Where you live: who is in charge of your information at GRAJ, which law applies, and what is not done yet.
Last updated: 2026-10-22
GRAJ does not sell your personal information and does not share it for advertising — wherever you live. These are the commitments that depend on where you are, beside the full Privacy Policy. Each line names its law and the day it was read; a line that says "to confirm" was not read from the law itself.
Section 1
Canada (PIPEDA; Quebec's Law 25; Alberta and British Columbia)
The person in charge of the protection of personal information at GRAJ is its founder — the person with the highest authority in the business, who holds the role by default under Quebec's Act respecting the protection of personal information in the private sector (s. 3.1) and is the individual accountable under PIPEDA. Title: Founder, GRAJ. Contact: ilove@getreadyandjump.com. The role may be delegated in writing; if it is, this line will name the new title and contact. Source: Commission d'accès à l'information du Québec, "Responsabilité des entreprises" (person in charge; title and contact published on the website; the Commission is not notified) (read 2026-10-22).
You may ask for access to the personal information GRAJ holds about you and have it corrected; in Quebec you may also ask for it in a structured, commonly used technological format. A copy of your data, erasure and correction are in your account under Settings, and anything else by email. GRAJ answers within 30 days. Source: PIPEDA, S.C. 2000, c. 5, Schedule 1 principle 4.9 and s. 8(3); Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 27 and 32.The statutes' text was not re-read in this build (LégisQuébec answered 403): the 30-day period and Quebec's portability right are to confirm.
GRAJ's providers process information in the United States (see "International transfers"). Quebec asks a business to assess the privacy impact before personal information leaves Quebec; GRAJ has not yet published that assessment. Source: CQLR c. P-39.1, s. 17.Not re-read in this build — to confirm.
If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d'accès à l'information, or in Alberta or British Columbia to that province's Information and Privacy Commissioner. Source: PIPEDA s. 11; CQLR c. P-39.1; PIPA (Alberta), S.A. 2003, c. P-6.5; PIPA (British Columbia), S.B.C. 2003, c. 63.
Section 2
United States (California and the other state privacy laws)
GRAJ does not sell personal information and does not share it for cross-context behavioral advertising, so there is nothing to opt out of — but the right stands, and a Global Privacy Control signal from your browser needs nothing further: there is no sale or sharing for it to stop. "Your privacy choices" in the footer comes here. Source: California Consumer Privacy Act, Civil Code §§ 1798.120, 1798.135; CCPA Regulations, 11 CCR § 7025 (opt-out preference signals).The regulations were not re-read in this build — to confirm.
The CCPA reaches a business with over USD 26,625,000 in annual gross revenue (from 1 January 2025), or one that buys, sells or shares the personal information of 100,000 or more California consumers or households, or earns half its revenue from selling or sharing it. GRAJ gives every person in every state the rights in "Your rights and choices" whether or not a law reaches it. Source: California Privacy Protection Agency, "CPI adjustment" (Civil Code § 1798.140(d)(1)(A)) (read 2026-10-22).
Other states with comprehensive consumer privacy laws in force: Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana (2023-2024); Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland (2025); Indiana, Kentucky, Rhode Island (2026). They give the same core rights — access, correction, deletion, portability, opt-out of sale, targeted advertising and profiling — and an appeal if a request is refused: write to us and say it is an appeal. The list and the dates are as commonly reported, not read from each statute in this build — to confirm. Each state's threshold differs, and a law that does not reach GRAJ is honored all the same.
Biometric information (identity verification) is covered under "Biometric information" — Illinois, Texas and Washington have their own biometric statutes.
Section 3
United Kingdom (UK GDPR and the Data Protection Act 2018)
GRAJ is established in the United States and offers the Protocol to people in the UK, so UK GDPR applies to that processing. You may complain to the Information Commissioner's Office (ico.org.uk) at any time. Source: UK GDPR Arts. 3(2) and 77 (read 2026-10-22).
A controller outside the UK appoints a representative in the UK. GRAJ has not appointed one yet; until it does, write to us at the contact above. Source: UK GDPR Art. 27.
Section 4
European Union and Denmark (GDPR; the Danish Data Protection Act)
GDPR applies to GRAJ's processing for people in the EU. In Denmark the supervisory authority is Datatilsynet (datatilsynet.dk); anywhere in the EU you may complain to your own country's authority. A Danish CPR number is never asked for on GRAJ's payer file — it is used only where Danish law allows it. Source: GDPR Arts. 3(2), 77; Databeskyttelsesloven (lov nr. 502 af 23. maj 2018) § 11 (read 2026-10-22).§ 11 was not re-read in this build — to confirm.
A controller outside the EU appoints a representative in a member state. GRAJ has not appointed one yet; until it does, write to us at the contact above. Source: GDPR Art. 27.
Section 5
Australia (Privacy Act 1988 and the Australian Privacy Principles)
The 13 Australian Privacy Principles govern how personal information is collected, used, disclosed, kept accurate and secure, and how you may see and correct it. A business with annual turnover of AUD 3 million or less is generally outside the Act; GRAJ follows the principles for everyone in Australia whether or not the Act reaches it. Source: Privacy Act 1988 (Cth) Sch. 1; Office of the Australian Information Commissioner, "Australian Privacy Principles" and "Opting in to the Privacy Act" (read 2026-10-22).
GRAJ's providers process information in the United States (see "International transfers"); disclosing it overseas is APP 8, and GRAJ stays accountable for it. If you are not satisfied with GRAJ's answer, you may complain to the OAIC (oaic.gov.au). Source: Privacy Act 1988 (Cth) Sch. 1 APP 8 and s 16C; s 36.APP 8 and s 16C were not re-read in this build — to confirm.
Section 6
New Zealand (Privacy Act 2020)
The Privacy Act 2020 reaches a business outside New Zealand that carries on business there, so it applies to GRAJ for people in New Zealand. You may ask for and correct the information GRAJ holds about you, and complain to the Privacy Commissioner (privacy.org.nz). Source: Privacy Act 2020 ss 4 and 22 (IPPs 6-7).Section 4 was not re-read in this build — to confirm.
From 1 May 2026, when GRAJ collects personal information about you from someone else — a business adding you as a contact or a prospect, for example — it takes reasonable steps to tell you: that it has it, why, who will receive it, GRAJ's name and address, and your rights to see and correct it (IPP 3A). Source: Privacy Act 2020 s 22 IPP 3A, inserted by the Privacy Amendment Act 2025 (in force 1 May 2026; s 25A — not for information collected before then); Office of the Privacy Commissioner, IPP 3A guidance (December 2025) (read 2026-10-22).Read through a search of legislation.govt.nz and privacy.org.nz — to confirm. GRAJ's own notice to a contact added by someone else is not yet sent automatically.
Section 7
Mexico (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, 2025)
A new federal data protection law for private parties was published on 20 March 2025, replacing the 2010 law; the authority is now the Secretaría Anticorrupción y Buen Gobierno, which took over from the dissolved INAI. You may access, rectify, cancel or oppose the use of your data (ARCO rights) by writing to us. Source: Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, última reforma DOF 14-11-2025) — read through a search of diputados.gob.mx (read 2026-10-22).The law's articles on the privacy notice and the ARCO deadlines were not read in this build — to confirm.
The law asks for a privacy notice (aviso de privacidad) a person can read before their data is used. GRAJ's notice is in English; a Spanish version for Mexico is not yet published. Source: LFPDPPP (2025).The notice's required contents under the 2025 law are to confirm.
Section 8
Japan (Act on the Protection of Personal Information)
Personal data about you is given to a third party in another country only with your consent, after you are told the country, its data protection system and the measures the recipient takes — or where the recipient keeps a system the Personal Information Protection Commission recognizes. GRAJ's providers are in the United States. Source: Act on the Protection of Personal Information art. 28 (as amended 2020); Personal Information Protection Commission, "Comparative table of the current and amended provisions of the APPI" (ppc.go.jp, read through a search 2026-10-22) (read 2026-10-22).GRAJ's country-by-country transfer information is not yet published — to confirm what it must say.
A leak that may harm you is reported to the Commission and you are told. You may ask GRAJ to disclose, correct or stop using your data, and complain to the Personal Information Protection Commission (ppc.go.jp). Source: APPI art. 26 (leak reports, in force 1 April 2022) and arts. 33-35.Not re-read in this build — to confirm.
Section 9
India (Digital Personal Data Protection Act 2023 and Rules 2025)
The Digital Personal Data Protection Rules were notified in November 2025 with an 18-month phased start; when they apply in full, GRAJ gives a standalone consent notice, answers a request to access, correct or erase within 90 days, and names a contact for grievances. You may complain to the Data Protection Board of India. Source: Digital Personal Data Protection Act 2023; Digital Personal Data Protection Rules 2025 — Press Information Bureau, "Government notifies DPDP Rules" (pib.gov.in, read through a search 2026-10-22) (read 2026-10-22).The Rules' own text and the exact day each duty applies (about May 2027) are to confirm.
GRAJ's providers process information in the United States. The DPDP Act allows personal data to go outside India except to a country the Government restricts by notification; no such restriction reaches the United States today. Source: Digital Personal Data Protection Act 2023 s 16.Section 16 and any notification under it were not read in this build — to confirm.
