RodGrid

Privacy

RodGrid Privacy Policy

Last updated: August 8, 2026

RodGrid respects your privacy and is committed to protecting your information.

This Privacy Policy explains how RodGrid collects, uses, stores, shares, and protects data when you use RodGrid. Some data practices apply only if optional or future features, such as billing, AI, analytics, or diagnostics, are enabled.

1. Who Operates RodGrid

RodGrid Software is the registered business name under which Rodrigo Aires de Oliveira, an individual sole proprietor based in New Brunswick, Canada, operates RodGrid. RodGrid Software is not a corporation or a legal entity separate from its owner. Rodrigo Aires de Oliveira, carrying on business as RodGrid Software is the data controller responsible for the personal information of RodGrid's own users. Where a customer uses RodGrid to interview someone, that customer is the controller of their candidate's information and RodGrid acts as their processor — see "Interview Candidates."

For privacy requests, support, or questions, contact: [email protected].

2. Notice at Collection

This notice summarizes the categories of information RodGrid may collect, the purposes for collection, and how long data may be retained. The rest of this Privacy Policy gives more detail.

RodGrid retains information for as long as needed to operate the service, meet legal obligations, resolve disputes, enforce agreements, maintain backups, and protect security.

3. Information We Collect

RodGrid may collect:

RodGrid does not receive or store raw payment card information. Payments are handled by Paddle (Paddle.com Market Limited) as merchant of record.

4. How We Use Information

RodGrid uses collected information to:

5. Marketing Communications

If you opt in, RodGrid may send you occasional product updates, tips, and announcements by email. Marketing email is optional and off by default — you are added only if you affirmatively opt in, for example by ticking the optional box at sign-up or turning it on in your account profile.

You can withdraw your consent at any time by turning off marketing emails in your profile or using the unsubscribe link in any marketing message. Withdrawing consent does not affect transactional or service emails (such as sign-in, billing, security, and account notices), which are necessary to operate your account and are not marketing.

RodGrid records the date and the version of the terms in force when you opt in or out, as proof of consent.

6. Cookies and Local Storage

RodGrid uses storage technologies needed to run the product and protect access.

RodGrid sets only strictly necessary cookies (the session and OAuth-state cookies above) and uses no advertising or cross-site tracking cookies. Usage analytics are collected in a cookieless, privacy-preserving way (Cloudflare Web Analytics). Because RodGrid does not set non-essential or tracking cookies, it does not display a cookie-consent banner.

7. Sharing and Service Providers

RodGrid does not sell personal information.

RodGrid shares information with the following trusted service providers (subprocessors) involved in operating the platform:

These providers process data on RodGrid's behalf under their own terms and security commitments, and may process it in countries outside your own. Information may also be disclosed if required by law, to enforce agreements, or to protect the security and integrity of the platform.

8. Business Transfers

If RodGrid is involved in a merger, acquisition, financing, reorganization, bankruptcy, or a sale of all or part of its assets, personal information may be transferred to the successor or acquirer as part of that transaction.

Any successor will remain bound by this Privacy Policy or will provide notice of a materially different policy before your information becomes subject to it. Consistent with the CCPA/CPRA, transferring personal information as an asset in such a transaction, where the recipient continues to honor this Policy, is not a "sale" of personal information.

9. Project Visibility and Collaboration

Grids are private by default.

Users may choose to share Grids with collaborators. Shared content becomes accessible to users granted access by the Grid owner or by authorized invite links. A Grid owner may also create a view link that opens without a RodGrid account, or embed a Grid in an external page — in which case the content is readable by anyone who obtains that URL, including people RodGrid never sees and cannot identify.

Users are responsible for managing sharing permissions appropriately and for understanding who can access a shared Grid. Once someone has opened shared content, RodGrid can revoke their future access but cannot recall what they already saw or copied.

If you are the Grid owner and you place personal information about another person into a Grid you then share, you decide that disclosure — not RodGrid. RodGrid stores and transmits Grid content on your instruction and has no way to know whose information is in it or what you agreed with them. Your responsibilities for that information are set out in "Your Content and Other People's Information" in the Terms of Service.

An interview Grid works differently: the candidate reaches it through a single-use invite link rather than by being added as a collaborator, sees only their own side of it (material the interviewer marks as interviewer-only is never sent to them), and does not need an account. See "Interview Candidates" below.

10. If Someone Shared a Grid With You

You can open a shared Grid without a RodGrid account, through a view link or an embed. If that is how you got here, very little of this policy is about you: RodGrid records the request in its logs, with the IP address and user agent stored in hashed form for security and abuse prevention, and counts the visit in cookieless analytics. No account is created, no profile is built, and you are not tracked across sites.

The content of that Grid is not RodGrid's. It belongs to the person or organization who created it and chose to share it, and they decide whether it stays available, what it says, and who else can see it. If a Grid contains information about you that you want changed or taken down, ask whoever shared it with you — they can edit or delete it directly, and answering you is their responsibility rather than RodGrid's. If you write to [email protected] instead, we will forward your request to them. RodGrid removes or restricts content on its own only where it breaks our Terms or the law requires us to.

11. Interview Candidates

A RodGrid customer can invite someone to take a technical interview or a take-home exercise. If you received an interview link, this section describes you: you do not need a RodGrid account, you did not choose RodGrid, and the customer who invited you decides how the interview runs.

What RodGrid records during an interview:

The behavioural signals in the last item are recorded as interview evidence and are shown to the interviewer. They are also summarized for the AI scorecard described below, which treats them as supporting context and never as the primary basis for an assessment.

RodGrid does not send your name, your email address, or your profile picture to the AI provider: your display name and picture are removed from your comments and activity before your work leaves, and your email address is not part of what is sent at all. What it receives is the design, the comments and activity on it, the employer's rubric and notes, the title the employer gave the exercise, and the process signals above. Two limits on that, stated plainly rather than implied: anything you type into the design or a comment is the work being assessed and travels with it, and the title and the notes are the employer's own free text, so anything they write there — including your name — goes with it.

Where a person is required to review the AI draft before it is used, RodGrid records that they did so and whether they accepted, edited, or set it aside. That record exists so the oversight can be shown to have happened; it is kept with the interview and is available to the organization that invited you.

If the organization has set RodGrid up to forward results, RodGrid sends your scorecard to a web address they nominated as soon as it is ready. That address is theirs, and is not a system RodGrid connects to or vets: it may be their recruiting or applicant-tracking system, or a service of their own that passes the result on to one. RodGrid does not choose the destination, does not control what happens to the result once it arrives, and sends it only because that organization instructed it to.

The customer who invited you decides who is invited, what is asked, whether email confirmation is required, and how long the interview and its recording are kept (from one day up to one year; if they set nothing, RodGrid's standard grid lifetime applies). RodGrid does not decide the outcome of your interview and does not use your interview to make its own decisions about you.

RodGrid decides what the platform is capable of recording — the categories listed above — and how the scorecard is produced. The customer decides whether to run an interview on RodGrid at all, and everything about the one you took. Where you want something changed, that split tells you who to ask: the customer for your interview, RodGrid for how the product behaves.

RodGrid does not sell this information, does not use it to train AI models, and does not use it to advertise to you.

To ask what is held about you, to correct it, or to have it deleted, contact the organization that invited you. This is not RodGrid passing you along: they chose to interview you, they decide what happens to the result, and under data-protection law they are the controller of your interview — which means the decision to delete it is theirs to make and they can act on it directly. RodGrid runs the session on their instruction.

If you write to RodGrid at [email protected] instead, we will forward your request to that organization, and they answer it. RodGrid will not delete or hand over their assessment record on its own — that is not ours to decide, and neither is any decision they made about you. We act on their instruction, and we act on our own only where the law requires it of us directly or the content breaks our Terms.

12. AI Processing

RodGrid offers AI-assisted features (such as specification/PRD generation, diagram generation, and evaluations).

One of those evaluations assesses a person: when an interview ends, RodGrid can produce a scorecard from the candidate's design and the process signals described above. It is advisory and evidence-linked — it reports what it observed and how strongly, and it never produces a hire or no-hire recommendation. The hiring decision is made by people at the organization running the interview, not by RodGrid and not by the model.

When you use an AI feature, RodGrid processes the relevant prompt, Grid content, project notes, architecture metadata, or related data through OpenAI, its third-party AI provider, for the sole purpose of generating the requested output. RodGrid does not use your content to train AI models.

RodGrid also keeps a record of each AI run: that the output was AI-generated, which provider and model produced it, when, the version of the instructions used, what the feature was for, and whether a person was required to review the result before it could be relied on. Where a review is required, the reviewer's decision — accepted, edited, or disregarded — is recorded as it happens and is not rewritten afterwards. This record is about the AI run, not about you, and you can obtain your own copy of it from the data export in your profile.

Users should avoid submitting highly sensitive or regulated information unless explicitly supported by the platform.

13. Data Retention and Deletion

RodGrid retains information for as long as necessary to:

Where supported, users may export Grid content in supported formats before deleting a Grid or account.

When a Grid, account record, or related content is deleted, it is deleted from active service records where practical. Active service deletion normally begins immediately and may take up to 30 days to complete across active systems.

Backup and log retention windows may keep residual copies for up to 90 days unless a longer period is required for security, abuse prevention, legal compliance, or dispute resolution.

Interview recordings follow the retention the inviting customer set for that interview — from one day up to one year — measured from when the interview ends. If they set nothing, the standard grid lifetime applies. Deleting the interview removes its recording on the same schedule as any other deleted content above.

Certain records — such as billing and tax records, and records of consent or acceptance (for example, agreement to these terms or a refund-cancellation acknowledgement) — may be retained after account deletion where necessary to comply with legal obligations or to establish, exercise, or defend legal claims, minimized to what those purposes require.

14. Security

RodGrid implements reasonable technical and organizational measures to protect user data.

However, no online system can guarantee absolute security.

RodGrid has no password of its own — you sign in through GitHub or Google, or through a single-use link sent to your email address. Protecting your account therefore means protecting those: the provider account you sign in with, the mailbox that receives sign-in links, and any Grid invite or view link you have been given, since anyone holding such a link can use it.

If a security incident affects your personal information, RodGrid will notify affected users and, where applicable, the relevant supervisory authority, as and when required by applicable law.

Where an incident affects interview candidate data, RodGrid notifies the customer who ran that interview without undue delay, because they are its controller and the decision to notify the candidate or an authority is theirs to make. RodGrid will support them in doing so.

15. International Data Transfers

RodGrid and its service providers may process data in multiple countries.

By using RodGrid, you understand that information may be transferred and processed outside your local jurisdiction. Privacy rights and safeguards may vary depending on where you live.

16. Your Rights

Depending on your jurisdiction, you may have rights related to access, correction, deletion, objection, restriction, withdrawal of consent where applicable, and data portability.

RodGrid may need to verify your identity before fulfilling a privacy request. Requests may be submitted to: [email protected].

If you took an interview on RodGrid rather than holding a RodGrid account, your request goes to the organization that invited you — they control that interview. See "Interview Candidates" for how this works and what RodGrid will do if you write to us instead.

17. European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, the UK, or Switzerland, Rodrigo Aires de Oliveira, carrying on business as RodGrid Software is the data controller for the personal information of RodGrid's own users — your account, your workspace, your billing, and how you use the service — and the following applies to you under the EU and UK General Data Protection Regulation (GDPR).

Interview candidates are the exception, and it is a deliberate one. Where a RodGrid customer invites someone to an interview, that customer is the controller of the candidate's personal information: they decide the purpose, who is invited, what is asked, how long it is kept, and what the result is used for. RodGrid acts as their processor for that data and handles it on their instruction. RodGrid remains responsible in its own right for what it decides — what the platform is capable of recording, how the scorecard is produced, and keeping the data secure — and a candidate exercising their rights should start with the organization that invited them, as described in "Interview Candidates."

We process your personal information on the following legal bases:

You have the right to access, correct, delete, restrict, or object to the processing of your personal information, to data portability, and to withdraw consent where processing is based on consent. You can export your data and delete your account directly from your profile, or contact [email protected]. You also have the right to lodge a complaint with your local data protection supervisory authority.

Where information is transferred outside your region, we rely on the safeguards our service providers use for international transfers (such as Standard Contractual Clauses), as described in "International Data Transfers."

18. California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you specific rights regarding your personal information. The categories of personal information RodGrid collects, the purposes for collecting it, and the categories of providers it is shared with are described in "Notice at Collection," "Information We Collect," and "Sharing and Service Providers" above.

RodGrid does not sell your personal information, and does not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA, and has not done so in the preceding 12 months. Because we do not sell or share your personal information, no "Do Not Sell or Share My Personal Information" opt-out is required — there is nothing to opt out of.

Subject to legal limits, you have the right to know and access the personal information we hold about you, to request correction of inaccurate information, to request deletion of your information, and not to be discriminated against for exercising these rights.

You can access and export your information or delete your account directly from your profile, or submit a request to [email protected]. We may need to verify your identity before acting on a request, and you may use an authorized agent where permitted by law.

19. Children's Privacy

RodGrid is intended for professional or business use and is not intended for minors.

RodGrid is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

If we learn that personal information from a child under 13 has been collected, we will take appropriate steps to delete it.

20. Changes to This Policy

This Privacy Policy may be updated periodically. When we do, we revise the "Last updated" date and post the updated policy here.

For minor or non-material updates, continuing to use RodGrid after they take effect constitutes acceptance of the revised policy.

For material updates that change how we handle your personal information, we will provide notice (for example, by email or an in-app notice) and, where required, ask for your acceptance or consent before the change applies to you. Until you accept, access to the service may be limited; you can still exercise your data-protection rights at [email protected].

21. Contact

The data controller for RodGrid's own users is Rodrigo Aires de Oliveira, carrying on business as RodGrid Software, PO Box 8011, Fredericton RPO Crossings, NB E3A 6C9, Canada.

For privacy-related questions or requests: [email protected]