Privacy Policy

1. Introduction

This Privacy Policy explains how Griffex S.A. ("Griffex S.A.", "we", "us"), a company located at Avenida La Reforma, Edificio Aristos 7-62, Oficina 709, Zona 9, Guatemala City, Guatemala, processes personal data in connection with Griffex ("the Service"), its legal practice management platform available at www.griffex.app.

Griffex is a multi-tenant software-as-a-service (SaaS) platform for law firms and legal professionals that supports managing cases, stakeholders, documents and files, charges and invoices, alarms and reminders, and team collaboration. This policy applies to everyone who uses the Service or contacts us.

2. Definitions

• Personal data: any information relating to an identified or identifiable natural person.
• Data controller: the party that determines the purposes and means of processing.
• Data processor: the party that processes data on behalf of the controller.
• Workspace: an isolated environment within an organization where a customer stores its information.
• Stakeholder: any person or entity a customer records in connection with its legal work (clients, counterparties, witnesses, experts, third parties).
• Customer: the firm, organization, or professional that subscribes to the Service.

3. Information we collect

3.1 Account and identity data

Name, email address, password (stored in encrypted form), role and function within the workspace, the organization you belong to, and language and time-zone preferences.

3.2 Content you upload

The Service lets you record and store information about your legal matters, including: case data (title, description, status, categories, news updates), stakeholders, documents and file attachments (PDF, DOCX, images, etc.), charges and invoices, and alarms. This content may include personal data of third parties that you choose to enter.

3.3 Payment and billing data

When you subscribe to a paid plan, we collect the data needed for billing. Your payment instrument details are handled directly by our payment provider; Griffex S.A. does not store full card numbers.

3.4 Automatically collected data

IP address, device and browser type, activity and security logs (logins, file uploads, relevant actions), and the date and time of those actions.

4. How we collect information

• Directly from you: when you register, configure your workspace, upload content, or contact us.
• Automatically: through server logs, technical cookies, and security mechanisms when you use the Service.
• From our providers: for example, payment confirmations or anti-fraud verification results.

5. How we use information

• Provide, operate, and maintain the Service, including data isolation between workspaces.
• Authenticate users and protect account security (including two-factor authentication).
• Send operational notifications, alarms, and reminders by email.
• Process payments and manage subscriptions.
• Prevent fraud, abuse, and unauthorized access.
• Improve the Service and diagnose technical issues.
• Comply with legal obligations and respond to requests from competent authorities.

6. Legal basis

We process personal data based on: (a) performance of the contract with the Customer; (b) your consent, where applicable; (c) our legitimate interest in operating and securing the Service; and (d) compliance with legal obligations.

7. Who is responsible for the data

For account data and the operation of the Service, Griffex S.A. acts as the controller. For the content you upload about your cases and stakeholders, the Customer is the controller and Griffex S.A. acts as the processor, handling that information in accordance with the Customer's instructions and the service agreement.

8. Service providers and third parties

We do not sell your personal data. We share it only with providers that help us deliver the Service, subject to confidentiality and data-protection obligations:

We may also disclose data where required by law or a competent authority, or to protect rights, the security, and the integrity of the Service.

9. Automated processing and artificial intelligence

Griffex may offer AI-assisted features. To provide them, certain content (for example, case or document text) may be transmitted to AI providers such as Anthropic (Claude), OpenAI (ChatGPT), or Google (Gemini), which process it under their own terms.

We do not use your content to train artificial-intelligence models, nor do we share it with AI providers for that purpose. Inputs transmitted to those providers are used solely to generate the requested output within the Service and are not used to train or improve their models.

We do not make decisions based solely on automated processing that produce legal effects on individuals or similarly significantly affect them. AI features are assistive in nature: they generate suggestions or drafts that require human review. Responsibility for reviewing, validating, and approving any AI-generated content rests with the Customer using the Service, not with Griffex S.A.

10. International data transfers

Some of our providers (AWS, reCAPTCHA, and the AI providers) are located in or process data outside your country, including the United States. In the countries where we operate, data-protection rules rely primarily on the data subject's consent. We base these transfers on:

• your informed consent, given when you register and accept this Policy, which expressly describes the international transfer of your data to the listed providers;
• the necessity of the transfer to perform the contract and provide the Service you request; and
• the confidentiality and security commitments our providers undertake under their own terms of service and privacy policies.

You may withdraw your consent at any time by writing to admin@griffex.lat; note that doing so may prevent the provision of certain features of the Service.

11. Data retention

We retain account data and content while your subscription is active and for a grace period after termination, after which it is deleted or anonymized. Technical and security logs are kept for as long as necessary for security and legal-compliance purposes.

12. Security

We apply technical and organizational measures to protect your data, including: encryption in transit and at rest, two-factor authentication, role-based access control, per-workspace data isolation, authenticated file downloads, upload rate limiting, and automatic backups. No system is completely secure, but we work continuously to protect your information.

13. Your rights

Subject to applicable law, you may have the right to access, rectify, delete, object to processing, request restriction, port your data, and withdraw your consent. To exercise these rights, write to us at admin@griffex.lat; we may ask you to verify your identity and will respond within a reasonable timeframe. If your content is under the control of a Customer (your firm or organization), we will direct your request to that Customer.

14. Cookies and similar technologies

We use strictly necessary cookies to authenticate you and maintain your session, as well as cookies associated with Google reCAPTCHA to prevent abuse. You can manage cookies from your browser settings; disabling essential cookies may prevent the Service from working.

15. Children's privacy

The Service is intended for legal professionals and not for minors. We do not knowingly collect data from minors. If you believe a minor has provided us with data, contact us so we can delete it.

16. Changes to this policy

We may update this Privacy Policy. We will post the current version on this page and, for material changes, notify you by reasonable means (for example, in-app or by email) before they take effect.

17. Contact

Griffex S.A.
Avenida La Reforma, Edificio Aristos 7-62, Oficina 709, Zona 9, Guatemala City, Guatemala
Email: admin@griffex.lat

18. Governing law

This Policy is governed by the laws of the Republic of Guatemala and by the data-protection regulations applicable in the Latin American countries where we operate.