Privacy policy

This policy explains what Graunt collects, how Graunt uses it, and the choices you have. Graunt is a marketplace for machine-usable data packets, operated from the United States and not directed to users in any other jurisdiction. Graunt collects the minimum needed to run the marketplace and does not sell personal information.

The document this summarises

This page is a plain-language summary. The binding document is the full Privacy Policy, currently version 1.11, effective October 21, 2026. Read the exact text. New acceptances are recorded against those exact bytes by their SHA-256. If you accepted an earlier version, your record stays pinned to the version you were shown. You can request that version from support@graunt.com.

sha256:2cff8eebe2718aed172c5b04d4c0a57512f03ddf3e469634ef5e4be24efdd3a5

What we collect

Account information: your name, your email address (stored encrypted), whether you hold the account for yourself or for an organization and that organization's name, and your acceptance of legal terms.

Marketplace activity: the listings you create or acquire, your entitlements and delivery records, support requests, audit records of account actions, and the AI assistants and agents you connect or create, with what they do in your account.

Technical data: basic request information needed to operate and secure the service, such as a coarse, privacy-bounded record of access for abuse prevention. Graunt does not require third-party advertising trackers to use the marketplace.

How you arrived, and the pages you view: a first-party cookie with a random identifier, the marketing source of your first visit, and a record of the pages loaded in your browser under that identifier. See Measuring where visitors come from.

Approximate location: a coarse country label derived locally from your IP address, and — for account registrations from the United States — the state. See Approximate location.

Measuring where visitors come from

Graunt keeps its own count of which channels bring people here. On your first visit Graunt sets a first-party cookie holding a randomly generated identifier and keeps one record for it: the utm_source, utm_medium, utm_campaign, utm_term and utm_content parameters on the link you followed, the host and path of the site that referred you, and whether the link carried an advertising click identifier and which advertising network it came from — noted as present, never the value. The record also carries a coarse classification of your client, such as browser or automated agent, and when you first and last visited.

Automated crawlers are left out on purpose. Requests Graunt identifies as search-engine indexers, AI training crawlers, or other recognized bots get no cookie and produce no record — crawler traffic is counted separately as an aggregate number and is never attributed to a traffic source. Being excluded changes only what Graunt records; it never changes what a crawler is served.

The record holds no name, no email address, no IP address, and no browser user-agent string. If you go on to create an account, sign in, publish a listing, redeem an access code, or complete a purchase, Graunt records that event against the same identifier, with your account identifiers and the transaction amount, so a sale can be traced to its channel. From that point Graunt treats the record as personal information under this policy.

Each page that loads in your browser reports its path and the kind of page, under the same identifier; Graunt uses these records to count visits and see which pages people use, and keeps them for 180 days. This measurement stays inside Graunt. It is not shared with any advertising network or third-party analytics vendor, and it is not used to build advertising profiles or to target ads.

A visit record is deleted after 365 days without activity; event records are kept for 730 days to match accounting and dispute periods. Clearing cookies in your browser unlinks your later visits from the record, and you can ask Graunt to delete these records at support@graunt.com.

Approximate location

Graunt derives a coarse location from your IP address at the time of a request: the country, and — for account registrations from the United States — the state or territory. The lookup runs locally, on Graunt's own servers, against a stored, versioned dataset. Your IP address is not sent to any geolocation provider or other third party; approximate location is derived locally. The result is an estimate of where the network address appears to be — not a statement of anyone's residence, nationality, or physical location — and it can be wrong: mobile carriers, corporate networks, and VPNs routinely place traffic far from the person using them.

What is stored is the derived label only, together with the version of the dataset that produced it. Usage measurements may carry a country label — country is the only location detail on usage records. Graunt does not retain, display, or log city, postal-code, or coordinate lookup results about a request or an account: the dataset on Graunt's servers contains that finer detail, and only the country and, for United States registrations, an approximate state or territory code are copied into Graunt's records. The account record keeps that country and state, derived once at registration and not recomputed later. If the account is deactivated or its registration identity is released, the derived origin is removed from the account record. If the dataset cannot place an address, nothing is recorded. Location labels are not added to the "how you arrived" record above, and accounts registered before this practice began carry no derived origin.

This signal stays inside Graunt. It appears in Graunt's own operator views in aggregate — with small counts grouped together — and on internal account administration records. It is never shown on public marketplace surfaces, and no automated system reads it — nothing prices, ranks, gates, or rate-limits by it. In a manual fraud or abuse review, Graunt's operator may see the label as context beside the account's other records; it is never the sole basis for an adverse action against an account.

Proof of what you agreed to

When you accept a legal document — the Terms of Service, this policy, the Acceptable Use Policy and the electronic-records consent when you open an account; the Seller Agreement and the rights attestation before your first listing; the Acceptable Use Policy again with each listing; the Buyer Terms when you pay; the referral and contributor terms when you join those programs — Graunt records that acceptance and keeps it as evidence of the agreement. The record names the account that accepted, and the agent if one accepted for you, the document and its version, a cryptographic hash of that document's exact text, when it happened, and where in the service it happened. The hash is the point: it pins the exact wording agreed to, rather than naming a document that may since have been revised.

The record also holds the IP address and browser user-agent string present at that moment, as evidence of where and how the acceptance was made. These are stored in full, not hashed — a separate, durable record, not the rolling operational log, and not kept for the same period. If a question ever arises about whether an account agreed to a particular version of Graunt's terms, this record is the answer; that is its only job.

Acceptance records appear on Graunt's internal account administration records. They are never shown on public marketplace surfaces, never sent to an advertising network or a third-party analytics vendor, and never used for advertising, ranking, or pricing. The acceptance itself is kept for the life of the account record. The IP address and user-agent on it are kept for the life of the account's registration identity and are cleared when that identity is released — a registration that never verifies its email address and is later retired is the case that happens in practice.

How we use it

To provide the marketplace — create and authenticate accounts, process purchases, grant and deliver entitlements, surface evaluation evidence, run search, handle support and disputes, prevent fraud and abuse, and meet legal and tax obligations. Graunt uses your information to operate the service you asked for; it is not used to build advertising profiles.

Payments

Payments are processed by Stripe. Graunt does not store full payment-card numbers. Stripe processes card and payout data under its own terms and privacy policy as part of completing your transactions and seller payouts.

Service providers

Graunt uses a small set of providers to run the service, and the accepted Privacy Policy names each one. Amazon Web Services hosts the platform and delivers transactional email. Stripe processes payments, payouts, and tax calculation and reporting. Sentry receives redacted error reports, with secrets, tokens, and personal identifiers scrubbed before they are sent. Zoho Corporation hosts Graunt's mailboxes, including support@graunt.com, so it carries what you write to Graunt and Graunt's replies.

Anthropic, OpenAI and xAI process packet content when a seller runs the Refinery on their own upload. What they receive is the seller-submitted content being prepared for listing — not your platform-account personal information. For speech-to-text, OpenAI receives the audio of a seller's recordings and returns the words spoken with their times. Anthropic also sorts the replies people send to Graunt's invitations to sell, so a request to stop is honored even before anyone has read it.

These providers process data only to provide their service to Graunt and are not permitted to use it for their own purposes. Graunt may also disclose information when required by law or to protect the marketplace, its users, and rights-holders.

People Graunt invites to sell

Graunt invites people who publish datasets to sell them on Graunt. It finds them through public dataset pages and the publisher's own website, and writes only to an email address printed on that website, and only when the site shows the person is in the United States. Graunt keeps the person's name, that address, the pages it came from, what was sent, and their replies. Every message says how to opt out; after an opt-out Graunt deletes the address and keeps only a one-way fingerprint of it, so it never writes again. Anyone Graunt has written to can ask for their information to be deleted at support@graunt.com.

Cookies

Graunt sets only first-party cookies: a sign-in cookie that keeps you signed in, a signed-in hint that holds no identifier, the traffic-source cookie described above (it expires after 90 days), and a marker set only on Graunt staff browsers so Graunt does not count itself. There are no third-party advertising or analytics cookies.

Security and retention

Graunt protects information with access controls, encryption in transit, scoped credentials, and audit logging. Secrets and access tokens are never shown in URLs and are returned to you only once at creation. Graunt keeps information for as long as needed to provide the marketplace and to meet legal, accounting, and dispute-resolution obligations, then removes or de-identifies it.

Your choices

You can review and update your account information, and you can request access to or deletion of your personal information by contacting support@graunt.com. Some records — for example completed-transaction and audit records — may be retained where the law requires. Graunt is a U.S. service and is not directed to children under 13, who may not use it.

Copyright notices

Notices of claimed copyright infringement go to Graunt's DMCA designated agent, JACO Digital, at DMCANotice@jacodigital.com or 10990 Wilshire Blvd., Suite 1025, Los Angeles, CA 90024, (310) 469-9800. See the DMCA Policy for the full notice-and-takedown process.

Changes and contact

Graunt may update this policy. A material change is announced on this page 30 days before it takes effect; other changes take effect when published. Questions about privacy: support@graunt.com. See also the Terms of Service and the Refund policy.