Grain procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | medium | “ Your Data is currently hosted by Grain or its authorized service partners in data centers located in the United States. If Your principal location is within the United States, we will use commercially reasonable efforts to notify You at least thirty (30) days before our election to host Personal Data provided to Grain in connection with use of the Service in data centers located outside the United States. If You are entitled to this notice and do not wish to have Your Personal Data hosted in data centers located in such other country or territory, You may terminate Your Subscription and Your Account with immediate effect upon written notice to Grain within thirty (30) days or Your receipt of such notice.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We will retain Personal Information that we store and process on behalf of our Subscribers for as long as needed to provide the Services to our Subscribers. We will retain and use this Personal Information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “If you are a Subscriber or otherwise provide us with Personal Information in connection with your use of our Websites or Services, we will delete this information upon your request, provided that, notwithstanding such request, this information may be retained for as long as you maintain an account for our Services, or as needed to provide you with our Services (in particular for Accounts with multiple Users where we need to retain the interaction with Users who continue to use the Services), comply with our legal obligations, resolve disputes and enforce our agreements.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “Following the termination or cancellation of Your subscription to the Service and/or Account, We reserve the right to delete all Your Data in the normal course of operation. Your Data cannot be recovered once Your Account is canceled.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Upon request, we will provide you with information about whether we hold and otherwise process, or process on behalf of a third party, any of your Personal Information. To request this information please contact us at privacy@grain.co. Subscribers to our Services may update or change their Account Information by editing their profile or organization record or by contacting privacy@grain.co for more detailed instructions. To make a request to have Personal Information maintained by us returned to you or removed, please email privacy@grain.co. Requests to access, change, or remove your information will be handled within thirty 30 days. An individual who seeks access to, or who seeks to correct, amend, or delete inaccuracies in Personal Information stored or processed by us on behalf of a Subscriber should direct his/her query to the Subscriber (the data controller). Upon receipt of a request from one of our Subscribers for us to remove the data, we will respond to their request within thirty (30) days. We will retain Personal Information that we store and process on behalf of our Subscribers for as long as needed to provide the Services to our Subscribers. We will retain and use this Personal Information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. If you are a Subscriber or otherwise provide us with Personal Information in connection with your use of our Websites or Services, we will delete this information upon your request, provided that, notwithstanding such request, this information may be retained for as long as you maintain an account for our Services, or as needed to provide you with our Services (in particular for Accounts with multiple Users where we need to retain the interaction with Users who continue to” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may assign or transfer this Policy, as well as your account and related information and data, including any Personal Information, to any person or entity that acquires all or substantially all of our business, stock or assets, or with whom we merge.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We’ll process your data when we have a legal obligation to do so, for example, if we’re responding to legal process or an enforceable governmental request.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 3.3 You agree that Grain and the service providers We use to assist in providing the Service to You shall have the right to access Your Account and to use, modify, reproduce, distribute, display and disclose Your Data solely to the extent necessary to provide the Service, including, without limitation, in response to Your support requests. Any third party service providers We utilize will only be given access to Your Account and Your Data as is reasonably necessary to provide the Service and will be subject to (a) confidentiality obligations which are commercially reasonable and substantially consistent with the standards described in Section 3.2; and (b) their agreement to comply with the data transfer restrictions applicable to Personal Data as set forth in Section 3.4. Grain may also access or disclose information about You, Your Account, Users or End-Users, including Your Data, in order to (a) comply with the law or respond to lawful requests or legal process; (b) protect Grain’s or its customers’ or partners’ rights or property, including enforcement of these Terms or other policies associated with the Service; (c) act on a good faith belief that such disclosure is necessary to protect personal safety or avoid violation of applicable law or regulation. 3.4 We collect certain information about You, Users, and End-Users as well as Your and their respective devices, computers and use of the Service. We use, disclose, and protect this information as described in Our Privacy Policy, the then-current version of which is available at [ https://www.grain.co/privacy-policy ] and is incorporated into the Terms. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ (iii) When we’re complying with legal obligations” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “In certain situations, we may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may disclose Personal Information to respond to subpoenas, court orders, or legal process, or to establish or exercise our legal rights or defend against legal claims. We may also share such information if we believe it is necessary in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our Service Agreement, or as otherwise required by law.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may transfer Personal Information to companies that help us provide our Services to Subscribers.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 6.4 Unless otherwise stated, Our charges do not include any taxes, levies, duties or similar governmental assessments, including value-added, sales, use or withholding taxes assessable by any local, state, provincial or foreign jurisdiction (collectively “Taxes”). You are responsible for paying Taxes except those assessable against Grain based on its income. We will invoice You for such Taxes if We believe We have a legal obligation to do so and You agree to pay such Taxes if so invoiced. 6.5 If You pay by credit card, the Service provides an interface for the account owner to change credit card information (e.g. upon card renewal). The Account owner will receive a receipt upon each receipt of payment by Grain, or they may obtain a receipt from within the Service to track subscription status. You hereby authorize Grain to bill Your credit card or another payment instrument in advance on a periodic basis in accordance with the terms of the Service Plan until you terminate your Subscription, and you further agree to pay any Subscription Charges so incurred. Grain uses a third-party intermediary to manage credit card processing and this intermediary is not permitted to store, retain or use Your billing information except to process Your credit card information for Grain.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Social Media Widgets: The Websites include social media features, such as the Facebook Like button, and widgets, such as the Share This button or interactive mini-programs that run on our Websites. These features may collect your Internet protocol address, which page you are visiting on the Websites, and may set a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or hosted directly on the Websites. Your interactions with these features are governed by the privacy statement of the companies that provide them. Information From Third Party Services: We may also obtain other information, including Personal Information, from third parties and combine that with information we collect through our Websites. For example, we may have access to certain information from a third party authentication service if you log into our Services through such a service or otherwise provide us with access to information from the service. Any access that we may have to such information from a third party social media or authentication service is in accordance with the authorization procedures determined by that service. By authorizing us to connect with a third party service, you authorize us to access and store your name, email address(es), current city, profile picture URL, and other Personal Information that the third party service makes available to us, and to use and disclose it in accordance with this Policy. You should check your privacy settings on these third party services to understand and change the information sent to us through these services. For example, you can log in to the Services using sign-in services such as Google Authentication, as further described below.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ If you have purchased a subscription to our Services additional terms relating to data rights are set forth in and governed by our Terms of Service, available here: [ https://www.grain.co/terms ], or such other applicable agreement between you and any member of the Grain relating to your access to and use of such Services (“Service Agreement”). We may transfer Personal Information to companies that help us provide our Services to Subscribers.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.