Your material and privacy

Effective 29 September 2026.

1. Who provides this workspace

GraniteAi is operated by GraniteAi LLC, 145 Lakeside Drive, Manchester, NH 03104. GraniteAi LLC decides how your material is handled here and is responsible for it. Questions about your data go to support@graniteai.co.

This workspace is built for professionals in the United States, and the services behind it run in the United States. It is not directed to people under 16, and LinkedIn itself does not accept members under 16. If you use the workspace from outside the United States, your material is transferred to and processed in the United States. For people in the European Economic Area, the United Kingdom and Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum with each processor above, and on your instruction to publish when sending content to LinkedIn.

2. What this workspace stores

Your email address, the professional profile you fill in, any writing you import as material, any source you or your AI client send in for a draft, the drafts and posts produced from it, the headline image rendered for each post, your publication permissions, and a record of service activity such as sign-ins, profile updates and scheduled posts.

If you connect LinkedIn, your LinkedIn member identifier, display name and access credentials are stored. Credentials are encrypted on the server. For posts you publish, LinkedIn's own lifetime counts for impressions, reactions, comments, reshares and members reached are stored when your connection carries the analytics permission.

If you subscribe, the payment provider's customer identifier, your subscription status and the billing events behind it are stored. Card numbers never reach this workspace.

Sign-in codes, sessions, OAuth states and AI client tokens are stored as one-way hashes, not in readable form.

If you arrive from a specific link or campaign, we record that source — such as a utm parameter or the page that referred you — together with your account, so we know which channel brought you here.

If you start signing in but do not finish, we may keep your email address as an unconfirmed lead so we can follow up about the workspace; confirm or unsubscribe from the link in that email at any time.

3. Who else processes your material

These services are used to run the workspace. They receive only what their job requires.

• OpenAI, to write drafts. Receives your professional profile, the material you import, any source you or your AI client send in for a draft, and your recent post titles.
• LinkedIn, to publish and to read back your own post analytics. Receives the post text and image you authorize, and any comment you write and send from the workspace on a post it published.
• Resend, to deliver sign-in emails. Receives your email address and the code.
• Stripe, to take subscription payment. Receives your email address and your account identifier.
• Vercel, application hosting.
• Neon, database hosting.
• Sentry, error reporting. Receives error messages and diagnostic tags such as the route, request identifier and seller identifier. The reporter does not attach request bodies or headers.
• Doppler, operational configuration storage. Holds the service credentials used to run the platform, not a copy of your workspace writing.
• Better Stack, uptime monitoring and the public status page. Receives health-check responses and timing information, and your email address if you subscribe to status updates.

Operational service list updated 17 September 2026 to identify services configured on 16 September. This disclosure does not change your publishing permissions or the terms effective date.

OpenAI, LinkedIn, Stripe, Vercel and Neon operate in the United States; Resend delivers through Amazon Web Services in the United States. This list changes only when the service changes, and material changes are announced under section 10.

4. Content generation

The content engine sends your supplied professional material to OpenAI to write drafts, using the standard API configuration, under which OpenAI does not use the data to train its models. Avoid supplying private employer or client information, anything about identifiable other people, and anything sensitive such as health, political or religious detail. A supplied fact is not independently verified merely because it appears in a draft.

5. LinkedIn and connected AI clients

LinkedIn receives posts you authorize for publication. Connecting LinkedIn does not by itself publish anything.

If you connect an AI client through the consent screen, that client can read your workspace profile, your stored posts and their status and metrics. It can save a draft for your review, and it can send a transcript, article, notes or a public link for the workspace to write a draft from. That draft waits in the studio for you unless you have turned on automatic publishing. In that case it is scheduled on your posting rhythm and published at that time, unless your workspace requires approval first. Whatever it reads goes to the company that provides that client, and that company's own terms and privacy policy govern what it does with it. Connecting Claude makes Anthropic a recipient; connecting ChatGPT makes OpenAI one. You can revoke AI client access at any time in Publishing & access.

Sections 2, 3, 5, 7 and 8 updated 23 September 2026 to describe sources an AI client can send for a draft.

6. Cookies and tracking

This workspace sets two cookies, both strictly necessary, so there is nothing to consent to and nothing to opt out of. studio_session keeps you signed in for seven days. studio_oauth lasts ten minutes and exists only to tie a LinkedIn connection attempt to the browser that started it. The browser's session storage briefly holds the page to return to after sign-in; it is cleared when the tab closes and never sent to us.

There is no analytics, no session recording, no advertising cookie and no tracking pixel of any kind in this workspace.

7. How long material is kept

Sign-in codes, sessions, OAuth states and AI client tokens are removed as soon as they expire. Records used to rate limit sign-in attempts expire within a day.

Drafts, canceled posts and failed posts older than 365 days are purged automatically, and so are service activity records and abandoned intake forms. Scheduled and published posts stay in your workspace until you delete them or delete the workspace.

The text of a source sent in for a draft is deleted 30 days after the draft is written or the attempt fails. The record that it was sent is kept under the 365-day rule above, or for as long as a post written from it is kept.

Billing and payment records are kept for seven years, because tax and accounting rules require it.

8. Access and deletion

Export everything held about you from Publishing & access: your profile, imported material, publication policy, LinkedIn connection details, posts, post metrics, activity record, subscription history, feedback, generation usage and the sources sent in for drafts.

Delete your workspace from the same tab. After you confirm your sign-in email, your profile, posts, imported material, publication permissions, LinkedIn connection and AI client access are removed immediately, and your stored LinkedIn credentials are erased.

Disconnecting LinkedIn under Publishing & access erases your stored LinkedIn credentials and the analytics counts read from LinkedIn, pauses automatic publishing, and cancels scheduled posts. Your posts and drafts stay in the workspace.

Billing records survive that deletion, because tax and accounting rules require them for seven years, but your email address is removed from them: the stored payment events for your past invoices keep the amounts, identifiers and dates, and the address is erased from them at the same time as everything else. A short deletion record is also kept, containing the seller, the date and a keyed fingerprint of your email address. That fingerprint cannot be turned back into your address, though it would let us recognise the same address if you gave it to us again.

Two things are outside our reach. Our payment provider keeps its own customer record on its systems under its own policy, and deleting your workspace here does not remove posts already published on LinkedIn.

9. Your rights

You can ask what is held about you, correct it, get a copy, have it deleted, and ask to stop being contacted. These rights come from California and similar state laws, and they are extended to everyone who asks, wherever you live.

We process your material to provide the workspace you asked for (performance of a contract), to keep it secure and meet tax and accounting duties (legal obligation), and, for the activity record, in our legitimate interest in running a reliable service. Connecting an AI client or turning on unattended publishing is processing based on your consent, which you can withdraw under Publishing & access.

Requests go to support@graniteai.co. Expect acknowledgement within ten business days and a substantive answer within forty five calendar days, extendable once to ninety days for a complicated request, with notice. If you are in the EEA, UK or Switzerland you can also complain to your local data protection authority.

Your material is never sold and never shared for cross-context behavioral advertising. Because there is no tracking in this workspace, a Global Privacy Control signal has nothing to switch off here.

10. Security, breaches and changes

LinkedIn credentials are encrypted with AES-256-GCM. Session and AI client tokens are stored only as hashes. Every request is bound to your account and your seller before any row is read or written, and the database enforces row-level security beneath that. Requests that change anything are checked against the workspace origin, and sensitive actions are rate limited. Sign-in credentials are not shared with your AI client.

If personal information is exposed in a security incident, affected people and any regulator entitled to notice are told without undue delay, with what happened and what to do about it.

Material changes to this notice are posted here at least fifteen days before they take effect, with a revised date. Earlier versions are available on request at support@graniteai.co.

11. Contact

Write to support@graniteai.co, or to GraniteAi LLC at 145 Lakeside Drive, Manchester, NH 03104.