GridPrepped

    Privacy Policy

    Last updated: April 18, 2026

    This Privacy Policy explains how GridPrepped ("we," "us," "our," or "the Service") collects, uses, discloses, and protects your information. By using the Service, you consent to the practices described here.

    1. Information We Collect

    We collect the following categories of information:

    • Account information: Name, email address, username, and authentication credentials (password hashes; we never store plaintext passwords).
    • Profile data: ZIP code, optional street address, household size, family/group membership, subscription tier, and notification preferences.
    • Preparedness data: Assessment answers, supply inventory, emergency plans, readiness goals, business continuity plan inputs, drill records, and any content you submit to community features.
    • AI-generated content & inputs: Prompts, parameters, and outputs generated by AI features such as "Plan for Me" and BCP generation. We log usage events (feature, timestamp, token counts) for rate-limiting, abuse prevention, and billing.
    • Usage & device data: Pages visited, features used, IP address, approximate location derived from IP, browser type, device identifiers, referrer URL, and session timestamps.
    • Payment data: Processed by our third-party payment processor (Stripe). We do not store full card numbers. We retain billing metadata such as plan, status, and last-4 digits.
    • Communications: Messages you send via contact forms, support requests, or community posts.

    2. How We Use Your Information

    • Provide, personalize, and improve the Service, including localized risk profiles and alerts.
    • Calculate and track your Grid Score and readiness progress.
    • Generate AI-assisted plans and recommendations (see Section 4).
    • Process payments, manage subscriptions, and prevent fraud.
    • Send transactional emails (account, billing, security, alerts) and, with your consent, marketing emails.
    • Enforce our Terms of Service, investigate abuse, and protect the safety and security of users and the Service.
    • Comply with legal obligations and respond to lawful requests.

    3. Legal Bases (EEA/UK Users)

    If you are in the European Economic Area or United Kingdom, we rely on the following legal bases: (a) performance of a contract (delivering the Service you requested), (b) legitimate interests (improving the Service, security, fraud prevention), (c) consent (marketing emails, optional features), and (d) legal obligation.

    4. Artificial Intelligence Features

    Certain features — including "Plan for Me," AI-generated business continuity plans, and similar tools — are powered by large language models (LLMs) provided by third-party AI vendors (currently Google and OpenAI, accessed via the Lovable AI Gateway). When you use these features:

    • Your inputs (assessment answers, ZIP-derived hazard data, household size, plan types, and existing inventory item IDs) are sent to the AI provider to generate a response.
    • We do not send your name, email, payment information, or precise street address to AI providers.
    • AI-generated content is produced algorithmically and may contain inaccuracies, omissions, or recommendations that are inappropriate for your specific situation. You must independently verify any AI output before relying on it, especially for life-safety decisions.
    • We retain AI usage events (feature name, timestamp, token counts, success/failure) for rate-limiting, billing, and abuse prevention. We do not use your AI inputs to train third-party foundation models.
    • Per our agreements with current AI providers, your prompts are not retained by them beyond the time required to generate a response (subject to their own policies).

    5. Data Sources & Public Information

    GridPrepped aggregates publicly available data from government and scientific sources including FEMA (National Risk Index, OpenFEMA, Flood Map Service), the National Weather Service (NWS), USGS (Earthquake Hazards, Water Services, Volcano alerts), AirNow (EPA), NASA FIRMS (active fires), NIFC/InciWeb, NOAA Storm Events, NOAA Space Weather Prediction Center, EIA (electricity & fuel), ERCOT (Texas grid real-time conditions), EPA Drinking Water, FBI Crime Data, U.S. State Department travel advisories, CISA advisories, and National Inventory of Dams (USACE). We do not claim ownership of this data; it remains in the public domain or is used under the terms of each provider's public access policy.

    6. How We Share Information

    We do not sell your personal information. We share data only as follows:

    • Service providers: Hosting and database (Supabase / Lovable Cloud), payment processing (Stripe), email delivery (Resend / configured SMTP), AI inference (Google, OpenAI via Lovable AI Gateway), map tile rendering (Geoapify — your approximate ZIP-centroid coordinates are sent to generate the area map embedded in your fridge-card and full-plan PDFs), analytics, and customer support tools. Each is contractually bound to protect your data and use it only on our instructions.
    • Family/organization members: If you join a family group or organization, certain profile and readiness data is visible to other members of that group as needed for the feature (e.g., household plan sharing). Community posts you create are visible to other authenticated users.
    • Legal & safety: When required by law, court order, or subpoena; to enforce our Terms; to investigate fraud or abuse; or to protect the rights, property, or safety of GridPrepped, our users, or the public.
    • Business transfers: If GridPrepped is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your data becomes subject to a different privacy policy.

    7. Data Retention

    We retain your personal information for as long as your account is active or as needed to provide the Service. After account deletion, we delete or anonymize your data within 30 days, except where we are required to retain it for legal, tax, accounting, or fraud-prevention purposes (typically up to 7 years for billing records). Aggregated, de-identified data may be retained indefinitely.

    8. Your Rights & Choices

    Depending on your jurisdiction, you may have the following rights:

    • Access & portability: Request a copy of the personal data we hold about you.
    • Correction: Update inaccurate information directly in your profile or by contacting us.
    • Deletion: Delete your account at any time from your dashboard, which removes your personal data subject to Section 7.
    • Opt-out: Unsubscribe from marketing emails via the link in any email or via your account settings. You cannot opt out of essential transactional emails (account, security, billing) while you have an active account.
    • California, Colorado, Virginia, and other state-law rights: Residents of certain U.S. states may have additional rights including the right to know, delete, correct, and opt out of "sale" or "sharing" (we do not sell or share for cross-context behavioral advertising). To exercise these rights, email hello@gridprepped.com.
    • EEA/UK rights: Right to lodge a complaint with your supervisory authority and to object to or restrict certain processing.

    9. Cookies & Similar Technologies

    We use essential cookies and local storage to maintain your session, remember preferences, and operate features such as cached AI plans. We do not use third-party advertising cookies or cross-site tracking. We may use first-party analytics to understand aggregate usage patterns. You can clear cookies and local storage via your browser at any time, though doing so may sign you out and reset preferences.

    10. Data Security

    We implement industry-standard administrative, technical, and physical safeguards including encryption in transit (TLS) and at rest, Row-Level Security on database tables, hashed passwords, restricted access to production systems, and regular security reviews. However, no internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk. You are responsible for maintaining the confidentiality of your account credentials.

    11. International Transfers

    GridPrepped is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to, stored, and processed in the U.S. and other countries where our service providers operate. By using the Service, you consent to such transfers. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for transfers from the EEA/UK.

    12. Children's Privacy

    The Service is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect personal information from them. If we learn we have collected such information, we will delete it promptly. Parents who believe their child has provided us information may contact us at hello@gridprepped.com.

    13. Service Availability & Offline Use

    GridPrepped is an internet-based service and may experience outages, interruptions, or delays. You should not rely on GridPrepped as your sole source of emergency information. We strongly recommend maintaining printed or offline copies of your emergency plans, downloading important documents locally, and having alternative sources of emergency alerts (NOAA Weather Radio, local broadcast media, etc.). GridPrepped is not responsible for any failure to deliver notifications or alerts due to service outages, network issues, third-party provider failures, or device limitations.

    14. Not Emergency Services

    GridPrepped is an informational and educational preparedness tool. It is not a substitute for official emergency services, warnings, or professional advice. In an emergency, always call 911 or your local emergency number and follow instructions from local emergency management, law enforcement, and first responders.

    15. Changes to This Policy

    We may update this policy from time to time. The "Last updated" date at the top reflects the latest revision. We will notify you of material changes via email or an in-app notice. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

    16. Contact Us

    If you have questions about this Privacy Policy or wish to exercise any of your rights, please contact us at hello@gridprepped.com.