Legal
Privacy Policy
Effective date: July 21, 2026
Ground Control (“we,” “us,” or “our”) operates the Ground Control web application (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.
1. Information We Collect
1.1 Information You Provide
- Account Information: When you register, we collect your name, email address, and password. If you sign up via Google OAuth, we receive your name, email address, and profile picture from Google.
- Organization Data: Information about organizations you create or join, including organization name, member roles, and member profiles (position, department, phone number, address).
- Content Data: Tasks, approvals, form responses, chat messages, comments, and file attachments you create within the Service.
- Beta Programme: If you sign up for our Beta Programme, we collect your name and email address.
1.2 Information Collected Automatically
- Usage Data: We may collect information about how you access and use the Service, including your browser type, device information, pages visited, and timestamps of interactions.
- Session Data: Session tokens and authentication state managed through our authentication provider (Better Auth).
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Service
- Authenticate your identity and manage your account
- Enable collaboration within your organizations
- Send transactional emails (e.g., account verification, password reset, organization invitations, overdue task notifications)
- Enforce role-based access controls and permissions
- Maintain audit logs of actions performed within the Service for accountability and security
- Improve and optimize the Service
- Respond to your inquiries and provide customer support
3. Third-Party Services
We use the following third-party services to operate the Service:
| Service | Purpose | Data Shared |
|---|---|---|
| Convex | Real-time database and serverless backend | All application data (tasks, approvals, forms, user profiles) |
| Google OAuth | Social sign-in authentication | Name, email, profile picture (received from Google) |
| Resend | Transactional email delivery | Recipient email address, email content |
| Cloudflare R2 | File attachment storage | Uploaded files (documents, images) |
Each third-party service has its own privacy policy. We encourage you to review their policies.
4. Data Retention
We retain your personal data for as long as your account is active or as needed to provide you the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal obligations.
Audit logs and organizational data may be retained for the duration of the organization's existence to maintain data integrity for other members.
5. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit (HTTPS/TLS)
- Secure authentication with session token management
- Role-based access controls within the application
- Regular security reviews of our infrastructure
However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete personal data
- Delete your personal data (see our Data Deletion page)
- Export your data in a portable format
- Withdraw consent for data processing where applicable
To exercise any of these rights, please contact us at privacy@groundcontrol.app.
7. Google User Data
When you sign in using Google, we access the following data from your Google account:
- Your name
- Your email address
- Your profile picture
This data is used solely for creating and authenticating your account within the Service. We do not share your Google user data with any third parties for advertising or other purposes unrelated to the Service. We do not store your Google access tokens beyond the authentication session.
You can revoke Ground Control's access to your Google account at any time through your Google Account permissions settings.
8. Children's Privacy
The Service is not intended for use by children under 13 years of age. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us so we can take appropriate action.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Effective date” above. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.
10. Contact Us
If you have questions or concerns about this Privacy Policy, please contact us at:
Ground Control
Email: privacy@groundcontrol.app