign-in, image generation, saved collections, editing and exports. The basis for this processing is performing our contract with you, or taking requested steps before a contract.
We keep necessary purchase and financial records to meet legal obligations. We also process limited operational records for our legitimate interests in securing accounts, preventing misuse, resolving payment issues and improving service reliability. These interests must be balanced against your rights.
Site measurement helps us understand visits and returning visitors. Browser storage used for this is described below; any consent required for non-essential storage must be obtained separately.
Service providers
Some information is processed by providers needed to run Gridbite:
- Google handles Google sign-in.
- OpenAI receives the product images and instructions needed to analyze your photo and generate your packshot.
- Stripe processes checkout payments and provides payment confirmations.
- Hosting and storage providers support the website, database and private image storage.
Account access is required to retrieve your private workspace images. We may also disclose information where required by law or necessary to address fraud or security incidents.
Cookies and browser storage
We use session cookies for sign-in. Your browser also stores preferences such as light or dark mode and some editor state.
To prevent repeated free trials, we use a signed first-party browser cookie that lasts up to one year and a separate random identifier in local storage. These identifiers are used only for Gridbite's trial checks. We do not use canvas, audio or font fingerprinting for this check. Clearing browser storage does not erase trial eligibility records already stored by the service.
Our site measurement stores a random visitor identifier and a session identifier in local storage and sends them with activity events. A signed first-party cookie lasting up to 15 minutes links a sign-in attempt to the resulting account through the Google redirect. It can recognize a returning browser; it is a pseudonymous identifier, not fully anonymous data. Optional browser tracking respects the browser’s Do Not Track setting. We still record service operations such as completed generations, payments, export responses and technical failures to operate and support the service.
You can clear or block cookies and local storage in your browser. Clearing them may sign you out and reset preferences. Browser controls do not erase information already stored with your account.
Retention and deletion
When you delete a product, we delete its original uploads and generated packshots from our active storage. This includes associated detail crops, shadow layers, saved colour edits and temporary collection exports containing that product. Access is removed immediately; permanent file cleanup runs automatically and is retried if interrupted.
We do not keep deleted product photos as accounting records. Deleting a product does not delete your account: we retain the account information needed to keep your remaining workspace available, along with payment, credit and limited generation records needed for accounting, security and resolving disputes. Deletion does not return credits already used for completed generations.
Retention depends on the purpose of the record and applicable legal requirements. Copies you have downloaded or shared are outside our control. Information already processed by external providers, and any separately managed backups, may be subject to separate retention rules; product deletion is not a promise of immediate erasure from every external system.
Trial eligibility decisions and keyed network/browser hashes are retained while the trial programme operates to prevent repeated claims. You can contact us about an incorrect decision or request review or deletion of your records.
International processing
Our providers may process information outside Denmark or the European Economic Area. We do not promise that all data stays in the EU.
International transfers are subject to applicable data protection requirements. The arrangements depend on the provider and processing location; the use of a provider does not mean all processing takes place in Denmark.
Your privacy rights
Depending on the circumstances, you can request access to your personal data, correction, erasure, restriction of processing or a portable copy. You may also object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.
We may need to verify your identity before handling a request. Removing individual products from the studio starts the image-deletion process described above; account and other personal-data requests are separate.
Send privacy requests to info@gridbite.app.
You can complain to your local supervisory authority or Denmark’s Data Protection Agency (Datatilsynet).
Updates to this notice
We may update this notice as the service develops. The date above identifies this version. Material changes affecting how we use personal information will be communicated as required before they take effect.