Your data, plainly explained.

1. Who is responsible

Grido AB (org. no. 559480-1945), c/- Dockplatsen 16, 211 19 Malmö, Sweden. Email: support@gri.do.

For this website and for accounts of businesses using Waitlisted, we are the controller.

For the waitlists themselves, the business running a waitlist is the controller of the data of people who join it. We process that data on its behalf (Art. 28 GDPR). If you joined a waitlist, please contact that business about your data; we will help it answer. Businesses using Waitlisted find our data processing agreement at waitlisted.me/dpa.

2. Visiting this website

When you open a page, your browser sends technical data (IP address, time, page, browser) to our hosting provider, Vercel Inc. This is needed to deliver the page and keep it secure (Art. 6(1)(f) GDPR). Logs are kept briefly and then deleted.

Fonts are served from our own server. Your browser does not connect to Google for them.

Waitlist and response pages use Cloudflare Turnstile (Cloudflare, Inc., USA) to tell people from bots before a form is sent. Your browser connects to Cloudflare, which looks at technical signals such as your IP address and browser; we only receive a pass or fail, and don’t store it. Legal basis: our legitimate interest in keeping the forms, and the people on the lists, safe from spam (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.

3. Accounts for businesses

To sign up you give your email address and business name. We use them to run your account, send sign-in links and codes, and contact you about the service (Art. 6(1)(b) GDPR). If you choose to sign in with Google or Apple, they send us your email address and name (Apple may send a private relay address instead); we use them the same way. The data is stored with Supabase Inc. in the EU (Ireland).

A business can invite other people by email to help run one of its waitlists as admins. We send the invite and keep the invited address until it is used, cancelled or expires after 14 days. Admins sign in with their own address and can see and manage that one waitlist, including the people on it, on behalf of the business; the business decides who its admins are and can remove them at any time (Art. 6(1)(b) and Art. 28 GDPR).

A business owner can also hand the whole account over to someone else by email. We send the offer and keep that address until it is accepted, cancelled or expires after 14 days. Once accepted, the account with its pages, the people on them and its plan belongs to the new owner, and the previous owner loses access; we tell the previous owner by email and send Stripe the new owner’s email address for receipts (Art. 6(1)(b) GDPR).

Payments for the plan are handled by Stripe Payments Europe Ltd. (Ireland). When you subscribe, Stripe receives your email address, business name and the billing details you enter there (card, billing address, VAT number) to take payments and issue invoices (Art. 6(1)(b) GDPR). We never see your full card details; we store only your Stripe customer number and the state of your plan. Stripe may transfer data to Stripe, Inc. (USA), covered by the EU-US Data Privacy Framework and standard contractual clauses.

4. Joining a waitlist

When you join a waitlist you give your email address, optionally your name, and the answers the business asks for. They are used to keep your place, show it on your personal status page, and email you about it (joined, a spot offered, messages from the business). They are stored with Supabase in the EU (Ireland) until the business deletes the waitlist or your entry.

A business can also add people it already had on its own list by importing them (email address, name and answers); it is responsible for being allowed to do that. Imported people are not emailed when they are added.

For each email we send you about a waitlist we keep which kind it was (joined, spot offered, spot accepted or a message, with its subject) and when it was sent, so the business can see who has heard from them. This record is deleted after 90 days, or earlier with your entry.

Emails are sent through Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg; servers in the EU). During our switch to it, some emails may still go through Resend Inc. (USA); transfers there are covered by the EU-US Data Privacy Framework and standard contractual clauses. We record whether an email was delivered, bounced or marked as spam, to stop emailing addresses that don’t work or don’t want our emails (legitimate interest, Art. 6(1)(f) GDPR). These delivery records are deleted after 90 days; a blocked address is kept so it isn’t emailed again. Messages from a business to its list carry a link to unsubscribe from them.

We do not use analytics on join pages, status pages or in emails.

5. Analytics

On our marketing pages and in the dashboard for businesses we use PostHog (PostHog Inc., data hosted in the EU, Frankfurt) to understand which pages are used and where people get stuck. No cookies and no local storage are used, IP addresses are not stored, and every visit counts as a new anonymous visitor. For signed-in businesses, events are linked to the account (for example “waitlist published”). Legal basis: legitimate interest in improving the product (Art. 6(1)(f) GDPR). You can object at any time by emailing us; blocking the requests in your browser also works.

6. Photos from Unsplash

Some pages show photos from Unsplash. Unsplash requires these photos to be loaded from its own servers, so your browser connects to Unsplash Inc. (USA) and transmits your IP address when such a page is shown (Art. 6(1)(f) GDPR: showing the photo the page was designed with).

7. Cookies

We only set cookies that are needed for the service (Art. 5(3) ePrivacy Directive; in Germany § 25(2) TDDDG): a sign-in cookie for businesses using the dashboard, and “wl_lang”, which remembers the language you chose, for one year. We don’t use advertising or tracking cookies.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest (Art. 15–21 GDPR). Write to us at support@gri.do. You may also complain to a data protection supervisory authority: our lead authority is the Swedish Authority for Privacy Protection (IMY, imy.se), or the authority where you live.