Grid Heap legal
Privacy Policy
Effective date: 2026-10-02
Grid Heap, Inc. provides heap.page, a service for curated references, structured evidence records, original editorial analysis, saved reading, domain registration, phone-number purchases and transfers, a prepaid balance, paid tools, delivery, and related account features. This Privacy Policy describes how Grid Heap processes personal information through heap.page and activities that link to this policy.
Grid Heap, Inc. is the operator and data controller responsible for the processing described here. References to Grid Heap, we, us, or our mean Grid Heap, Inc. Privacy questions and rights requests are legal matters and must be sent to Grid Heap Legal.
Personal information we collect
The information collected depends on the features used. A visitor to a public page provides less information than a person who creates an account, buys a domain, phone number, or balance, runs a paid tool, follows a Heap, enables email delivery, creates an Agent credential, or submits a request.
Do not provide passwords, authentication tokens, full payment-card numbers, card security codes, government identification numbers, health information, biometric data, or other sensitive information through free-form fields unless Grid Heap specifically requests it through an authorized process.
Information you provide
Grid Heap receives contact data such as name and email address; account and profile data supplied through Clerk; communications and support messages; subscription and delivery preferences; content-correction details; and transaction references supplied for billing support.
- Contact data, including name, email address, and any company information you choose to provide.
- Account data, including the account identifier, authentication state, and verified primary email supplied by the identity provider.
- Communications data, including support requests, privacy or legal notices, feedback, and related correspondence.
- Transactional data, including product, amount, currency, tax, checkout state, renewal settings, refund state, and transaction identifiers.
- Preference and content data, including followed Heaps, delivery mode, saved progress, correction requests, and labels for Agent credentials.
Information collected automatically
Infrastructure providers process IP address, request time, URL, response status, browser and device information, language, referral information, security signals, and approximate region to deliver and protect the service. Grid Heap's product analytics pipeline records privacy-minimized route, event, status, and hour fields without placing names, email addresses, account subjects, cookies, IP addresses, or full request URLs in those analytics events.
- Device and request data needed for network delivery, compatibility, fraud prevention, and security.
- Online activity needed to serve a requested page and maintain limited aggregate product measurements.
- Communication interaction or delivery data generated when an authorized operational or subscribed email is processed.
Payment information
Grid Heap does not receive or store full payment-card numbers, card security codes, or payment-account credentials. Which party collects your payment details depends on the purchase.
- Domain orders: Grid Heap is the seller and Stripe processes the payment through Stripe Checkout. Grid Heap receives the billing email, billing address, amount, tax, and payment identifiers. If you turn on automatic renewal, Stripe saves your card to a Stripe customer record, and Grid Heap stores the reference to that card and uses the saved billing address to calculate renewal tax.
- Balance top-ups: Stripe is the merchant of record through Stripe Managed Payments and its Link checkout, and processes your payment, tax, and receipt as a controller under Stripe's and Link's own privacy notices. Grid Heap receives the top-up amount, status, and transaction identifiers needed to credit your balance.
- Phone numbers: you enter payment and delivery details directly in NumberBarn's checkout, under NumberBarn's privacy notice. Grid Heap receives the NumberBarn transaction identifier, number, date, status, and amounts needed to match the payment to your order.
Domains, phone numbers, and paid tools
These features process the information below in addition to account and payment data.
- Domain registrant data: the name, email, phone, postal address, country, and registry-specific fields you enter as the domain contact are stored encrypted and sent through Grid Heap's Domain Control Plane to Dynadot Inc, the registrar of record, and on to the registry. The registrar and registry publish or withhold this data in public WHOIS and RDAP according to your privacy setting, their policies, and applicable law, and may disclose it to ICANN, law enforcement, or dispute providers.
- Phone-number orders: phone-number requests go to Grid Heap's own Number Control Plane, which calls NumberBarn. It keeps your account identifier, a keyed hash of your verified email (heap.page computes the hash, so the Number Control Plane never receives the email itself), the number, the expected price, and the matching NumberBarn transaction; heap.page keeps the credit back recorded for the order. Port-out account numbers and PINs are fetched from NumberBarn by the Number Control Plane only when you reveal them, and are not stored. If you ask to move a number into your own NumberBarn account, Grid Heap gives NumberBarn the email address you provide for that account.
- Phone-number lookups: the number you look up is sent to Telnyx, and heap.page keeps your last 100 lookups and results in your account history.
- Paid tools: photos, briefs, and other inputs are sent through AIRuntime to OpenAI to generate the result. heap.page does not store Headshot Studio photos or the outputs of Headshot Studio, Cover Maker, or AI domain naming after returning them. AI Icon & Mascot Studio keeps generated images for 7 days and keeps the brief with the job record.
Sources of personal information
Grid Heap receives information directly from you, automatically through use of the service, from service providers that perform identity, hosting, payment, advertising, email, security, or delivery functions, and from a business transaction where applicable.
Identity and billing providers return verified or transaction-related records needed to operate an account or purchase. Grid Heap also receives public information when reviewing a correction, source, rights notice, or other request that identifies public material.
- You and devices you use to access heap.page.
- Clerk for identity and authentication.
- Stripe for checkout, payments, saved cards, tax, refunds, and disputes, including Stripe Managed Payments and Link for balance top-ups.
- Cloudflare for hosting, network delivery, storage, abuse prevention, and aggregate product events.
- Google when advertising is present on an eligible free content page.
- Dynadot Inc, through Grid Heap's Domain Control Plane, for domain registration, renewal, transfer, and management records.
- NumberBarn, through Grid Heap's Number Control Plane, for phone-number transactions and port-out credentials, and Telnyx for phone-number lookup results.
- Tidy Messages, Grid Heap's messaging platform, for email delivery state.
Tracking and other technologies
Cookies, browser storage, and similar technologies support authentication, security, saved progress, preferences, advertising, and provider-controlled checkout. The Cookie Notice identifies the applicable categories and available controls.
Grid Heap uses a server-side privacy-minimized analytics pipeline for selected page and product events. On eligible free content pages that show advertising, Google AdSense processes device, online activity, approximate location, consent, and advertising information under Google's own terms and controls.
How we use personal information
Grid Heap uses personal information for the purposes described below and for compatible purposes disclosed when information is collected. If a materially different purpose requires consent, Grid Heap will request it where required.
Service delivery and operations
Provide pages and account features; authenticate users; process domain, phone-number, and balance purchases, automatic renewals, refunds, and paid tool runs; save preferences; deliver followed content; issue and revoke Agent credentials; respond to support, legal, and privacy requests; and send service-related communications such as receipts, renewal reminders, and transfer notices.
Improvement and measurement
Understand aggregate page and feature use, diagnose reliability, maintain editorial records, improve product behavior, and develop services without placing credentials, payment data, private notes, source bodies, or direct identity fields in free-form analytics records.
Compliance and protection
Comply with law and legal process; enforce terms; protect rights, privacy, safety, systems, and property; prevent abuse, fraud, unauthorized access, cyberattacks, and identity theft; and establish, exercise, or defend legal claims.
Advertising and communications
Deliver an advertisement on an eligible free content page and send communications a user requested or that are necessary to operate an account or purchase. Marketing or subscribed content communications include an applicable choice to stop future optional messages.
Retention
Grid Heap retains personal information for as long as reasonably necessary to provide the service, fulfill the purpose for which it was collected, comply with legal, accounting, and reporting obligations, establish or defend claims, prevent fraud, maintain suppression and security controls, and preserve authorized editorial or transaction records.
Retention is determined by the amount, nature, and sensitivity of the information; risk of harm; operational need; available alternatives; contractual commitments; and applicable law. When information is no longer required, Grid Heap deletes, anonymizes, or isolates it, subject to backups, legal holds, security records, and records that must be retained.
Purchase, tax, refund, and registration records are kept as long as needed for accounting, tax, and registrar obligations and to resolve disputes. Domain registrant data is also retained by the registrar and registry under their policies.
Your choices
You can update available account settings, change delivery preferences, unfollow a Heap, revoke an Agent credential, turn off domain automatic renewal, remove a saved card, sign out, clear browser storage, or use an unsubscribe mechanism included with optional email.
You can use browser and provider controls described in the Cookie Notice. Declining information identified as required can prevent Grid Heap from providing the related account, billing, delivery, legal-request, or support function.
Other sites and services
heap.page links to websites and services operated by third parties. A link, citation, or integration is not a representation that Grid Heap controls the third party or its privacy practices.
Third-party services process information under their own notices and settings. Review those notices before providing information or using a linked service.
Security
Grid Heap uses administrative, technical, and organizational safeguards designed to protect personal information, including encrypted transport, restricted administrative access, request validation, managed secret storage, audit records, and separation of public, account, billing, and administrative surfaces.
No internet or information system is completely secure. A suspected vulnerability or compromise is a security matter and should be reported to Grid Heap Security, not through the product-support form.
International data transfers
Grid Heap is headquartered in the United States and uses providers operating in the United States and other countries. Personal information is therefore processed in jurisdictions whose laws differ from those where you live.
Where applicable law requires a transfer mechanism, Grid Heap uses an adequacy decision, approved standard contractual clauses or equivalent safeguards, a legally recognized certification or framework, or an applicable derogation. Contact Grid Heap Legal to request information about a transfer mechanism relevant to your information.
Children
The service is not intended for anyone under 18 years of age. Grid Heap does not knowingly invite a child to create an account, make a purchase, create an Agent credential, or submit personal information through a support or legal-request channel.
If a parent or guardian believes a child supplied personal information in a manner prohibited by law, contact Grid Heap Legal. Grid Heap will investigate and take action required by applicable law.
State privacy rights notice
Residents covered by applicable U.S. comprehensive privacy laws have rights to information, access, correction, deletion, portability, appeal, and nondiscrimination, together with applicable rights to opt out of certain sales, sharing, targeted advertising, or significant profiling. These rights are not absolute and vary by jurisdiction.
Grid Heap does not sell personal information for money and does not use personal information to make automated decisions that produce legal or similarly significant effects. Some laws classify advertising technology on eligible free pages as a sale, sharing, or targeted advertising. Available browser and Google controls are described in the Cookie Notice.
Submitting and verifying a request
Submit a rights request to Grid Heap Legal and identify the right, relevant account email, jurisdiction, and information or service involved. Grid Heap requests information reasonably necessary to verify identity, residency, account ownership, or an authorized agent's authority. Do not send passwords, authentication tokens, full payment-card details, or unrelated identity documents.
California and Nevada information
California residents can request the categories and specific pieces of personal information collected, sources, purposes, and categories of recipients, and can exercise other rights provided by the CCPA as amended. A California Shine the Light request should state that title and include the requester's name, mailing address, and certification of California residency. Nevada residents can submit a verified request concerning a future sale covered by Nevada law even though Grid Heap does not currently sell covered information for monetary consideration.
Notice to European users
This section applies to individuals in the European Economic Area and United Kingdom. For this section, personal information includes personal data as defined by applicable European data-protection law, and Grid Heap, Inc. is the controller for the processing described in this policy.
Grid Heap relies on contractual necessity to provide requested account, purchase, delivery, and support functions; legitimate interests to operate, secure, measure, improve, and protect the service; compliance with law for legal obligations; and consent where applicable law requires consent for a specific processing activity.
European rights
Subject to applicable conditions, European users can request access, correction, deletion, portability, restriction, or objection, and can withdraw consent without affecting processing that was lawful before withdrawal. Grid Heap requests information needed to verify identity and explain a permitted refusal.
- Access information about processing and obtain a copy of personal data.
- Correct inaccurate or incomplete personal data.
- Delete personal data where there is no lawful reason to retain it.
- Transfer applicable data in a machine-readable format.
- Restrict or object to processing in circumstances provided by law.
- Withdraw consent where consent is the legal basis.
Complaints and transfers
A European user can complain to the data-protection authority where the user lives or works, or where an alleged infringement occurred. Grid Heap is a U.S. company and processes information in the United States using the transfer safeguards described above. Grid Heap does not maintain a European establishment and has not appointed a data-protection officer.
| Purpose | Information | Legal basis |
|---|---|---|
| Service delivery and operations | Contact, account, communications, transaction, preference, and device data | Contractual necessity; legitimate interests for related service administration |
| Security, fraud prevention, and legal compliance | Contact, account, device, request, transaction, and security data | Compliance with law; legitimate interests in protecting users, systems, rights, and property |
| Product improvement and privacy-minimized measurement | Route, event, status, hour, preference, and limited device or request data | Legitimate interests in reliable and useful services; consent where required for optional technology |
| Advertising on eligible free pages | Device, online activity, approximate location, consent, and advertising data | Consent where required; otherwise legitimate interests as permitted by applicable law |
| Optional subscribed communications | Contact, verified email, selected Heap, and delivery preference | Consent or contractual necessity, depending on the requested communication |
Changes to this policy
Grid Heap updates this Privacy Policy when services, providers, processing, legal requirements, or safeguards change. The version and effective date at the top identify the policy that applies.
A material change will receive additional notice where required. Continued use does not waive a right that applicable law does not allow a person to waive.
How to contact Grid Heap
Privacy questions and privacy-rights requests go to Grid Heap Legal. Security vulnerabilities and suspected compromise go to Grid Heap Security. Only non-legal, non-security corporate matters go to Corporate. Account, billing, content, and technical help for heap.page goes through the private support form.
Send postal notices to Grid Heap, Inc., 1111B S Governors Ave # 51059, Dover, Delaware 19904, USA.