Privacy policy

Who we are

Granterra is provided by Kognita AI Ltd, 3 Spruce Avenue, Loughborough, England, LE11 2QW, registered in England and Wales under company number 17162975 ("we", "us"). We are the controller of the personal data described in this policy. Contact us about privacy at info@kognitaai.com.

What this policy covers

This policy covers our website (granterra.app), the Granterra platform (app.granterra.app) and your contacts with us. If you are a researcher whose publicly available professional information we use, our notice for researchers explains that processing.

The data we use

Visiting the website. The website sets no cookies and uses no analytics or tracking. Our server processes the technical data every web request involves (such as your IP address) to deliver the page and keep the service secure.
Your account. When you sign in with Google, ORCID, Microsoft or an email code, we receive and keep your name, your email address (ORCID provides none) and the identifier your sign-in provider gives your account. We keep your membership (plan and dates) and the date your account was created. One person has one account: sign-ins with the same verified email address, or with an ORCID iD you have connected, are joined to the same account.
Using the platform. Your saved alerts and their results, the searches and concept notes you submit to Search by idea, how many times you used Search by idea in a month, and display choices (such as cards or table).
Your researcher profile, if you opt in. Your ORCID iD (connected through ORCID itself), your choice to show your profile, and a record of each change to that choice.
Payments. Payments are handled by Stripe. We receive the subscription, invoice and payment status and the billing details needed for invoices; we never receive your full card or bank details.
Contacting us. The emails you send us and our replies.

Why we use it, and on what legal basis

To provide the platform you signed up for, manage your account and membership, and take payments: performance of our contract with you (Article 6(1)(b) UK GDPR and GDPR).
To keep the service secure, prevent misuse and join duplicate accounts of one person: our legitimate interests (Article 6(1)(f)).
To show your researcher profile to other members: your consent (Article 6(1)(a)), which you can withdraw at any time on your profile page; your profile disappears at once.
To keep invoices and accounting records: our legal obligations (Article 6(1)(c)).
To answer your messages: our legitimate interest in responding, or steps you asked for before a contract.

Your concept notes

Text you paste into Search by idea is private to your account. It is not shown to anyone else, not sent to other companies or public databases, and not used to train any AI model. It is kept for 30 days, so that links to your results keep working, and then deleted.

Who receives data

Hetzner Online GmbH (Germany) hosts the platform and the website on servers in Nuremberg, Germany.
Your sign-in provider (Google, ORCID, Microsoft, or the email-code service) processes your sign-in under its own privacy policy.
Stripe processes payments; for some of this processing (such as fraud prevention) Stripe acts as a controller under its own privacy policy.
ORCID and OpenAlex: when you opt in to show your profile, we use your ORCID iD to retrieve your public list of publications from them.
Our email provider, for messages you send us.

We do not sell personal data or share it for advertising.

Where your data is stored

We store your data in the EU (Germany). Where a provider named above processes data outside the UK or the EEA, it does so under safeguards recognised by UK and EU law, such as standard contractual clauses.

How long we keep it

Account, membership and platform data: while you have an account. If you ask us to delete your account, we delete it within 30 days.
Concept notes: 30 days.
Records of your researcher-profile choices: kept as proof of your choices for as long as needed for that purpose, including after your account is deleted, without your name or email.
Invoices and accounting records: six years, as UK law requires.
Emails with us: as long as needed to deal with your request.
Backups are overwritten on a rolling basis.

Your rights

You can ask us for access to your data, for a copy in a portable format, and to correct, delete or restrict it; you can object to processing based on our legitimate interests, and withdraw consent at any time. Write to info@kognitaai.com. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live in the EU.

Security

Connections are encrypted. The part of the platform that members use cannot read our internal database; access to our systems is limited to authorised staff and protected by additional network controls.

Changes

We will update this policy when our processing changes, and tell account holders about significant changes.

Last updated: 9 November 2026