Privacy policy

Two kinds of information

Most of what is in Ground was put there by a firm about its own investors — entities, commitments, transactions, documents, and correspondence. For that information the firm is the controller and we are its processor: we hold and process it on the firm’s instructions, and if you are an investor asking what is held about you, the firm is the right place to start. We will help them answer.

A smaller amount of information is ours to explain — the account you sign in with, and the records the service keeps in order to run. That is what the rest of this policy covers.

What we collect

• Your account. Your name, email address, role, and the firm whose workspace you belong to.
• Sign-in records. When a sign-in link was issued and used, when a session was opened, and failed password attempts — which we count in order to lock an account that is being guessed at.
• A password, if you set one. We store a scrypt hash, never the password itself. Setting one is optional; the emailed link always works, which is why there is no reset flow and no reset token to leak.
• Activity within the workspace. Who did what and when — an update published, a document uploaded, a member added. This is what lets a firm answer questions about its own record.
• Technical records. The browser a session was opened from, and standard server logs needed to operate and secure the service.

We do not run advertising, we do not sell personal information, and we do not use third-party tracking or advertising cookies.

Cookies

One cookie, holding a session identifier, set when you sign in. It is HTTP-only, restricted to this site, and sent only over HTTPS. It is what keeps you signed in; signing out revokes it on the server as well as removing it from your browser. No other cookies are set.

How the information is used

To provide the service, to authenticate you, to keep the service secure, to give a firm a record of activity in its own workspace, and to meet legal obligations. We do not use the contents of a firm’s workspace to train machine learning models, and we do not use it for any purpose other than providing the service to that firm.

How it is kept apart

Each firm’s information is separated inside the database itself. Every query runs under the identity of the person making the request, and the database enforces what that person may see. An investor sees their own positions and the documents addressed to them, and cannot reach another investor’s, even if something in the application above goes wrong. That separation is tested automatically on every change to the service.

Passwords are hashed with scrypt at a deliberately high cost. Sign-in links are stored only as a hash, expire, and can be redeemed once. Data is encrypted in transit, and at rest by our hosting providers.

Who else is involved

We use a small number of providers to run the service, each with access limited to what their function requires: cloud hosting and application delivery, a managed PostgreSQL database, transactional email for sign-in codes and notifications, and file storage for documents. We do not otherwise share personal information, except where we are required to by law or where a firm instructs us to.

The service is operated from the United States. If you are outside it, your information will be processed there.

How long it is kept

Workspace information is kept while the firm’s account is active, and for thirty days after it ends so it can be exported, after which it may be deleted. Sessions expire after thirty days and can be revoked sooner from your account settings. Financial records we are required to retain are kept for as long as the law requires.

Your rights

Depending on where you live, you may have the right to ask for a copy of the personal information held about you, to have it corrected or deleted, to object to or restrict its processing, and to complain to a supervisory authority. Where a firm is the controller we will pass your request to them and help them respond.

You can see and change your own account details, and end other active sessions, from your account settings inside the service at any time.

Children

Ground is a tool for businesses and is not directed at children. We do not knowingly collect information about anyone under sixteen.

Changes

We will update this policy as the service changes, and will give notice through the service or by email before a material change takes effect. The date at the top says when it was last revised.

Contact

Write to privacy@groundfirm.co with any question about this policy. Our terms of use cover the rest of the arrangement.