GrimAI Privacy Policy
Last Updated: 8/1/2026
Protecting your privacy is important to us. GrimAI, Inc. ("GrimAI," "we," "our," or "us") provides Persona OS, a multi-tenant runtime and identity layer for governed AI personas, together with related software and services (collectively, the "Platform," and together with our website https://persona-os.ai/ (the "Site") and any other interactions you may have with GrimAI, our "Services"). With this in mind, we are providing this Privacy Policy ("Policy") to explain our practices regarding the collection, use, and disclosure of information that we receive through the Services. This Policy does not apply to any third-party websites, services, or applications, even if they are accessible through the Services. Also, please note that, unless we define a term in this Policy, all capitalized terms used in this Policy have the same meanings as in our Terms of Service. Please make sure that you have read and understood our Terms of Service.
Please read this policy carefully. If you do not agree to this policy, please do not use the Services.
Scope of This Policy
- An "Authorized User" means an individual who accesses the Platform as, or on behalf of, a Customer, including agency personnel.
- A "Customer" means an approved real-estate agency or brokerage (or other entity) that has contracted with GrimAI to access the Platform.
- A "Customer End User" means an individual whose information GrimAI receives from a Customer, or otherwise processes on a Customer's behalf, in connection with tenant-scoped realtor assistant personas — for example, a prospective buyer, renter, or other member of the public who chats with a Customer's persona.
- A "Site Visitor" means an individual who visits the Site or interacts with the Services outside the context of a Customer's use of the Platform.
This Policy applies to our handling of information about Site Visitors, prospective Customers, Customers, and Authorized Users. It does not cover information about Customer End Users that GrimAI receives from a Customer, or otherwise processes on a Customer's behalf, in connection with the Platform (including the content of chats, "End User Communications"). GrimAI processes End User Communications and other Customer End User information under the instructions of the relevant Customer, which is the data controller (or occupies a similar role under applicable privacy law), as described in the applicable Services Agreement between GrimAI and that Customer. GrimAI's obligations as a data processor/service provider are set out in that Services Agreement and are not part of this Policy.
If you are a Customer End User with questions about how your information is collected and processed through the Platform, please contact the agency/brokerage that provided your information to us.
The Information We Collect
We may collect the following categories of personal information (a) directly from you, such as when you create an account, communicate with us, or use the Platform; (b) automatically, from the device and browser you use to access the Services; (c) from cookies and similar technologies, as described below; and (d) from your Customer (agency/brokerage) and from our sub-processors and service providers, in each case in connection with your use of the Platform.
Identifiers
First and last name; business contact information (email, phone, address); username and password credentials; your position/role at your agency; and workspace identifiers.
Commercial Information
Subscription plan and seat information, billing and payment records, payment processing information, and information about your agency's or brokerage's business relationship with GrimAI.
Inferences
We may make inferences about your use of the Platform based on usage telemetry and Platform activity, in order to maintain, secure, and improve the Services.
Device Information
Device type, browser type and language, operating system, IP address, and other online or unique identifiers.
Internet Activity
Session identifiers, pages and features accessed, time spent, and other usage telemetry concerning your interaction with the Services, collected via the cookies described below.
AI-Generated Content and Model Inputs
Persona OS uses generative AI (via Microsoft Azure OpenAI Service) to power tenant-scoped realtor assistant personas. Prompts, durable chat content and related metadata may be processed by our AI sub-processor to generate outputs.
Cookies
We (and our service providers) use cookies and similar technologies to collect certain information automatically when you use the Services. A cookie is a small string of information that a website you visit transfers to your browser for identification purposes. Cookies on the Services are divided into the following categories:
Strictly Necessary Cookies
These are required for operation of the Services. These are session cookies and are erased when you close your browser.
Functional Cookies
These improve the functional performance of the Services and make them easier to use. These are persistent cookies that remain on your device for use during a future visit.
Analytical/Performance Cookies
These help us understand, in the aggregate, how the Services are used so we can measure and improve performance and reliability. These cookies do not identify you individually and are not used for advertising.
How We Use Your Information
- Provide and maintain the Services, including authenticating agency users and provisioning tenant-scoped personas
- Respond to inquiries and provide customer support
- Process subscriptions and payments through Stripe
- Analyze use of the Services, improve the Platform, and develop new features
- Secure the Services and investigate misuse (e.g., tenant-boundary probing, credential misuse, high-volume automated abuse)
- Comply with applicable law
- Establish, exercise, or defend legal rights
Aggregate/De-Identified Information:
We may aggregate and/or de-identify information so it can no longer be linked to you, and may use such information for any purpose, including research, product improvement, and telemetry/aggregated insights as described in our Customer agreements.
How We Disclose Your Information
Sub-processors and Service Providers
We disclose information to select third parties who help us deliver the Services, including hosting, technology, and communications providers. In some instances, a service provider may be directly responsible to you for its use of your personal information and may be obliged by law to provide you with additional information about the personal information it holds and how and why it processes that information; further information may be provided in a separate notice or may be obtained from that service provider directly, such as via its website.
Affiliates
We may share your personal information with our current or future corporate affiliates, including any parent company, subsidiaries, joint venture partners, or other companies under common control with GrimAI, for purposes consistent with this Policy.
Your Agency/Customer
If you are an Authorized User, we may provide your information to your agency to fulfill and enforce the applicable Services Agreement.
Advisers and Financial Institutions
We may disclose personal information to our advisers and financial institutions, including auditors, and legal, tax, risk, and compliance advisors, where necessary to obtain advice or otherwise protect and manage our business interests.
Protection of GrimAI and Others
We may access, retain, and disclose information to government bodies, law enforcement agencies, dispute resolution organizations, or other third parties in connection with (a) responding to a subpoena, search warrant, or other lawful request for information that we receive; (b) cooperating in a law enforcement or similar investigation; or (c) otherwise protecting the rights, property, or safety of GrimAI, its users, or the public, as applicable.
Business Transactions
Information may be disclosed in connection with a change to the control or financial status of GrimAI, including a corporate restructuring, sale, acquisition, financing, reorganization, bankruptcy, receivership, transfer, assignment of assets, or business merger or divestiture. Personal information may be shared in the diligence process with counterparties and others assisting with the transaction, and transferred to a successor or affiliate as part of that transaction.
Aggregate/De-Identified Information
May be disclosed at our discretion; will not identify you personally.
With Your Consent
We may disclose your personal information for any other purpose with your consent.
Retention of Your Information
We retain information for as long as necessary for the purposes for which it is processed, or as required by law.
Your Rights and Choices
Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict our processing of your information, and to opt out of certain processing. To exercise these rights, contact us using the information below.
If you are a Customer End User, please direct rights requests to the agency/brokerage that provided your information to us, and we will provide reasonable assistance to that Customer as required by our Services Agreement.
Third-Party Links and Features
Our Services may link to third-party sites or integrate with third-party platforms. We are not responsible for the privacy practices of those third parties.
International Users
GrimAI currently offers the Services only to U.S. Customers, and the Services are hosted in the United States.
How We Protect Your Information
GrimAI takes technical and organizational measures designed to protect information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction, including tenant isolation controls designed to prevent cross-tenant data access.
Children's and Minors' Privacy
The Services are not directed to, and are not intended for use by, children under the age of 13, consistent with the Children's Online Privacy Protection Act ("COPPA"). GrimAI does not knowingly collect personal information from children under 13. The Platform is offered exclusively to approved agencies/brokerages and their Authorized Users on a business-to-business basis, and is not offered to schools or to the general public. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us using the information in the "Contact Information" section below.
California Residents
This section provides additional information for California residents required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA").
Categories of Personal Information We Collect
In the past 12 months, we may have collected the categories of personal information, as described in the "The Information We Collect" section above.
Sources of Personal Information
We collect personal information directly from you, automatically through your use of the Services, and from the sub-processors and service providers described in the "How We Disclose Your Information" section above.
Purposes for Collection and Use
We collect and use personal information for the business and commercial purposes described in the "How We Use Your Information" section above.
Disclosure of Personal Information
We disclose personal information to the categories of recipients described in the "How We Disclose Your Information" section above.
We Do Not Sell or Share Personal Information
GrimAI does not sell personal information, and does not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA. GrimAI does not knowingly sell or share the personal information of consumers under 16 years of age.
Your California Privacy Rights
Subject to certain exceptions, California residents have the right to:
- Know and access the specific pieces and categories of personal information we have collected about you;
- Delete personal information we have collected from you;
- Correct inaccurate personal information we maintain about you; and
- Not be discriminated against for exercising these rights.
To exercise these rights, contact us using the information in the "Contact Information" section below. We may need to verify your identity before completing your request, such as by confirming information associated with your account. If you use an authorized agent to submit a request, we may require proof of the agent's authorization and may still need to verify your identity directly.
Because GrimAI does not sell or share personal information, there is currently no opt-out mechanism to disable, and no "Do Not Sell or Share My Personal Information" link is provided at this time.
Changes to This Policy
We may update this Policy from time to time. We will post the updated version and revise the 'Last Updated' date above.
Contact Information
GrimAI, Inc.
8 The Green, Suite B
Dover, DE 19901