Privacy Policy

1. Controller and scope

GRAYINVESTED operates a commodity research desk, account workspace and research brief mailing list. The controller is GRAYINVESTED LLC, a New Mexico limited liability company.

Contact the desk at desk@grayinvested.com for privacy questions or to exercise your rights. This notice covers account access, research, requests, correspondence and mailing preferences, not independent third-party websites.

2. Information collected and purposes

• Account email, optional display name and avatar, sign-in verification state, login records and access status, to create and secure accounts and provide research access.
• Name, company, email, decision, commodity exposure, timeline, request messages and attachments that you submit, to assess and deliver research engagements and respond to correspondence.
• Mailing-list email, signup source, category preferences, unsubscribe status and delivery records, to deliver requested research briefs and respect opt-outs.
• Subscription and payment references where applicable. Stripe handles payment-card details; the platform keeps billing and access records rather than full card numbers.
• Device and usage information, including page views, clicks, scroll depth and engagement, collected by the analytics integrations described below. Signed-in legacy report readers also record reading time, opens and scroll depth.
• Security and operational logs generated by hosting and service providers.

Do not send sensitive personal data or confidential third-party information unless necessary for an agreed engagement. The platform does not need sensitive personal data to create a research account.

3. Lawful bases and mailing consent

Account access, requested research and correspondence rely on performance of a contract or steps requested before entering a contract. Necessary security and abuse prevention rely on legitimate interests in protecting the service, balanced against your rights. Statutory record keeping relies on legal obligations.

Optional research brief broadcasts require separate, informed consent. Providing an email for account sign-in is not, by itself, consent to broadcasts. Sign-in code emails are transactional and are sent through Resend.

You may withdraw mailing consent using the unsubscribe link or change categories using the preferences link in a brief, or contact the desk. Unsubscribing from briefs does not cancel an account or necessary service messages.

The research mailing list is optional. Subscribers receive the desk's research dispatch, which carries memo headlines, the desk's calls and the running record of outcomes, and nothing else. Every dispatch carries an unsubscribe link and a link to a preferences page where you choose which categories you receive.

4. Processors and international transfers

• Lovable supplies platform hosting and managed cloud infrastructure.
• The underlying cloud infrastructure provider supplies authentication, database and file storage. Data is hosted in the eu-west-1 region (Ireland).
• Resend delivers transactional sign-in and correspondence emails, and the separate research dispatch stream.
• Google Analytics 4 measures site usage, only after consent.
• Stripe processes payments and billing where those services are used.
• Cal.com supplies the booking service when you choose to open it. Google Fonts supplies remotely loaded typefaces.

These services may process data outside the EEA. Where they do, transfers rely on the providers' standard contractual clauses or equivalent safeguards.

Personal information is not offered for sale by the platform.

5. Cookies, local storage and tracking

Authentication uses browser storage for the signed-in session. The app also stores theme, release-refresh markers, saved items, editor-preview state and local abuse counters. These storage items are distinct from cookies. A sidebar-state cookie is implemented with a seven-day lifetime where that sidebar is used.

Google Analytics 4 loads only after you choose Accept in the cookie banner. The default is off. You can change or withdraw your choice at any time: Cookie settings.

The browser check observed _ga and _ga_YD0D5555YG cookies with approximately 400-day lifetimes, _gid with a one-day lifetime, plus a short-lived _gat cookie. Their exact names, durations and whether they are set on each live route depend on provider settings and browser restrictions. Essential security cookies may also be set by hosting.

No email tracking occurs. Open and click tracking are switched off for every email the platform sends, including the research dispatch, so emails contain no tracking pixel and links are not rewritten.

6. Retention and deletion

Sign-in codes expire after ten minutes and successful verification removes the code record. Expired codes are rejected. Login-attempt cleanup in the existing flow targets records older than twenty-four hours. Deleted research requests can be recovered for thirty days.

Account records remain while the account is active. Self-service account deletion removes the identity, profile and avatar but can leave detached client history, requests, correspondence, mailing-list and suppression records. It is not complete erasure of all personal data. Contact the desk for an erasure request covering those records.

Subscriber addresses, delivery logs and correspondence are kept until you ask for them to be removed or unsubscribe, after which only a suppression record is kept. Analytics data is retained according to the Google Analytics settings for the property. Billing records are kept as long as the law requires.

Only a minimal suppression record is retained as necessary to avoid emailing an unsubscribed recipient again. Legal obligations and properly documented legal claims may require limited retention, and such exceptions are explained when responding to a request.

7. Your rights

Subject to applicable law, you may request access, correction, erasure, restriction, objection and a portable copy of data you provided where processing is automated and based on consent or contract. You may withdraw consent without affecting earlier lawful processing. Email desk@grayinvested.com; reasonable identity checks may be required.

Requests are answered within 30 days. Any permitted extension is explained within that period. You may complain to your local supervisory authority, including the CNIL in France. Mandatory rights are not removed by the Terms or a choice of governing law.

8. Security, children and updates

Database access uses record-level controls. Request attachments and research charts are private; approved public memo covers and brand images may be publicly readable. Encrypted transport and access checks reduce risk but cannot guarantee perfect security.

The service is intended for adults. Contact the desk if personal information about a child has been submitted. Material changes will be identified by an updated effective date and communicated where legally required. Continued browsing is not a substitute for consent to new optional processing.