Privacy Policy

02Who we are

Grace is operated by Beyond the Brackets USA LLC, a Delaware limited liability company, 8 The Green, STE R, Dover, DE 19901, USA (“we”, “us”). We decide why and how the personal data described on this page is processed, which makes us its controller under the GDPR and the business responsible for it under US state privacy laws.

For anything on this page, write to hello@agent-grace.com. We answer in English or French.

03What this policy covers

This website (www.agent-grace.com), the Grace app (app.agent-grace.com), the Grace Guardian plugin and editor connection, the calls you book with us, and the emails we send.

It does not cover personal data about your own users that sits inside the code, the error reports or the app data you connect to Grace. We process that on your behalf, as your processor, under our Data Processing Addendum.

04What we collect, and why

When you visit this website

• Technical data your browser sends with every request: IP address, browser and device type, the page requested, the time and the referring page. Our host logs it to serve the site and keep it secure. The booking and measurement endpoints also hold your IP address in memory for up to an hour, to limit abuse.
• Your cookie choice, so we don't ask again on every page or again in the app.
• If you accept Meta's cookies: the Meta Pixel loads, and we set two identifiers (_fbp and _fbc) that let Meta connect a visit to an ad. Meta receives the pages you view, the main buttons you click and whether you book a call. When you book, our server also tells Meta directly, with your IP address, browser type and those identifiers. We don't send Meta your name or email from this website. If you decline, none of this happens. Details are in our Cookie Policy.
• The chat window is Pipedrive's. What you type in it goes to our CRM. Its script loads on every page and stores identifiers in your browser so a conversation can follow you from page to page.
• Which call-to-action buttons are clicked is recorded in a list held in your browser's memory. Nothing is sent from that list unless you have accepted Meta's cookies.

When you book a call

• The form asks for your role, name, work email, company or product name, app URL, what the app was built with, whether it is live, how it is funded (founders) or how many client apps you look after (agencies), how urgent this is, whether the budget fits, and what worries you.
• We record your answers in our CRM, whether or not you go on to book, and share them with the Grace app so the engineer on your call can read them first. If the CRM is unavailable, they are emailed to our team instead.
• Cal.com runs the calendar. It receives the time you choose, your name, email and notes, and sends your invite and a reminder an hour before the call.
• We email you a confirmation, a note the day before, and a message if we miss each other. For the day-before note, we ask the Grace app whether you have an account, have connected an app and have a finished audit, so we send the version that fits.
• If you open the form from inside the Grace app, it is filled in with what the app knows about you. That travels in the part of the link after "#", which your browser never sends to a server.

When you create an account

• Your name, email and password. The password is stored only as a one-way hash: nobody can read it, us included. We use it only to sign you in.
• Or, if you sign in with Google or GitHub: your name, email and profile picture from that service, and the tokens it returns so you stay signed in.
• For each sign-in session: your IP address and browser type, to keep you signed in and spot misuse.
• If you join an account someone else set up, its owners can see your name, your email and what you do in that account.

When you connect an app

• GitHub. Connecting GitHub from the app asks for GitHub's repo permission, which is read and write access to your repositories. Grace uses it to read the repositories you choose, and to deliver fixes: it pushes them to its own grace/ branches and opens pull requests. It never pushes to your main branch, and nothing is merged without your approval. The Grace GitHub App, if you install it instead, is limited to the repositories you pick, with read access to your code and read and write access to pull requests, checks and commit statuses. GitHub shows exactly what you granted in your settings, and you can revoke it there at any time. We fetch the files of the repositories you choose and keep a copy on our servers in France.
• A ZIP upload. We keep the extracted files until you delete the app.
• A folder on your computer, through your editor. Grace registers the project from its metadata and receives neither your code nor the folder's path. When the Grace Guardian checks run in your editor, the text about to be written, your prompts and the commands about to run are sent to our servers to be checked, for example for secrets. What we keep is a record of the file paths and commands involved, for between one and 90 days, never the value of a secret.
• Sentry, if you connect it. We read your error reports and keep the exception type, message and stack frames. Error messages sometimes contain personal data from your app; Grace does not remove it.
• What Grace produces from all of this is stored too: audit results, findings and their evidence, reports, the log of each run, your conversations with Grace, and a map of your code (summaries, file paths, and how the parts connect).

When you pay

Stripe runs checkout and the billing portal. Your card details go to Stripe and never reach us. Stripe collects your billing name and address, and a tax ID where one is needed. We keep Stripe's references, your plan, the amounts, your invoices and whether each payment went through. If you accept Meta's cookies, the app also tells Meta when you sign up or buy, with a hashed (scrambled, one-way) copy of your email and an internal account number, so Meta can tell which ads led there.

When we email you, or you talk to us

• Emails about your account and the service: verification, reports, billing, booking. These come with the service.
• Digests, which you can turn off from the link in each one.
• Occasional emails to people we think Grace could help, sent to work addresses. You can ask us to stop at any time, and we will.
• Some of our emails record whether they were opened and which links were clicked.
• When you write to us, chat with us or talk to us on a call, we keep what you tell us and the notes we take, so the next conversation starts where the last one ended.

05How AI is used on your code

To audit, review and fix your app, Grace sends your code, your diffs, your error reports and your conversations with it to AI models. An audit sends the whole codebase, in batches. The requests go through Vercel's AI Gateway to the provider of the model in use: by default Google (Gemini), with OpenAI indexing the code. Other providers on the gateway, such as Anthropic, receive data only when one of their models is selected for a task, in your settings or by us.

We don't use your code to train AI models. The providers process it under their API terms to return a result. We have not set up zero-data-retention arrangements with them, so a provider may keep a request for a limited period under its own terms, typically to monitor abuse.

At the end of a run, Grace also writes general lessons about how the work went, for example a step that had to be redone. An automated step is designed to strip anything that identifies an account, a project, a repository, a file or code, and only the abstract lesson is kept. We use these lessons to improve Grace.

06Who at Beyond the Brackets sees your data

Our engineers see your account and your apps' data when they deliver the human parts of your plan (a report walkthrough, a monthly review, the fixes in Make It Solid), when you ask for help, and when they investigate a security issue or misuse. To help you, an authorized administrator can view the app signed in as you. Access is limited to the people who need it for those purposes, and every one of them is bound by confidentiality.

07Legal bases (EEA, UK and Switzerland)

08Who we share it with

These companies process personal data for us, each only for the purpose listed. We don't sell personal data.

Beyond them, we share personal data only with our professional advisers (lawyers, accountants) under confidentiality, with authorities when the law requires it, and with a buyer or successor if the business changes hands, who would be bound by this policy.

09International transfers

We are a US company, the Grace app is hosted in France, and several of the services above are in the United States. When personal data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, we rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses, with the UK and Swiss addenda. Ask us and we will send you a copy of the safeguards that apply.

10How long we keep it

When you delete an app, its files and everything Grace produced about it are removed within hours. We keep the records of what you paid for it, because the law requires it.

11Your rights

Wherever you live, you can ask us for a copy of your personal data, ask us to correct it, delete it, or send it to you in a machine-readable format, and ask us to stop writing to you. If you are in the EEA, the UK or Switzerland, you can also object to processing based on our legitimate interests, ask us to restrict processing, and withdraw your consent at any time without affecting what came before.

Some of this you can do yourself: delete an app from the app, turn off digests from any digest email, and change your cookie choice from the Cookie settings link at the foot of every page. For the rest, including deleting your account, write to hello@agent-grace.com. We may ask you to confirm your identity, and we answer within one month.

If you think we have mishandled your data, tell us first and we will try to put it right. You can also complain to the data protection authority where you live or work, such as the CNIL in France or the ICO in the United Kingdom.

12US state privacy rights

If you live in California, Colorado, Connecticut, Virginia or another state with a comprehensive privacy law, you have the right to know what personal data we collect and why, to access it, correct it, delete it and take a portable copy, and to opt out of its sale, of its “sharing” for cross-context behavioral advertising, and of targeted advertising.

We don't sell personal data for money. If you accept Meta's cookies, the Meta Pixel may count as sharing or targeted advertising under some of these laws. You opt out by declining in Cookie settings, and we treat a Global Privacy Control signal from your browser as that opt-out, without asking.

In the last twelve months we collected the categories described above: identifiers (name, email, IP address, online identifiers), commercial information (plan and purchases), internet activity on our site and app, and professional information (your role and company). We collected them from you, from your browser, and from the services you connect, for the purposes on this page, and disclosed them only to the companies listed above. Your password is used only to sign you in.

To use these rights, write to hello@agent-grace.com, or have someone you have authorized write to us for you. We won't treat you differently for using them. If we decline a request, you can appeal by replying to our answer, and we will respond within 45 days.

13Security

• Every connection to the site and the app is encrypted (HTTPS).
• Each account's data is isolated from every other account's.
• The access tokens for the code services you connect are encrypted at rest.
• Passwords, and the keys that connect your editor, are stored only as hashes.
• Access by our team is limited to the purposes described above.

No system is perfectly secure. If a breach affects your data, we will tell you, and the authorities, as the law requires. Found a vulnerability? Write to hello@agent-grace.com; our security.txt explains what is in scope.

14Children

Grace is a service for businesses. It is not meant for anyone under 18, and we don't knowingly collect personal data from children.

15Changes to this policy

When this policy changes, we publish the new version here with a new date. If a change matters, for example a new use of your data, we email account holders before it takes effect.

16Contact

Beyond the Brackets USA LLC. Email hello@agent-grace.com. For how we use cookies, see the Cookie Policy; for the rules of using Grace, the Terms of Service.