Privacy Policy.

This Privacy Policy explains how GRIDNEXA PTE. LTD. collects, uses, discloses, stores and protects personal data worldwide in connection with the GridNexa website, Platform Preview, accounts, application marketplace, compute services and related services.

GridNexa is currently in Platform Preview. Some features may not yet be generally available. Except where mandatory local law provides otherwise, if this translation differs from the English version, the English version prevails.

Data controller: GRIDNEXA PTE. LTD. (UEN 202603992G).

Registered address: 160 Robinson Road, #19-10, Singapore Business Federation Center, Singapore 068914.

Privacy email: [email protected].

This Policy applies to GridNexa websites and services we operate directly. Third-party websites, models, applications, payment services, cloud services, developer services or external links are governed by their own policies.

We may collect:

• Account details such as name, username, email, encrypted password representation, organisation and role.
• Information in contact, partnership or compute-provider applications.
• Content, files, prompts, application information, API configurations and feedback you upload, submit, publish or enter.
• Transaction, order, billing and tax information; full payment-card details are usually handled by entrusted payment processors.
• Information you provide when communicating with us, filing complaints or requesting support.

We may automatically collect:

• Device, browser, operating system, language, approximate location, IP address, security logs and timestamps.
• Pages visited, referrers, clicks, dwell time, form interactions, errors and performance data.
• Account logins, Service Credits usage, API calls, application usage, workloads and operational audit records.
• Data from cookies, local storage, pixels and similar technologies.

When you choose third-party login, payment, hosting, analytics or integration services, we may receive necessary data under your authorisation and those third parties’ rules. We may also obtain data from public sources or business partners for security, compliance and business contact purposes.

We use personal data to:

• Provide, maintain and improve the website, accounts, application marketplace, compute, developer and support services.
• Process applications, registration, verification, orders, credits, billing, refunds and service records.
• Protect account and platform security and prevent fraud, abuse, attacks and unlawful activity.
• Analyse product use, fix errors, measure performance and plan features.
• Send service notices and, where required consent is obtained, marketing communications.
• Comply with legal, regulatory, tax, audit, dispute-resolution and law-enforcement requirements.
• Establish, exercise or defend legal rights and enforce our agreements.

Where applicable law requires a legal basis, we process personal data to perform a contract, take pre-contractual steps, pursue legitimate interests, rely on your consent, or comply with legal obligations. When we rely on legitimate interests, we balance those interests against your rights. When we rely on consent, you may withdraw it without affecting processing that occurred before withdrawal.

We may use necessary cookies for login, security and basic functions and, after obtaining legally required consent, analytics tools such as Google Analytics 4 to understand visits and feature use. We do not require development teams to send names, emails, phone numbers, free-text messages or other directly identifying information to analytics tools. You can manage non-essential technologies through cookie settings, browser settings or applicable opt-out tools.

We may disclose data, only as needed for the purposes in this Policy, to cloud hosting, cybersecurity, analytics, communications, customer support, payment, professional advisers and other entrusted processors; to developers, applications, compute providers or integrations you choose, as needed to complete a transaction or service; to parties bound by confidentiality in reorganisation, financing, merger or asset transactions; or to competent authorities when required by law or to protect rights, security and the public interest. Selling personal data is not our primary business model.

Because the Services are global, data may be processed in Singapore and in other countries or regions where our service providers operate. We take contractual, organisational and technical measures required by applicable law—such as data-processing agreements, standard contractual clauses or other recognised mechanisms—and assess the protection level of destination countries where necessary.

We retain data only for as long as needed to fulfil the collection purpose, perform contracts, maintain security, resolve disputes and meet legal, tax and audit requirements. After account closure, some data may be kept for statutory or reasonable defence periods, then deleted, anonymised or securely isolated. Backup copies are cleared in the ordinary rotation cycle.

We use access controls, encryption, logging, backups, isolation, vulnerability management and vendor management proportionate to risk. No internet transmission or storage is absolutely secure. You should protect credentials, enable available security features and promptly report suspicious activity.

Depending on your local law, you may have rights to request access, correction, deletion, restriction or objection to processing, obtain a portable copy, withdraw consent, opt out of marketing, or contest automated decisions. Submit requests to [email protected]. We may verify identity and, where permitted, refuse requests that are manifestly unfounded, excessive or would harm others’ rights. You may also complain to a competent data-protection authority.

Singapore users’ data is handled under the Personal Data Protection Act and other applicable rules. Users in the EEA and UK may have rights regarding legal bases, cross-border safeguards and regulatory complaints. Residents of certain US states may have rights to know, delete, correct, or opt out of specific sharing or targeted advertising; we handle those requests under applicable state law. Where regional law provides stronger protection, that mandatory rule prevails.

The Services are not directed to persons under eighteen. We do not knowingly collect minors’ data. If you believe a minor has provided data to us, contact us so we can delete it.

Data you submit to AI applications, developer applications or compute jobs may be processed by the relevant models, developers, compute providers or infrastructure providers. We take reasonable steps to limit access and clarify roles, but you must not submit sensitive, confidential or regulated data you are not authorised to process. Enterprise customers should confirm data-processing terms, security requirements and available regions with us before formally processing such data.

We may update this Policy. Material changes will be reasonably notified on the website, in the account or by email, with a new effective date. Where law requires, we will obtain consent again.

For privacy questions, rights requests or complaints, email [email protected]. To help us process your request, please state your name, related account, region and specific request, but do not send passwords or unnecessary sensitive information by ordinary email.