Privacy Policy

Grayrock Privacy Policy

Grayrock Capital Pte. Ltd. (“Grayrock”, “we”, “us” or “our”) respects your privacy and is committed to handling personal data responsibly.

This Privacy Policy explains how Grayrock collects, uses, discloses, stores and protects personal data when you visit Grayrock websites, communicate with us, subscribe to communications, create an account, or use Grayrock products and services, including Grayrock Money and Grayrock Trading Journal.

Grayrock Capital Pte. Ltd. is based in Singapore and handles personal data in accordance with applicable data-protection requirements, including Singapore’s Personal Data Protection Act 2012 (“PDPA”).

1. Who We Are

Company: Grayrock Capital Pte. Ltd.
Company Registration No.: 200721052C
Country: Singapore
Website: Grayrock.asia
General Support: support@grayrock.asia
Privacy & Data Protection: privacy@grayrock.asia

Grayrock develops and operates focused software products, including Grayrock Money and Grayrock Trading Journal.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through:

• Grayrock.asia and related Grayrock websites;
• Grayrock Money;
• Grayrock Trading Journal;
• Grayrock Sync and related supported product components;
• account registration and authentication;
• subscription and billing interactions;
• customer support and contact forms;
• newsletters and product communications; and
• other Grayrock services that refer to this Privacy Policy.

Separate product notices may supplement this Privacy Policy where necessary.

3. Personal Data We May Collect

The information we process depends on how you interact with Grayrock and which products or features you use.

3.1 Account and Contact Information

This may include:

• name;
• email address;
• account identifiers;
• authentication-related information;
• subscription status;
• communication preferences;
• support requests; and
• correspondence with Grayrock.

Grayrock does not store passwords in plain text. Authentication credentials are handled using appropriate technical safeguards.

3.2 Google Sign-In Information

Grayrock Money may allow you to create an account or sign in using Sign in with Google.

When you choose Google Sign-In, Grayrock may receive basic information associated with your Google Account, including:

• your Google account identifier;
• your name;
• your email address; and
• your profile image, where available.

Grayrock uses this information only as reasonably necessary to:

• create your Grayrock Money account;
• identify and authenticate you;
• link your Google Account to an existing Grayrock Money account where applicable;
• enable you to sign in using Google; and
• maintain the security and operation of your account.

Grayrock Money does not request access to your Gmail messages, Google Drive files, Google Contacts or other Google Account content as part of the standard Google Sign-In process.

Grayrock does not receive or store your Google Account password.

Grayrock securely stores the information reasonably required to maintain the account connection and authentication process.

Grayrock does not sell Google user data or use Google user data for targeted advertising.

Google user data may be processed by service providers acting on Grayrock’s behalf only where reasonably necessary to provide, secure or operate the service, or where otherwise permitted or required by applicable law and this Privacy Policy.

If you stop using Google Sign-In or disconnect your Google Account, information already associated with your Grayrock Money account may continue to be retained in accordance with Grayrock’s applicable data-retention practices and this Privacy Policy.

You may contact Grayrock regarding access, correction or deletion of personal data associated with your Grayrock account using the contact details provided in this Privacy Policy.

3.3 Grayrock Money Data

If you use Grayrock Money, information you choose to enter, upload, import or generate may include:

• financial account names and descriptions;
• account types;
• account balances;
• currencies;
• transaction records;
• income and expenses;
• transfers;
• merchants and payees;
• categories and subcategories;
• tags;
• budgets;
• financial goals;
• recurring transactions and commitments;
• reconciliation information;
• financial reports;
• notes and references;
• uploaded attachments;
• imported financial files;
• Personal, Business or Mixed classifications; and
• other information required to provide features you choose to use.

Grayrock Money is a money-management product. Users control the information they choose to enter or import into their workspace.

3.4 Grayrock Trading Journal Data

If you use Grayrock Trading Journal, information you choose to enter, upload, import, synchronize or generate may include:

• broker or trading-account identifiers;
• trading history;
• completed trade records;
• instruments and symbols;
• entry and exit information;
• quantities or lot sizes;
• profit and loss information;
• commissions, swaps and other trading costs where available;
• strategies;
• setups;
• tags;
• notes;
• mistakes;
• psychology and discipline observations;
• trading-session information;
• performance statistics and metrics;
• chart images;
• imported trading files;
• journal records; and
• other information required to provide selected Trading Journal features.

3.5 Grayrock Sync Data

Where you use Grayrock Sync with a supported MetaTrader environment, Grayrock may process information required to pair the supported terminal with your Grayrock Trading Journal account and synchronize supported completed-trade information.

Grayrock Sync is designed for journal synchronization. Grayrock does not request your broker master password or investor password for this synchronization workflow and does not use Grayrock Sync to place, modify or close trades.

3.6 Imported and Uploaded Data

Where a Grayrock product permits file upload or import, we may process the uploaded information to:

• read and validate the file;
• identify supported data structures;
• map source fields;
• normalize supported information;
• identify duplicates or errors;
• provide an import preview;
• complete an import requested by the user;
• store attachments requested by the user; and
• provide related product functionality.

Users are responsible for ensuring that they have the lawful right or authority to provide information they upload, import or synchronize with Grayrock.

3.7 Technical and Usage Information

We may process technical information such as:

• IP address;
• browser type;
• device and operating-system information;
• date and time of access;
• application logs;
• security events;
• session information;
• product usage information;
• diagnostic information; and
• information required to prevent abuse and maintain system security.

3.8 Payment and Subscription Information

Where paid subscriptions are offered, Grayrock may receive information relating to:

• selected subscription plan;
• billing status;
• transaction reference;
• payment status; and
• limited payment-related information made available by our payment provider.

Payment-card information may be collected and processed directly by our payment-service provider. Grayrock does not need to store complete payment-card numbers to operate its subscriptions.

4. How We Use Personal Data

We may collect, use or disclose personal data for purposes including:

• providing Grayrock products and services;
• creating and managing user accounts;
• authenticating users;
• maintaining workspaces;
• processing data entered or imported by users;
• providing reports, analytics and other requested functionality;
• synchronizing supported trading-journal information;
• administering subscriptions and payments;
• responding to enquiries and support requests;
• providing important service communications;
• providing newsletters or product updates where requested or otherwise permitted;
• maintaining, troubleshooting and improving our products;
• monitoring reliability and performance;
• maintaining security;
• detecting and preventing fraud, misuse and unauthorized activity;
• maintaining audit and security records;
• protecting Grayrock, our users and our systems;
• complying with legal and regulatory obligations; and
• other purposes notified to you when the information is collected.

We seek to collect, use and disclose personal data only for purposes that are appropriate in the circumstances and in accordance with applicable law.

Singapore’s PDPA requires organisations to notify individuals of purposes and limits collection, use and disclosure to appropriate purposes, subject to applicable exceptions.

5. Consent and Withdrawal

Where consent is required, Grayrock may obtain consent through account registration, product interactions, forms, settings or other appropriate means.

You may withdraw consent for applicable collection, use or disclosure of personal data by contacting us.

Withdrawal of consent may affect our ability to provide features or services that require the relevant information.

Some information may continue to be processed where permitted or required by applicable law, including for security, legal, contractual or legitimate business purposes.

6. How Grayrock Handles Product Data

Grayrock processes product data primarily to provide the functionality requested by the user.

Grayrock does not sell users’ personal financial or trading information to advertisers.

Grayrock does not use Grayrock Money financial records or Grayrock Trading Journal records to provide individualized investment recommendations unless a future service expressly states otherwise and the necessary legal and regulatory requirements have been addressed.

Grayrock may process aggregated or de-identified information for purposes such as product reliability, usage analysis, security and improvement where such information no longer identifies an individual.

7. Service Providers and Data Intermediaries

Grayrock may engage third-party providers to support operation of our websites and products.

These may include providers of:

• website and application hosting;
• server and cloud infrastructure;
• database or storage infrastructure;
• backup services;
• authentication;
• email delivery;
• payment processing;
• monitoring and error reporting;
• analytics;
• customer support; and
• other technical or operational services.

Where a provider processes personal data on Grayrock’s behalf, we take appropriate steps to manage the relationship and require appropriate handling and protection of personal data.

Under Singapore’s PDPA framework, organisations remain responsible for relevant obligations when using data intermediaries, while data intermediaries have their own role-based obligations.

8. Hosting and International Data Transfers

Grayrock Capital Pte. Ltd. is based in Singapore.

To provide and operate Grayrock products, personal data may be hosted, stored or processed outside Singapore.

Grayrock’s production infrastructure may be hosted in the European Union, including the Netherlands.

Other service providers used for functions such as email delivery, payment processing, monitoring, authentication, storage or support may process information in other jurisdictions.

Where personal data is transferred outside Singapore, Grayrock takes appropriate steps to comply with applicable transfer requirements and to ensure that transferred personal data receives a standard of protection comparable to that required under Singapore’s PDPA.

The PDPA does not prohibit overseas storage, but requires overseas transfers to satisfy prescribed requirements concerning comparable protection.

9. Data Security

Grayrock takes reasonable technical, administrative and organizational measures appropriate to the nature of the information and services involved.

Depending on the relevant system, these measures may include:

• encrypted connections;
• authentication controls;
• authorization and access controls;
• workspace and tenant access restrictions;
• administrative access restrictions;
• secure credential handling;
• audit and security logging;
• rate limiting and abuse protection;
• backup controls;
• system monitoring;
• vulnerability and security updates; and
• other measures designed to reduce unauthorized access, disclosure, alteration or loss.

Grayrock reviews security measures as products and infrastructure evolve.

No internet-based service, software system or method of electronic storage can be guaranteed to be completely secure. Grayrock therefore cannot represent that our systems are immune from every possible security risk.

Singapore’s PDPA requires reasonable security arrangements for personal data in an organisation’s possession or control.

Additional information about our general approach is available on our Data Protection & Security page.

10. Backups and Data Export

Certain Grayrock products may provide user-facing backup or export features.

These features are separate from infrastructure-level backup, continuity and recovery measures maintained by Grayrock or its service providers.

User-facing exports may allow information to be downloaded in supported readable formats.

Where workspace backup functionality is available, users are responsible for protecting copies they download because downloaded files may contain sensitive financial, trading or personal information.

Availability and functionality of backup, restore and export features may vary by product and subscription plan.

11. Data Retention

Grayrock retains personal data only for as long as reasonably necessary to:

• provide the applicable services;
• fulfil the purposes for which the information was collected;
• maintain account and product functionality;
• maintain security and audit records;
• resolve disputes;
• prevent fraud or misuse;
• meet legitimate business requirements; and
• comply with legal obligations.

When personal data is no longer required for business or legal purposes, Grayrock will take reasonable steps to cease retaining it, delete it, anonymize it or remove the means by which it can be associated with an identifiable individual, as appropriate.

Residual copies may remain temporarily in backup or recovery systems until those backups expire or are overwritten according to applicable retention practices.

The PDPA includes a Retention Limitation Obligation requiring organisations to cease retaining personal data when it is no longer needed for business or legal purposes.

12. Account Closure and Deletion

Where account or workspace deletion functionality is available, deletion may remove or schedule deletion of applicable active product data.

Some information may be retained for a limited period where reasonably required for:

• security;
• fraud prevention;
• dispute resolution;
• legal compliance;
• accounting or transaction records;
• backup integrity; or
• other legitimate business purposes permitted by law.

Deleting a Grayrock account does not necessarily cause every residual backup copy to disappear immediately. Such copies may remain until the relevant backup expires according to the applicable retention schedule.

13. Access and Correction

Subject to applicable law and permitted exceptions, individuals may request access to personal data held by Grayrock and information concerning applicable use or disclosure of that personal data.

Individuals may also request correction of errors or omissions in personal data.

Requests may be sent to:

privacy@grayrock.asia

We may need to verify your identity before processing a request.

Singapore’s PDPA includes access and correction obligations, subject to statutory exceptions.

14. Data Breaches

Grayrock maintains procedures for assessing and responding to suspected personal-data breaches.

Where a breach is notifiable under applicable law, Grayrock will take appropriate steps to notify the relevant authority and/or affected individuals as required.

Under Singapore’s PDPA, organisations must assess data breaches and notify the PDPC and affected individuals where applicable statutory thresholds are met.

15. Cookies and Similar Technologies

Grayrock websites and products may use cookies or similar technologies for purposes including:

• essential website functionality;
• authentication;
• security;
• maintaining sessions;
• remembering preferences;
• understanding website or product usage; and
• analytics where implemented.

Where required, optional cookies will be managed through applicable consent mechanisms.

For more information, see our Cookie Policy.

16. Marketing Communications

Where you subscribe to newsletters, announcements or other optional marketing communications, you may unsubscribe using the method provided in the communication or by contacting Grayrock.

Service-related communications necessary for account operation, security, subscriptions or product functionality may be treated separately from optional marketing communications.

17. Third-Party Websites and Services

Grayrock websites and products may contain links to or interact with independent third-party services.

Grayrock is not responsible for the privacy practices of independent third parties acting for their own purposes.

You should review the applicable privacy policies and terms of those third parties before providing information to them.

18. Children’s Privacy

Grayrock products are not currently designed or directed specifically at children.

If Grayrock introduces products or services specifically intended for children, appropriate notices, controls and safeguards will be implemented where required.

19. Your Responsibilities

Users should take reasonable steps to protect their own Grayrock accounts and exported data.

This includes:

• using strong and unique credentials;
• protecting authentication methods;
• not sharing account access unnecessarily;
• keeping devices reasonably secure;
• protecting downloaded backups and exports; and
• notifying Grayrock if unauthorized account access is suspected.

Users are also responsible for ensuring that information uploaded or imported into Grayrock can lawfully be provided and processed.

20. Data Protection Contact

Grayrock designates responsibility for overseeing its data-protection practices in accordance with applicable requirements.

Privacy, personal-data and data-protection enquiries may be sent to:

Data Protection Contact
Grayrock Capital Pte. Ltd.
Singapore
Company Registration No.: 200721052C
Email: privacy@grayrock.asia

PDPC guidance requires organisations to designate at least one person responsible for data protection and make the DPO’s business contact information available to the public.

21. Changes to This Privacy Policy

Grayrock may update this Privacy Policy as our products, services, infrastructure, service providers or legal requirements evolve.

The latest version will be published on Grayrock.asia with an updated Last Updated date.

Material changes may also be communicated through appropriate channels where necessary.

22. Contact Us

For general product or customer-support enquiries:

Grayrock Capital Pte. Ltd.
Singapore
Company Registration No.: 200721052C
Email: support@grayrock.asia