Last updated April 5, 2026
Grailsome collects the minimum information necessary to operate and improve the service. Account creation requires an email address (encrypted at rest). Collection contents including items, photos, valuations, narratives, and provenance events use field-level encryption. Photos and files reside on secure US cloud servers (AWS S3) accessed through the application only. Payment handling involves only a Stripe customer ID and encrypted billing email — credit card data never touches our servers. Server logs exist for debugging with sensitive data filtered out. No third-party analytics or tracking pixels are deployed.
Grailsome uses AI to identify collectibles, estimate values, generate narratives, and detect counterfeits. Photos and item details are transmitted to external AI providers (Anthropic, OpenAI, Google, xAI) meeting our privacy standards. AI providers cannot train models on your data. Conversations and processing results are stored only within your account.
Collection item photos are processed by AI for identification, grading, and cataloging. This service applies only to collection photos you submit for scanning.
Payment processing uses Stripe's secure hosted checkout pages where card details never touch our servers. File storage employs AWS S3 with application-layer access control. AI providers support scanning, valuation, and narrative features without permission to train on your data. Web fonts load externally without cookie placement or information sharing.
A single HTTP-only, secure, same-site session cookie maintains login status. No third-party tracking, analytics platforms, advertising cookies, or cross-site tracking exist. We use standard Rails CSRF protection without CAPTCHA services.
You may request data access, correction, deletion, or portability at any time. Email help@grailsome.ai and we will respond within 30 days.
Archived items remain recoverable until permanently deleted. Account deletion permanently removes all data — collections, items, photos, valuations, narratives, and provenance events. Uploaded files are removed from storage within 30 days. This deletion is irreversible.
Field-level encryption protects data at rest. HTTPS with HSTS enforcement encrypts data in transit. Payment card numbers never reach our servers. File storage is accessible only through authenticated application access.
Servers, database, and storage operate in the United States. By using the service, you consent to US processing and storage.
Significant changes will be communicated at your next login. Minor clarifications may proceed without notice. The "last updated" date reflects the current revision.
Questions? Email help@grailsome.ai