Grimophone Privacy Policy
Last updated: August 25, 2026
This Privacy Policy explains how Grimophone ("Grimophone", "we", "us"), operated by Infernal Solutions, collects, uses, and protects information when you use our website, application, and marketing workflow services (collectively, the "Service") at https://www.grimophone.app. By using the Service, you agree to this Policy and our Terms of Service.
Information we collect
- Account information. Your name, email address, business name, and password (stored only as a salted hash) when you register or are invited to the Service.
- Business information you provide. Details about your business you enter or approve for marketing use — website URLs, brand voice preferences, products, offers, and content drafts.
- Connected platform data. If you connect third-party accounts (such as Meta, TikTok, X, Google Analytics, Google Ads, Klaviyo, or Brevo), we store the OAuth authorization tokens needed to act on your behalf, along with basic account metadata (for example, the connected account email). Tokens are stored encrypted per workspace.
- Content you process through the Service. Drafts, approvals, images, reports, and performance data from connected platforms that you choose to sync.
- Usage and log data. IP address, browser type, pages visited, and timestamps collected automatically to operate and secure the Service.
- Support communications. Messages you send us, such as feedback or support requests.
How we use information
- To provide, maintain, and improve the Service — including drafting, scheduling, and publishing content you approve, and syncing analytics from platforms you connect.
- To authenticate you and secure your workspace.
- To communicate with you about your account, service updates, and support requests.
- To detect, prevent, and address abuse, security incidents, and violations of our Terms.
- To comply with legal obligations.
We do not sell your personal information, and we do not share it with third parties for their own direct marketing purposes.
Legal bases (EEA/UK users)
Where the GDPR applies, we process your information based on: performance of our contract with you (providing the Service), legitimate interests (securing and improving the Service), consent (where you explicitly grant it, such as connecting a platform), and legal obligations.
Sharing and disclosure
- Service providers. Hosting and infrastructure providers (for example, cloud hosting, database, and email delivery vendors) that process data on our behalf under contract.
- Connected platforms. When you direct us to publish content or retrieve analytics, the relevant platform (Meta, TikTok, X, Google, etc.) receives the necessary data to perform that action.
- Legal requirements. Where required by law, legal process, or to protect the rights, property, or safety of Grimophone, our users, or others.
- Business transfers. In connection with a merger, acquisition, or sale of assets, with notice provided where required.
Connected third-party platforms
Your use of connected platforms remains subject to those platforms' own terms and privacy policies. You can disconnect any platform at any time from within the Service; disconnecting removes our stored authorization tokens for that platform. You may also revoke Grimophone's access directly from the platform's account settings (for example, Google security settings or Facebook Business integrations).
Data retention
We retain your information for as long as your account is active or as needed to provide the Service. When you delete your workspace or request deletion, we remove or de-identify personal data within 90 days, except where longer retention is required by law or for legitimate business records (such as invoices).
Your rights and choices
Depending on your location (including under the GDPR, UK GDPR, and CCPA/CPRA), you may have the right to:
- Access the personal information we hold about you;
- Correct inaccurate information;
- Delete your personal information;
- Export your data in a portable format;
- Withdraw consent or object to processing;
- Not be discriminated against for exercising these rights.
To exercise any right, contact us at OneBigMonsterGames@gmail.com. We respond to verified requests within the timeframes required by applicable law. See also our data deletion page.
Cookies and similar technologies
The Service uses essential cookies and similar storage (such as session cookies) required for login, security, and core functionality. We do not use third-party advertising cookies on our own domains.
Data security
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including encryption of credentials and OAuth tokens at rest, TLS in transit, per-workspace tenant isolation, and least-privilege access controls. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
Children's privacy
The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.
International data transfers
We and our service providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers.
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced on the Service or by email to account holders. The "Last updated" date above reflects the current version.
Contact us
General questions: infernalsolutions@gmail.com
Privacy-specific questions: OneBigMonsterGames@gmail.com