Privacy Notice

Sdraa Pty Ltd (ABN 21 651 207 028), trading as Grascada, decides how and why personal information is handled on this site, which makes us the data controller (and an APP entity under the Australian Privacy Act). Questions or requests go to support@grascada.com.

• Scan inputs — business name, website address and the industry or region you want benchmarked. Used to run the scan and produce your report. Basis: performance of our contract with you, or our legitimate interest in delivering the free preview you requested.
• Contact details — email address, where you choose to give it, so we can send your report link, receipts and service notices. Basis: contract performance. You can run a free check without giving us an email address.
• Account and access data — subscriber login details and private report access links. Basis: contract performance.
• Support messages — what you send us and our replies, used to answer you and improve the product. Basis: contract performance and legitimate interests.
• Technical and usage data — IP address, device and browser information, pages viewed, scan timings and error logs. Used for security, fraud and abuse prevention, diagnosing faults and improving the service. Basis: legitimate interests and legal obligation.
• Marketing preferences — where you opt in to updates. Basis: consent, which you can withdraw at any time.

Payment details such as card numbers are collected and processed by Stripe at checkout, not by us. We never see or store your full card details.

• Payment processor — Stripe, for card payments, receipts and fraud checks on purchases you make from us.
• Service providers and subprocessors — hosting and database providers, email delivery, error monitoring and analytics tooling, and the AI model providers we query to build reports. Scan prompts are constructed from your industry and region; we do not send your contact details to model providers.
• Professional advisers — legal, accounting and insurance advisers where reasonably necessary.
• Authorities — where required by law, or to establish, exercise or defend legal claims.

We do not sell your personal information.

Some of our providers, including hosting and AI model providers, operate outside Australia. Where information is transferred overseas we take reasonable steps to ensure it is handled consistently with this notice and applicable law, including contractual protections such as standard contractual clauses where relevant.

Reports and the scan inputs behind them are kept for as long as you may need access to them, and for up to 24 months after your last activity, unless you ask us to delete them sooner. Records required for tax and accounting are kept for the period required by Australian law (generally five to seven years). Technical logs are kept for up to 12 months. After that, information is deleted or anonymised.

You can ask us to access, correct, or delete your personal information, to restrict or object to certain processing, to receive a copy in a portable form, and to withdraw consent for marketing. Email support@grascada.com and we will respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the UK or EEA, you may also complain to your local supervisory authority.

We use appropriate technical and organisational measures to protect personal information, including encryption in transit, access controls, row-level database security and least privilege for administrative access. No system is perfectly secure, but we will notify you and the relevant regulator where required if a data breach is likely to cause serious harm.

We use essential cookies and local storage to keep the site working, hold your session and remember your report access links. We may use limited analytics storage to understand which pages are used, and we do not run advertising or cross-site tracking cookies. You can clear or block cookies in your browser settings; essential cookies are required for checkout and subscriber login to function.

We may update this notice. The "last updated" date above shows when it changed, and material changes will be highlighted on the site.