Privacy Policy
This policy explains how GRINDA AI Co., Ltd. ("we", "us") handles personal information when you use TradeGraph. A Korean version that follows the structure required by the Korean Personal Information Protection Act is at /privacy/ko.
In short
- The TradeGraph app for ChatGPT and Claude works without an account. It receives only the values your AI app sends to a tool, such as a product name and a country, uses them to answer that request and does not store them.
- We never receive your conversation or the files you share with your AI app.
- We do not sell personal information, show ads, use analytics trackers, or use your data to train AI models.
- An account on our website is optional. If you create one, we keep what is needed to run it until you delete it.
1. Scope
This policy covers:
- the website tradegraph.rinda.ai and its free web tools;
- the MCP servers:
/mcp(public, no sign-in),/mcp/directory(the TradeGraph app in the ChatGPT and Claude directories, no sign-in, read-only tools) and/mcp/account(signed-in, OAuth); - the REST API at
/api/v1; - TradeGraph accounts.
Your AI app (for example ChatGPT or Claude) is run by its own provider. Your conversations with it are governed by that provider's privacy policy, not this one.
2. What we collect
2.1 Using the app or free tools without an account
- Tool arguments. Your AI app decides when to call a TradeGraph tool and sends only that tool's arguments: for example a product name or HS code, a country, and numbers you gave it such as emails sent, replies received or a FOB price. We use them only to compute the answer to that request. We do not write arguments or question text to our logs or database.
- IP address. We read the IP address of the device or AI service calling us (passed on by Cloudflare) to apply rate limits. It stays in memory only: per-minute counters are cleared every minute and per-day counters every day. We do not store it.
- Error logs. When a request fails, our server log records the tool name, a request ID, how long it took and the type of error. For input errors it does not record what was entered.
- Daily counts. For each tool we count calls per day, split into anonymous and signed-in. These counts contain no arguments and no IP addresses.
When the directory app answers about a product outside our 35 core items, we may ask UN Comtrade for public trade statistics using only the HS code and year. We get exchange rates from the European Central Bank. Neither request contains anything about you.
2.2 If you create an account on our website
| Data | Why we need it |
|---|---|
Email, name, company; a password hash (argon2id) or, if you sign in with Google, your Google account ID (we ask Google only for openid email profile); language; marketing consent; the time and version of the terms you agreed to | To create and run your account, sign you in and contact you about it |
| IP address at sign-up | To prevent abuse of the sign-up credit |
| Billing details for tax invoices, if you add them: business name, registration number, representative, address, invoice email | To issue tax invoices and receipts |
| Credit balance, credit ledger and top-ups | To run prepaid credits, refunds and accounting |
| Usage records: tool, endpoint, cost, status and duration (no arguments) | Billing, spending limits and your usage history |
| Sessions: a hashed token, IP address and browser user agent (30 days, renewed when used) | To keep you signed in and protect your account |
| API keys and OAuth tokens, stored only as hashes | To connect your AI agents to your account |
| What you save: plans (product, country, weekly numbers); buyer lists you build (public company information and, if you add them, a contact's name, title and work email); creator seeding lists (public handles); company context (profile, notes, do-not-contact emails and domains); outcome events (a buyer contact is stored only as a hash) | To provide the features you choose to use |
2.3 On your device
The website keeps preferences such as your language, your choices and plan progress in your browser's local storage. This stays on your device and is sent to us only when you save it to an account.
3. How we use it
- To answer your requests and run the service.
- To run accounts, prepaid credits, payments, refunds and tax invoices.
- To keep the service secure, apply rate limits and prevent abuse.
- To answer support requests.
- To send service emails such as sign-in links, receipts and low-balance alerts, and marketing emails only if you agreed to them.
- To meet legal obligations.
4. Who receives it
We run TradeGraph on cloud servers we operate, with the database on the same infrastructure. We share personal information only with the service providers below, only for the purpose shown, or when the law requires it.
| Recipient | What they receive | When |
|---|---|---|
| Cloudflare, Inc. (US) | IP address and request metadata | Every request (content delivery and security) |
| Toss Payments (Korea) | Email, name, amount, order ID | When you top up with a Korean card or pay app |
| Stripe, Inc. (US) | Email, amount, payment IDs | When you pay with an international card, where offered |
| Google LLC (US) | Sign-in request | Only if you choose to sign in with Google |
| treg.to (data API provider) | The live-data query and a pseudonymous customer ID; for contact lookups, company domains | When a signed-in user runs a paid live-data call |
| An email delivery provider | Email address and message | Sign-in, receipt and service emails |
| Our internal team messaging tool | Email and company of new sign-ups, top-ups and refunds | To notify our team |
| Font services (cdn.jsdelivr.net, Google Fonts) | Your IP address, as with any web request | When your browser loads fonts on our website |
TradeGraph does not send your data to any AI model provider. The provider of the AI app you use already receives your conversation under its own terms.
5. International transfers
We are based in the Republic of Korea. Some providers above process data in other countries: Cloudflare (a US company with a global network) for request metadata on every request; Stripe (US) if you pay with an international card; Google (US) if you sign in with Google; and the font services. Data travels to them over encrypted connections when you use the related feature. You can avoid the optional transfers by not using Google sign-in or international card payment.
6. How long we keep it
- Tool arguments: not stored. They are used in memory for the request only.
- IP addresses for rate limits: in memory only, cleared within a minute or a day.
- Error logs and access records: as required by law, up to 1 year.
- Daily counts: anonymous, kept while the service runs.
- Account data: until you delete your account.
- Records the law requires us to keep after deletion: contract, payment and service supply records for 5 years, and consumer complaint and dispute records for 3 years (Korean Act on Consumer Protection in Electronic Commerce).
You can delete your account in account settings by typing your email again. This deletes your plans, buyer lists, creator lists, company context, outcome events, sessions and API keys, and clears your email, name, company and billing details. Payment ledger, usage and top-up records are kept as the law requires. Unused paid credits are refunded as described in the Terms.
7. Your rights
You can ask to access, correct or delete your personal information, to stop or limit its processing, to withdraw consent (for example to marketing emails), and to receive a copy of it in a portable format. Email [email protected]. We answer within 10 days. You can also delete your account yourself at any time. If you are not satisfied, you can complain to a data protection authority, such as the Korean authorities listed in the Korean version or the authority where you live.
8. Children
TradeGraph is a business tool and is not meant for children. You must be at least 14 years old to create an account. If we learn that an account belongs to someone under 14, we delete it.
9. AI training
We do not use your tool arguments, account content or any other personal information to train AI models, and we do not allow others to do so.
10. No sale, no ads
We do not sell or rent personal information and do not share it for advertising. TradeGraph shows no ads and uses no Google Analytics, tracking pixels or other analytics trackers.
11. Optional sharing of outcome counts
Sharing is off unless you turn it on in your account. If you do, anonymous counts of your outreach outcomes (contacted, replied, positive) by product, country and buyer type are combined with other companies' counts. Counts are used only in groups of at least 5 companies, each company's weight is capped, and they are used to improve the reply-rate data everyone sees. No names, email addresses or message content are shared. You can turn sharing off at any time.
12. Cookies and local storage
We set two cookies, and only after you sign in:
| Cookie | Purpose | Lasts |
|---|---|---|
__Host-tg_session | Keeps you signed in (HttpOnly, Secure, SameSite=Lax) | 30 days |
tg_in | Tells the website you are signed in | 30 days |
We use no advertising or analytics cookies. You can block cookies in your browser, but then you cannot sign in. Local storage is described in section 2.3.
13. Security
We use encrypted connections (TLS), store passwords with argon2id, store API keys, OAuth tokens and session tokens only as hashes, limit staff access to what each task needs, and rate-limit requests. No system is perfectly secure. To report a security issue, email [email protected] with [Security] in the subject.
14. Changes
We post any new version on this page with its effective date. For important changes we also tell you on the website or by email at least 7 days before they apply, or 30 days before if they reduce your rights.
15. Contact
GRINDA AI Co., Ltd., 503, 99 Daehak-ro, Yuseong-gu, Daejeon 34134, Republic of Korea.
Privacy officer: Hojin Kang, CEO · [email protected] · +82 10-6326-9009