Privacy Policy

Effective Date: November 2, 2026 Version 2.4.0

1. Introduction

GridBoost, Inc. ("GridWonk," "we," "us," or "our") is a Delaware corporation that operates the GridWonk platform, accessible at gridwonk.com (the "Service"). GridWonk is a B2B AI SaaS platform that automates and accelerates grid interconnection processes for utilities, energy developers, consultants, and related organizations.

We are committed to protecting the privacy and security of information entrusted to us by our customers, their authorized users, and visitors to our website. This Privacy Policy describes what information we collect, how we use it, when we share it, and what rights you have with respect to your information.

By accessing or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you are using the Service on behalf of an organization, you represent that you have the authority to bind that organization to this Privacy Policy.

This Privacy Policy applies to all users of the Service, including administrators, authorized users within customer organizations, and visitors to our public-facing website. It does not apply to third-party websites or services that may be linked from our platform.

2. Information We Collect

We collect the following categories of information in connection with your use of the Service:

2.1 Account Information

When you create an account or are provisioned as a user within a customer organization, we collect:

• Email address
• Full name
• Company or organization name
• Job title and professional role
• Organization type (utility, developer, consultant, or other)
• Account credentials (passwords are stored in hashed form only)

2.2 Uploaded Documents

In the course of using the Service, you may upload or submit documents including but not limited to:

• Interconnection applications and related filings
• PDF documents, scanned forms, and engineering drawings
• Site control documentation, permits, and compliance materials
• Utility study reports, deficiency notices, and response letters
• Any other documents submitted for AI-powered processing, validation, or analysis

These documents are collectively referred to as "Customer Data." Customer Data is owned by the customer and processed by GridWonk solely to provide the Service.

2.3 Usage Data

We automatically collect information about how you interact with the Service, including:

• Features accessed and actions performed within the platform
• Session history, including login times and session duration
• AI agent interactions, including queries submitted and outputs received
• Token consumption and API usage metrics
• Navigation paths and workflow completion data

2.4 Device and Technical Data

When you access the Service, we automatically collect technical information from your device, including:

• IP address
• Browser type and version
• Operating system and version
• Device identifiers and hardware characteristics
• Screen resolution and viewport size
• Referring URL and pages visited on our site

2.5 Cookies and Tracking Technologies

We use cookies and similar technologies as described in Section 10 of this Privacy Policy. In summary:

• Essential cookies are used for authentication, session management, and security and cannot be disabled.
• Analytics cookies are set by Google Analytics, through Google Tag Manager, to measure how our website and the Service are used.

2.6 Payment Information

GridWonk does not currently collect or process payment card information through the Service. If self-service paid billing is introduced, we will update this policy and provide any required notices before collecting payment card data through a payment processor.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and maintain the Service. We use your account information, uploaded documents, and usage data to deliver the core functionality of the GridWonk platform, including AI-powered document processing, interconnection workflow management, and reporting.
• Process interconnection documents via AI agents. Customer Data is submitted to AI models for analysis, validation, deficiency identification, remediation guidance, and report generation. This processing is performed in real time to deliver results within the Service.
• Generate validation reports and analysis. We use the outputs of AI processing, combined with usage and document data, to produce compliance reports, deficiency summaries, and other deliverables requested by the customer.
• Improve and develop the Service. We may create de-identified data from Customer Data and use it to evaluate and improve the Service and our own AI models. We do not use identifiable Customer Data to train AI models, and our third-party AI model providers may not train on Customer Data. See Section 4.2 for details and exceptions.
• Send service notifications and updates. We use your contact information to send transactional communications such as account confirmations, security alerts, system status updates, and feature announcements relevant to your use of the Service.
• Ensure platform security and prevent abuse. We use technical data, usage patterns, and audit logs to detect unauthorized access, prevent fraud, enforce rate limits, and maintain the integrity and availability of the Service.
• Comply with legal obligations. We process information as necessary to comply with applicable laws, regulations, and contractual requirements.
• Communicate about account, billing, and policy changes. We use your contact information to notify you of changes to your account status, subscription terms, billing matters, and updates to this Privacy Policy or our Terms of Service.

4. AI-Specific Data Processing

GridWonk uses artificial intelligence to process customer documents and deliver core platform functionality. This section describes how Customer Data is handled in connection with AI processing.

4.1 Processing by AI Model Providers

Customer documents submitted for AI analysis are sent to third-party AI model providers, which process them and return the results to the GridWonk platform. These providers may keep inputs and outputs for a limited period (currently up to 30 days) solely for safety and abuse monitoring. They may not use them to train their models.

4.2 Model Training and De-identified Data

• No training on identifiable Customer Data. We do not use Customer Data in identifiable form to train or fine-tune AI models.
• De-identified data. We may create de-identified data from Customer Data and use it to operate, evaluate, and improve the Service and our own AI models. De-identified data cannot reasonably be used to identify a customer, a user or other individual, or a specific project, site, or facility, and does not contain Customer Data in its original or a reconstructable form. We do not attempt to re-identify it, and we share it with third parties only in aggregated form that cannot be associated with a customer.
• Third-party AI model providers. Our agreements with AI model providers do not permit them to use Customer Data submitted through their APIs for model training.
• Exception. We do not use Customer Data to create de-identified data where a separate written agreement with the customer, such as a non-disclosure or data-handling agreement, prohibits it.

4.3 Logs

We keep operational logs of AI processing and platform activity (such as model, token usage, cost, latency, and error information) for up to 24 months for quality assurance, debugging, cost tracking, and reliability monitoring. Chat and agent conversation history is Customer Data and is kept as described in Section 7.

4.4 Ownership of AI Outputs

All outputs generated by AI agents in connection with the processing of Customer Data are owned by the customer. GridWonk retains no proprietary interest in AI outputs derived from Customer Data.

4.5 AI Model Providers

The following third-party AI model providers are used to deliver the Service:

• Anthropic (Claude) — Primary AI model provider for document analysis, deficiency identification, compliance checking, report generation, and conversational agent interactions. Anthropic's commercial API terms apply, which prohibit the use of API inputs and outputs for model training.
• Google (Gemini) — Used for document digitization (OCR and PDF-to-text conversion) and supplementary AI processing tasks. Google's terms for paid Gemini API services apply, which prohibit using prompts and responses to improve Google's products.

Both providers are based in the United States. Their respective privacy and data processing policies are available on their websites.

5. Data Security

We implement comprehensive technical and organizational measures to protect information processed through the Service:

• Encryption in transit. All data transmitted between your device and our servers, and between our servers and third-party services, is encrypted using TLS 1.2 or higher.
• Encryption at rest. All data stored in our databases and file storage systems is encrypted at rest using AES-256 or equivalent encryption standards.
• Row-Level Security (RLS). Our database enforces row-level security policies that ensure users can only access data belonging to their own organization. These policies are enforced at the database layer, independent of application logic, providing defense-in-depth against unauthorized data access.
• Role-Based Access Control (RBAC). Access to platform features and data is governed by role-based permissions. Users are assigned roles (such as administrator, analyst, or viewer) that determine their level of access within their organization.
• Multi-organization data isolation. The platform supports multiple organization types (utilities, developers, consultants, and GridWonk personnel) with strict data isolation between organizations. Cross-organization access is permitted only where explicitly authorized (for example, consultant access to a developer's project) and is governed by access control policies.
• Regular security assessments. We conduct periodic security reviews, vulnerability assessments, and penetration testing to identify and remediate potential security weaknesses.
• Audit logging. All administrative actions, authentication events, and sensitive data operations are recorded in tamper-resistant audit logs for accountability and forensic analysis.
• Incident response procedures. We maintain documented incident response procedures for identifying, containing, remediating, and communicating security incidents. See Section 12 for our data breach notification commitments.

No system can guarantee absolute security. While we implement industry-standard safeguards, you are responsible for maintaining the confidentiality of your account credentials and for promptly reporting any suspected unauthorized access to your account.

6. Data Sharing and Third-Party Services

6.1 We Do Not Sell Personal Information

We do not sell, rent, or trade your personal information to third parties for their marketing or advertising purposes. We have never sold personal information and have no plans to do so.

6.2 Sub-Processors

We use the following sub-processors to deliver the Service. Each sub-processor processes data only as necessary to perform its designated function and is bound by contractual obligations regarding data protection:

Sub-Processor	Function	Location
Anthropic	AI model processing (Claude) — document analysis, deficiency identification, report generation, agent interactions	San Francisco, CA, USA
Google Cloud / Gemini	AI model processing and document digitization (OCR, PDF-to-text)	United States (various regions)
Google Cloud Platform	Backup storage, disaster recovery infrastructure, and related operational services	United States (various regions)
Supabase	Database hosting, authentication, and real-time data services	US-East
Vercel	Application hosting, serverless compute, and content delivery	United States (various regions)
Autodesk Platform Services	Processing of uploaded CAD drawings (for example, DWG files) into viewable and reviewable formats	United States
Resend	Transactional email, such as invitations, account notices, and deficiency notices (recipient name and email address, organization name, and notice content)	United States
Upstash	Managed Redis for session state, rate limiting, and chat-integration conversation state	United States
Google Analytics / Tag Manager	Website and product usage analytics	United States

We may update this sub-processor list from time to time. Material changes to sub-processors that handle Customer Data will be communicated to customers in advance.

6.3 Legal Disclosures

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, including in response to:

• Court orders or subpoenas
• Requests from law enforcement or regulatory authorities
• Legal proceedings to which GridWonk is a party
• Obligations under applicable federal energy regulations

We will make reasonable efforts to notify you of such disclosures unless prohibited by law or court order.

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will provide notice to affected customers before their information is transferred and becomes subject to a different privacy policy. Any successor entity will be bound by the terms of this Privacy Policy with respect to information collected prior to the transfer.

7. Data Retention

For this Privacy Policy, "Operational Backups" means short-term disaster-recovery copies maintained solely for service continuity, and "Regulatory Archive" means any customer-elected long-term retention schedule or legal hold that applies to designated records.

We retain information for the periods described below, after which it is securely deleted, purged from Operational Backups, or anonymized as applicable:

Data Category	Retention Period
Account data (name, email, role, organization)	Duration of the active account plus up to 90 days after account closure
Customer Data (uploaded documents, AI outputs, and chat and agent conversation history)	Kept for the life of the customer's account. Items a user deletes can be restored on request for up to 90 days, after which their stored files are deleted. After the customer's agreement ends, exportable on request for 60 days and deleted from active systems within 90 days, unless legal retention or a Regulatory Archive applies
Operational Backups	Retained only for disaster recovery and service continuity; deleted data is removed from backups within up to 90 days after active-system deletion
Regulatory Archive records	Retained only if the customer elects an archive schedule or Legal Hold; retention period depends on the applicable schedule, hold, or legal requirement
Operational logs (usage, cost, and error records)	Up to 24 months
Billing records (invoices, payment history)	7 years, as required by applicable tax and financial record-keeping laws
Audit logs (administrative actions, authentication events, and intake records that identify a document by name and hash but not its contents)	3 years

Customers may request earlier deletion of their data subject to applicable legal retention requirements. Upon account termination, we initiate the deletion process for all associated data in accordance with the Terms of Service, the applicable retention schedule above, and any Regulatory Archive or Legal Hold that applies.

8. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

• Right of Access. You may request a copy of the personal information we hold about you, including the categories of information collected, the purposes for which it is used, and the third parties with whom it has been shared.
• Right of Correction. You may request that we correct inaccurate or incomplete personal information. You can also update much of your account information directly through the Service.
• Right of Deletion. You may request that we delete your personal information, subject to applicable legal retention requirements and our legitimate interests in maintaining the integrity of our services.
• Right of Portability. You may request that we export your personal data in a structured, commonly used, machine-readable format (JSON). This includes your account information, uploaded documents, and AI-generated outputs.
• Right of Restriction. You may request that we restrict the processing of your personal information in certain circumstances, such as when you contest the accuracy of the data or object to our processing.
• Right of Objection. You may object to the processing of your personal information where we rely on legitimate interests as the legal basis for processing. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

How to Exercise Your Rights

To exercise any of the rights described above, please contact us at privacy@gridwonk.com with a description of your request. We will verify your identity before processing your request and will respond within 30 days of receiving a verifiable request. If we require additional time (up to an additional 60 days), we will notify you of the extension and the reason for it.

There is no fee for exercising your rights. If requests are manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or decline the request, with an explanation provided to you.

If you are an authorized user within a customer organization, certain requests (such as deletion of organizational data) may need to be submitted by the organization's administrator. We will direct you accordingly.

9. CCPA/CPRA Rights (California Residents)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"):

9.1 Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which personal information is collected, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share personal information.

9.2 Right to Delete

You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions permitted by law (such as legal retention requirements or the completion of a transaction for which the information was collected).

9.3 Right to Opt-Out of Sale or Sharing

You have the right to opt out of the "sale" or "sharing" of your personal information as those terms are defined under the CCPA/CPRA. We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. This disclosure is provided for transparency and compliance purposes.

9.4 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive different pricing, a different quality of service, or be denied access to the Service for exercising your rights.

9.5 Categories of Personal Information Collected

Under the CCPA/CPRA framework, we collect the following categories of personal information:

• Identifiers: Name, email address, IP address, account identifiers, device identifiers.
• Commercial information: Subscription and billing records, transaction history, service usage records.
• Internet or other electronic network activity information: Browsing history on our platform, interaction data with the Service, search queries within the platform, AI agent interaction logs.
• Professional or employment-related information: Job title, company name, professional role, organization type.

We do not collect sensitive personal information as defined by the CCPA/CPRA (such as Social Security numbers, precise geolocation, racial or ethnic origin, or biometric data).

9.6 No Sale or Sharing

We have not sold or shared (as defined by CCPA/CPRA) any personal information in the preceding 12 months, and we have no intention of doing so.

9.7 Authorized Agent Requests

You may designate an authorized agent to submit a request on your behalf. The authorized agent must provide written authorization signed by you, and we may require you to verify your identity directly with us before processing the request. Organizational administrators may submit requests on behalf of their authorized users where the organization has established that authority.

To exercise any CCPA/CPRA rights, contact us at privacy@gridwonk.com.

10. Cookie Policy

This section describes our use of cookies and similar tracking technologies.

10.1 Essential Cookies

These cookies are strictly necessary for the operation of the Service and cannot be disabled:

• Authentication cookies maintain your logged-in session and authenticate requests to the platform.
• Session management cookies track your active session to ensure continuity of service.
• CSRF protection cookies prevent cross-site request forgery attacks by validating that requests originate from our platform.
• Security cookies support rate limiting, abuse detection, and other security functions.

10.2 Functional Cookies

These cookies remember your preferences and settings to provide a more personalized experience:

• User preference cookies store settings such as sidebar state, display preferences, and selected organization context.
• Feature state cookies remember your interactions with platform features to maintain workflow continuity.

10.3 Analytics

We use the following tools to understand how our website and the Service are used:

• Google Analytics, through Google Tag Manager, sets cookies that record pages visited, features used, session duration, and interaction patterns.
• Vercel Web Analytics and Speed Insights measure page views and page performance without cookies. Before these reports are sent, we remove query strings from page addresses so that record identifiers are not included.

Analytics data is processed in the United States. We do not use analytics data for advertising.

10.4 No Third-Party Advertising Cookies

We do not use third-party advertising cookies. We do not serve targeted advertisements. No advertising networks or ad exchanges receive data from our platform.

10.5 Managing Cookies

You can manage cookies through the following mechanisms:

• Browser settings: Most browsers allow you to block or delete cookies through their settings. Blocking analytics cookies does not affect the Service; blocking essential cookies may prevent you from using it.
• Google Analytics opt-out: Google offers a browser add-on that stops Google Analytics from collecting data about your visits.

11. International Data

11.1 United States Operations

The Service is primarily operated from and designed for use within the United States. All primary data storage occurs in US-based data centers operated by our sub-processors (Supabase US-East and Vercel US regions). Our sub-processors are US-based companies.

11.2 International Users

If you access the Service from outside the United States, your information will be transferred to and processed in the United States. The United States may not provide the same level of data protection as your home jurisdiction.

11.3 Transfer Mechanisms

While GridWonk does not currently maintain an establishment in the European Union and is not directly subject to the General Data Protection Regulation (GDPR), we adopt GDPR-aligned data protection practices as a matter of best practice and to support customers who may have their own GDPR obligations. Standard Contractual Clauses (SCCs) for international data transfers are available upon request for customers who require them for their own compliance purposes.

11.4 Data Localization

All Customer Data is stored within the United States, except that AI model providers may temporarily keep inputs and outputs as described in Section 4.1. We do not store Customer Data in data centers outside the United States unless explicitly requested and authorized by the customer.

12. Data Breach Notification

12.1 Notification Timeline

In the event of a confirmed security breach that affects your personal information or Customer Data, we will notify affected customers within 72 hours of confirmation of the breach.

12.2 Notification Content

Breach notifications will include:

• A description of the nature and scope of the breach
• The categories and approximate volume of data affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects
• Contact information for our privacy and security team

12.3 Cooperation

We will cooperate with affected customers in connection with their own breach notification obligations to their end users, regulators, or other parties. We will provide reasonable assistance, including access to relevant information and coordination on public communications.

12.4 Regulatory Reporting

We will report data breaches to relevant regulatory authorities as required by applicable law, including state data breach notification statutes and any applicable federal requirements.

13. Children's Privacy

The Service is a B2B platform designed for use by professionals in the energy industry. It is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18 years of age.

If we become aware that we have collected personal information from a child under 18, we will take prompt steps to delete that information. If you believe that we may have collected information from a child under 18, please contact us at privacy@gridwonk.com.

14. Energy Sector Considerations

14.1 Critical Energy/Electric Infrastructure Information (CEII)

Certain information processed through the Service may constitute Critical Energy/Electric Infrastructure Information (CEII) as defined by the Federal Energy Regulatory Commission (FERC) under 18 CFR 388.113, or may otherwise be designated by customers for CEII-equivalent handling. We implement enhanced safeguards for such information, including:

• Restricted access controls limiting CEII to authorized personnel with a demonstrated need to access it
• Segregation of CEII from other data categories where technically feasible
• Enhanced audit logging for all access to documents or data flagged as CEII
• Compliance with FERC requirements regarding the handling, storage, and disclosure of CEII

Customers are responsible for identifying and flagging documents that contain CEII. GridWonk will apply appropriate handling controls upon notification.

14.2 Enhanced Access Controls for Sensitive Infrastructure Data

Documents containing sensitive infrastructure information (including substation specifications, protection system configurations, and detailed interconnection facility designs) are subject to additional access controls beyond standard RBAC, including multi-organization isolation and restricted sharing permissions.

15. Changes to This Policy

15.1 Material Changes

We will provide at least 30 days' advance notice of material changes to this Privacy Policy. Notice will be delivered via email to the address associated with your account and through a prominent notice on the Service. Material changes include, but are not limited to, changes in the categories of information collected, new purposes for data processing, changes to data sharing practices, or modifications to your rights.

15.2 Non-Material Changes

Non-material changes (such as formatting updates, clarifications that do not alter the substance of the policy, or updates to contact information) will be posted on our website and noted with an updated effective date.

15.3 Acceptance

Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you must discontinue use of the Service before the effective date.

15.4 Previous Versions

Previous versions of this Privacy Policy are available upon request. Contact privacy@gridwonk.com to request a copy of any prior version.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through the following channels:

Privacy Inquiries: Email: privacy@gridwonk.com

General Inquiries: Email: contact@gridwonk.com

Mailing Address: GridBoost, Inc. A Delaware Corporation

We aim to respond to all privacy-related inquiries within 30 days of receipt.