Privacy Policy

1. Introduction

This Privacy Policy explains how LIVEHOPPER EURL ("Livehopper", "we", "us", or "our") collects, uses, discloses, and protects personal data when you interact with Grengin and our related offerings.

We are committed to protecting your privacy. The Grengin software is open source under the Apache License 2.0. The Software does not contain usage telemetry or analytics that send your prompts, responses, files, logs, or product-usage data back to us. Self-hosting does not require a Grengin.com account. If an administrator explicitly connects an instance to a Grengin.com account, the limited connection metadata described in Section 5.1 is sent so we can provide the requested managed features.

This Policy describes the limited circumstances in which we do process personal data — primarily when you visit our website, contact us, raise a support ticket, contribute to our community channels, purchase through AWS Marketplace, or use managed hosting by Grengin ("Managed Hosting", described in Section 5.5).

This Policy is incorporated into, and forms part of, our Terms and Conditions. Capitalised terms not defined here have the meaning given to them in the Terms and Conditions.

2. Who we are and how to contact us

LIVEHOPPER EURL is the data controller under applicable law for personal data described in this Policy.

The contact details of our privacy contact are set out in Section 14.

3. Scope of this Policy

This Policy applies to personal data we collect through:

• The Grengin website at grengin.com and its sub-domains (the "Website");
• The Paid Services we offer (currently Technical Support and Managed Hosting);
• Our community channels, including the Grengin repository on GitHub, issue trackers, discussion forums, chat platforms, and similar venues we operate or host;
• Email, telephone, and other direct communications with us; and
• Events, webinars, and marketing communications (where you opt in).

This Policy does not apply to:

• Content and usage inside a self-hosted Grengin instance, which remains on your infrastructure and is not collected as telemetry; optional Grengin.com account connection metadata is covered by this Policy;
• AWS, when you independently self-host Grengin using the AWS Marketplace image — your relationship with AWS is governed by the AWS privacy notice;
• Third-party services we link to or integrate with, such as GitHub — your relationship with each is governed by that party's own privacy notice; or
• Websites of any third party that may link to ours.

4. The Software does not collect usage telemetry

We want to be unambiguous about this:

• The Grengin software does not collect, transmit, or send to Livehopper your prompts, model responses, files, crash reports, performance metrics, or usage analytics.
• The source code is publicly available at the Grengin repository for inspection.
• Software updates are pulled by you from the relevant cloud marketplace or repository; we do not push updates and cannot reach into your installation.
• Connecting an instance to Grengin.com is optional and requires an administrator to sign in, review the data to be shared, and approve the connection. The connection can be removed from the account dashboard.
• If a future version of Grengin ever introduces optional telemetry, it will be (a) opt-in only, (b) clearly disclosed in release notes, and (c) reflected in an updated version of this Policy before the change takes effect.

If you choose to share information with us — for example, by attaching log files to a support ticket, posting in a community channel, or using Managed Hosting — that information is processed as described in the rest of this Policy.

5. What personal data we collect, and why

5.1 Information you provide directly

The optional connection does not send Grengin user records, prompts, model responses, API keys, database credentials, logs, files, or LLM usage data. A short-lived instance authorisation grant is stored locally on the instance; your Grengin.com login token is not copied to the instance.

5.2 Information we receive from AWS Marketplace

When you purchase a Paid Service through AWS Marketplace, AWS may share with us the limited information required to fulfil the order — typically the buyer organisation name, a customer or buyer identifier, entitlement or subscription details, billing country, and a contact email. We do not receive your payment card or bank details. AWS acts as a billing agent for marketplace transactions; you can review what data AWS shares in its own terms and privacy notice. We do not publish Grengin marketplace images through any other cloud marketplace.

5.3 Information we collect automatically when you use the Website

The Website is hosted behind Cloudflare, Inc. ("Cloudflare"), which provides our content delivery network (CDN), DDoS protection, web application firewall, and analytics. When you visit the Website, Cloudflare's servers — and our origin servers — automatically receive certain technical information:

• IP address (which we treat as personal data under EU/UK law) and approximate geolocation derived from it;
• Device and browser information: user-agent string, operating system, browser type and version, screen size, language;
• Usage data: pages visited, time spent, referring URL, search queries entered on our Website, clicks on links;
• Network and security data: TLS fingerprints, request rate, and signals used by Cloudflare to detect bots, abuse, and attacks.

We use this data to operate, secure, and improve the Website, to detect and prevent fraud and abuse, to compile aggregate statistics about Website usage, and to comply with legal obligations.

Cloudflare's separate processing of data for CDN, DDoS protection, and security purposes is described in Cloudflare's own privacy policy at https://www.cloudflare.com/privacypolicy/. Cloudflare acts as our processor for these services, under the Cloudflare Data Processing Addendum (available at https://www.cloudflare.com/cloudflare-customer-dpa/) which is incorporated by reference into our subscription agreement with Cloudflare and which includes the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable.

We do not use Fathom, Plausible, PostHog, Mixpanel, or other third-party analytics or advertising tools on the Website beyond Cloudflare Web Analytics and Google Analytics 4 as described above.

5.4 Information we collect when you contribute to community channels

When you post on a Grengin GitHub repository, raise an issue or pull request, comment on documentation, or post in any community discussion channel we operate, the content you post (including your username, avatar, and the substance of your post) is public. We process this content to operate the community, moderate it, respond to you, and improve the project. The platform you post on (for example, GitHub) also processes your data under its own privacy notice.

5.5 Information we collect when we provide Managed Hosting

If you purchase Managed Hosting (our Paid Service under which we operate a Grengin instance on infrastructure managed by us on your behalf), we will necessarily have access to the infrastructure on which Grengin runs, and may incidentally have access to data you store in or process through that instance ("Customer Data"). We act as a processor / data processor for that Customer Data and process it only on your documented instructions and as set out in a separate data processing agreement that we will enter into with you. We do not access Customer Data for our own purposes.

5.6 Cloudflare developer-platform services we use

In addition to the CDN and security services described in Section 5.3, we use selected Cloudflare developer-platform products — Cloudflare Workers, Workers KV, D1, and R2 — for the optional instance connection and for two specific products that we sell separately from the same Website:

(a) Grengin Auth Proxy. A separately-sold product that customers deploy to broker single sign-on between their applications and identity providers such as Google Workspace or Microsoft Entra ID (Azure AD). When a customer's end user signs in, the Auth Proxy may process — on the customer's behalf and only as needed to complete the sign-in — identifiers issued by the upstream identity provider (such as the user's email address, name, OIDC sub, group membership, and short-lived tokens), together with operational data such as session identifiers, audit timestamps, and IP address. We act as a data processor for the customer in respect of this data, and the customer's end users are not in a direct relationship with us through this product.

(b) Grengin LLM Proxy. A separately-sold product that proxies large-language-model requests on behalf of the customer. When a customer's end user makes a request through the LLM Proxy, we — acting as a data processor for the customer — may process configuration, request-routing data, rate-limiting state, and (only where the customer has enabled logging) request and response payloads. Prompts and model outputs are not used to train any model, and are not used for any purpose beyond providing the service to the customer in accordance with the product-specific terms.

Each of these two products has its own product-specific terms and, where applicable, a separate data processing agreement that the customer enters into with us. This Privacy Policy describes only the personal data we process about you as a customer or prospective customer of grengin.com — for example, your account, billing, contact, and support data. Personal data of your end users that flows through the Auth Proxy or LLM Proxy is processed under the relevant product-specific terms and DPA, with the customer as controller and Livehopper as processor.

Workers, Workers KV, and D1 process the connected-instance metadata listed in Section 5.1. We do not use these services to receive content from inside a self-hosted instance unless you separately submit that content to support or use a managed proxy product described above.

In both contexts above, Cloudflare acts as our sub-processor under the Cloudflare Data Processing Addendum referenced in Section 5.3 (https://www.cloudflare.com/cloudflare-customer-dpa/), which incorporates the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and Cloudflare's certification under the EU–U.S., UK Extension, and Swiss–U.S. Data Privacy Frameworks. Cloudflare maintains its current sub-processor list on https://www.cloudflare.com/gdpr/subprocessors/.

5.7 Information we do not collect

We do not knowingly collect:

• Payment card numbers, bank account numbers, or other financial-account details (AWS Marketplace or our payment providers handle billing);
• Biometric data;
• Precise location data;
• Special-category data (health, race, religion, political opinions, sexual orientation, etc.) — please do not include such data in support tickets or community posts; and
• Personal data of children under 18 (see Section 13).

6. How we use personal data — purposes and legal bases

We process personal data for the following purposes. The legal bases listed apply where the GDPR, UK GDPR, or equivalent law requires one; in other jurisdictions we rely on the analogous lawful ground.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms and have concluded they are not. You may object at any time (Section 11).

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Who we share personal data with

We do not sell personal data. We share personal data only with the following categories of recipients, and only as necessary:

7.1 Service providers (processors and sub-processors)

We use carefully selected third-party providers to help us run our business. They process personal data on our behalf, under written contracts that require them to apply appropriate security and confidentiality measures and prohibit any use of the data other than on our instructions.

The principal processors we currently rely on include:

• Perter Technology Solutions Private Limited (New Delhi, India) — engineering, operations, and technical support under an intra-group data processing agreement incorporating EU Standard Contractual Clauses. For Customer Personal Data, Module Three applies as described in the DPA transfer section.
• Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) — provides our content delivery network, DDoS protection, web application firewall, bot management, and Cloudflare Web Analytics across the Website (Section 5.3), and acts as our sub-processor for the Cloudflare Workers, Workers KV, D1, and R2 services that underpin our Auth Proxy and LLM Proxy products (Section 5.6). Cloudflare processes Personal Data on our behalf under the https://www.cloudflare.com/cloudflare-customer-dpa/, which incorporates the EU Standard Contractual Clauses (Modules 2 and 3), the UK International Data Transfer Addendum, and Cloudflare's Data Privacy Framework certification.
• Google LLC / Google Ireland Limited — provides Google Analytics 4 for Website usage measurement (Section 5.3). Google processes data on our behalf under https://business.safety.google/adsprocessorterms/. See also https://policies.google.com/privacy.
• CookieYes — provides our cookie consent management platform on the Website (Section 8). CookieYes displays the consent banner, records your cookie preferences, and integrates with Google Consent Mode v2. See https://www.cookieyes.com/privacy-policy/.

Other categories of providers we may use include:

• Email and communication tools — transactional email senders, customer-support help-desk software, calendaring and meeting tools;
• Source-code and collaboration platforms — including GitHub, Inc. for source repositories, issue tracking, and discussions;
• Customer-relationship-management tools — for sales and support pipelines;
• Professional advisers — accountants, auditors, lawyers, and insurers, where engaged in connection with the relevant matter.

We will update this list as our processor relationships change. If we add a new processor that materially affects how your personal data is processed, we will update this Policy in accordance with Section 17.

7.2 Cloud marketplaces

When you purchase through AWS Marketplace, AWS processes the transaction. We exchange order, entitlement, and contact data with AWS as needed to fulfil the purchase. AWS acts as an independent controller for its own purposes (billing, fraud prevention, and marketplace operation) under its own privacy notice.

7.3 Public community channels

Information you post on a public Grengin community channel (GitHub issues, pull requests, discussions, public chat) is visible to anyone who can access that channel. We do not control how third parties use information you make public.

7.4 Authorities and legal disclosures

We may disclose personal data if we believe in good faith that disclosure is necessary to:

• Comply with a court order, subpoena, search warrant, or other lawful request from a government, regulator, or law-enforcement body;
• Enforce our Terms and Conditions or investigate violations;
• Protect the rights, property, or safety of Livehopper, our users, or others; or
• Comply with any legal, regulatory, or tax obligation.

We respond to lawful requests and legal obligations under French and European Union law. Where lawfully possible, we aim to notify the affected user of the request before responding.

7.5 Corporate transactions

If we are involved in a merger, acquisition, financing, reorganisation, bankruptcy, receivership, sale of assets, or transition of service to another provider, personal data may be transferred as part of that transaction, subject to standard confidentiality protections and applicable law. We will notify you of any such change in ownership or control of personal data.

7.6 Reporting abuse routed through Cloudflare

If you wish to report content or activity that you believe is being routed through Cloudflare's network on our domains (for example, alleged copyright infringement, malware, phishing, harassment, or other abuse), you may contact us directly at cloudflare-abuse@grengin.com. This is the dedicated abuse channel we have designated to receive complaints forwarded by Cloudflare under their abuse-reporting process. We will review your report and respond in accordance with applicable law and our Terms and Conditions. Copyright complaints under the U.S. DMCA should additionally follow the procedure set out in Section 25.5 of our Terms and Conditions.

8. Cookies and similar technologies

The Website uses a limited set of cookies. Cloudflare Web Analytics does not set analytics cookies (see Section 5.3). Google Analytics 4 sets first-party analytics cookies only if you accept analytics through our consent banner.

Cookies and similar technologies the Website may use include:

• Strictly necessary cookies — required for the Website to function or for security. These may include a Cloudflare-issued security cookie (such as __cf_bm, used to distinguish humans from bots, with a typical lifetime of around 30 minutes), session and CSRF-protection cookies, load-balancing cookies, and a CookieYes consent-preference cookie (such as cookieyes-consent) used solely to record your cookie choices. Under the EU e-Privacy Directive, the UK Privacy and Electronic Communications Regulations 2003, and analogous laws, strictly necessary cookies do not require prior consent.
• Analytics cookies (Google Analytics 4) — used to distinguish unique visitors and measure Website usage. Typical cookies include _ga (often up to two years) and _ga_* (session/state, often up to two years). These cookies are not strictly necessary and are not set until you accept analytics via CookieYes. You can decline or withdraw consent through the CookieYes preference centre, block or delete cookies in your browser settings, use the Google Analytics Opt-out Browser Add-on (Section 5.3), or send a Global Privacy Control signal where we honour it.
• Functional cookies — used only if you opt in to a preference such as language or theme, and only for that purpose.

We do not use: advertising cookies, social-media tracking pixels, or cross-site behavioural advertising on the Website. We do not sell or share personal information for cross-context behavioural advertising as defined under the CPRA.

You can also control cookies through your browser settings, although blocking strictly necessary cookies may break parts of the Website.

We honour the Global Privacy Control (GPC) signal as required under California law (Cal. Civ. Code § 1798.135) and treat it as an opt-out of any "sale" or "sharing" of personal information.

9. International transfers

Livehopper is established in France, and personal data is processed in the European Union. Perter Technology Solutions Private Limited may access data from its location listed in Section 7.1 for engineering, operations, and technical support, under an intra-group data processing agreement incorporating EU Standard Contractual Clauses. Other international transfers by our service providers are subject to the safeguards below.

When we transfer personal data out of the European Economic Area, the United Kingdom, or other jurisdictions with restrictions on international transfers, we rely on appropriate safeguards, which include:

• Standard Contractual Clauses (Module 1, 2, 3, or 4 as applicable) approved by the European Commission under Decision (EU) 2021/914;
• The UK International Data Transfer Addendum (IDTA) or the UK Addendum to the EU SCCs;
• adequacy decisions, where the European Commission, the UK Government, or another competent authority has determined that the destination provides an adequate level of protection;
• explicit consent for occasional transfers where applicable; and
• Analogous safeguards under PIPEDA, Quebec's Law 25, the Australian Privacy Principles, and the Singapore PDPA.

You may request a copy of the relevant safeguard by contacting privacy@grengin.com.

10. How long we keep personal data

We keep personal data only as long as necessary for the purposes for which it was collected, unless a longer retention is required by law. Indicative retention periods:

• Customer account data: retained for the duration of the customer relationship, subject to applicable legal-retention requirements.
• Accounting records and supporting documents: retained for ten (10) years under Code de commerce article L123-22.
• Support tickets and communications: typically three (3) years after the ticket is closed, unless a longer period is required to defend a claim.
• Marketing-suppression list (people who have unsubscribed): retained indefinitely so we can honour your opt-out.
• Website server logs: typically 30 to 90 days for security and diagnostic purposes.
• Connected-instance metadata: retained while the instance is connected. On disconnection, its domain, public IP address, region, and managed-proxy status are removed from the account record; the minimal instance identifier, account association, revocation timestamp, and audit record are retained in accordance with our account-security and legal-retention requirements.
• Google Analytics 4 data: retained in our GA4 property for 14 months (default event-data retention), unless we change that setting in the Google Analytics admin console.
• Cookie consent preferences (CookieYes): typically retained for 12 months in the consent cookie, unless you clear cookies sooner or change your preferences.
• Cookies: retention periods are set per cookie — see Section 8 (for example, GA4 cookies such as _ga are typically stored for up to two years unless you delete them sooner).
• Recruitment data for unsuccessful candidates: typically 12 months after the recruitment decision, unless you ask us to delete it sooner or to keep it for future opportunities.

When personal data is no longer needed and no legal basis to retain it remains, we delete or anonymise it.

11. Your rights

Subject to applicable law, you have the following rights in respect of personal data we hold about you. Some of these rights are jurisdiction-specific.

11.1 Rights available under the EU GDPR, French law, the UK GDPR, and other applicable privacy laws

• Access — request confirmation of whether we process your personal data, and a copy of it.
• Rectification / correction — ask us to correct inaccurate or incomplete data.
• Erasure / deletion — ask us to delete your personal data in certain circumstances.
• Restriction — ask us to limit how we use your data while a query is being investigated.
• Portability — receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Object — object to processing based on our legitimate interests, or to direct marketing.
• Withdraw consent — where we rely on your consent.
• Not be subject to solely automated decision-making that produces legal or similarly significant effects (we do not currently engage in such automated decision-making).
• Post-mortem directives — give instructions about the retention, deletion, and communication of your personal data after your death under article 85 of the French Loi Informatique et Libertés.

11.2 Additional California rights (CCPA/CPRA)

If you are a California resident:

• The right to know the categories and specific pieces of personal information we have collected, the categories of sources, the purposes, and the categories of third parties to whom we have disclosed it;
• The right to delete personal information (subject to exceptions);
• The right to correct inaccurate personal information;
• The right to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising — we do not sell or share personal information as those terms are defined under the CPRA;
• The right to limit the use of sensitive personal information — we do not use or disclose sensitive personal information for purposes that trigger this right;
• The right to non-discrimination for exercising your rights; and
• The right to designate an authorised agent to exercise these rights on your behalf.

A "Your Privacy Choices" / "Do Not Sell or Share My Personal Information" link is provided through the Website's cookie banner in accordance with Cal. Civ. Code § 1798.135.

11.3 Additional Australia, Canada, New Zealand, and Singapore rights

Residents of Australia, Canada, New Zealand, and Singapore have rights of access and correction, and rights to complain to their respective regulators, under the Privacy Act 1988 (Cth), PIPEDA / Quebec Law 25, the Privacy Act 2020, and the PDPA respectively. Quebec residents additionally have rights of de-indexing and to information about automated decisions.

11.4 How to exercise your rights

To exercise any of these rights, email us at privacy@grengin.com or contact our privacy contact (Section 14). We will respond within the period required by applicable law — generally within one month under the GDPR/UK GDPR, within 45 days under the CPRA (extendable once by 45 days).

We may need to verify your identity before acting on a request. We will not charge a fee unless your request is manifestly unfounded or excessive.

If you are not satisfied with our response, you may complain to:

• The Commission nationale de l'informatique et des libertés (CNIL) in France — visit cnil.fr;
• The Information Commissioner's Office (ICO) in the UK — visit the https://ico.org.uk;
• Your national EU/EEA supervisory authority — see the https://edpb.europa.eu/about-edpb/about-edpb/members_en;
• The California Privacy Protection Agency — visit the https://cppa.ca.gov;
• The Office of the Privacy Commissioner of Canada — visit the https://www.priv.gc.ca;
• The Office of the Australian Information Commissioner — visit the https://www.oaic.gov.au;
• The Office of the Privacy Commissioner of New Zealand — visit the https://www.privacy.org.nz; or
• The Personal Data Protection Commission of Singapore — visit the https://www.pdpc.gov.sg.

12. Security

We take reasonable and appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption of data in transit (TLS) and, where reasonable, at rest;
• Access controls based on the principle of least privilege;
• Multi-factor authentication for administrative access;
• Secure software-development practices and dependency management;
• Regular review of access, vulnerability scanning, and patching;
• Written policies governing employee handling of personal data; and
• Contractual obligations on service providers to apply equivalent measures.

These measures are intended to meet the security requirements of Article 32 of the GDPR, French data-protection law, and other applicable laws.

No system is perfectly secure. If we ever suffer a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within the timelines required by applicable law.

To report a security vulnerability, please contact security@grengin.com.

13. Children

The Grengin offerings are intended for businesses and professionals. They are not directed at children, and we do not knowingly collect personal data from anyone under 18 years of age (or the age of majority in the user's jurisdiction, if higher).

If you believe a child has provided us with personal data, please contact privacy@grengin.com and we will delete the data promptly.

14. Privacy contact

14.1 Privacy contact (Référent RGPD)

14.4 DMCA Designated Agent (United States)

For copyright complaints under 17 U.S.C. § 512(c)(2), see Section 25.5 of our Terms and Conditions.

15. Marketing communications

If you have given consent or if applicable law permits us to do so under a "soft opt-in" or legitimate-interests basis, we may send you marketing communications about our products and services.

You can opt out at any time by:

• Clicking the "unsubscribe" link in any marketing email;
• Replying to a marketing email asking to be removed; or
• Contacting us at privacy@grengin.com.

Opting out of marketing does not stop service-related messages (security notices, billing, breach notifications, Terms updates) which we are required or legitimately entitled to send.

We comply with applicable French rules on electronic prospecting and the EU e-Privacy Directive as transposed, followed where applicable by the UK Privacy and Electronic Communications Regulations 2003, the U.S. CAN-SPAM Act, Canada's Anti-Spam Legislation (CASL), and Australia's Spam Act 2003.

16. Third-party links

The Website and our community channels may contain links to third-party websites and services that we do not control. We are not responsible for their privacy practices. We encourage you to read the privacy notices of any third party before providing them with personal data.

17. Changes to this Policy

We may update this Policy from time to time. The current version is always available on this Privacy Policy page with the "Last Updated" date noted at the top.

For material changes (changes that materially affect your rights, the categories of data processed, the purposes, the recipients, or the legal basis), we will provide reasonable advance notice — typically at least thirty (30) days — by email (where we have your address), in-product notice, a Website banner, or a posting on our changelog. Where applicable law requires fresh consent, we will obtain it before the change takes effect.

18. Governing law and complaints

This Policy is governed by the laws of France, without prejudice to mandatory data-protection rights you may have under the law of your country of residence. The dispute-resolution and jurisdiction provisions in our Terms and Conditions apply to disputes arising out of this Policy, except that you retain the unconditional right to lodge a complaint with the supervisory authority in your country of residence (see Section 11.4).

19. Version history

• Version 1.0 — 30 April 2026: initial publication. Read the archived policy.
• Version 1.1 — 4 June 2026: added disclosure of Google Analytics 4 on the Website; updated cookies, processors, retention, and legal-basis sections accordingly.
• Version 1.2 — 5 June 2026: added CookieYes cookie consent banner disclosure; updated Google Consent Mode v2, cookies, processors, retention, and legal-basis sections accordingly.
• Version 1.3 — 30 July 2026: disclosed the optional Grengin.com instance connection, its limited metadata, managed-feature purpose, dashboard controls, and retention behaviour.
• Version 1.4 — 14 August 2026: aligned marketplace and hosting disclosures with AWS Marketplace and Grengin Cloud.
• Version 1.5 — 14 August 2026: previous published policy. Read the archived policy.
• Version 2.0 — 7 September 2026: LIVEHOPPER EURL becomes the controller; French law and EU processing; Perter Technology Solutions added as processor; privacy contact and rights updated; former jurisdiction-specific provisions removed.
• Editorial update — 6 October 2026: "Grengin Cloud" is now called managed hosting by Grengin ("Managed Hosting"). No change to your rights or obligations.