Attun · legal
Attun is a product of The GRIN Labs LLC.
You were invited to Attun by your organisation. What you write here belongs to you.
Nobody reads your Work Core but you. Teammates meet it only through questions, and every answer draws only on material you approved for them. Anything you hold back is never used, and its absence is never shown. No administrator, and no member of our staff, can read your Work Core, because the system is built so that they cannot.
An AI model drafts your Work Core from your own answers, and answers teammates' questions from material you approved. Your content is not used to train any AI model. We do not sell your data or use it for advertising.
Your employer does not get a copy of your Work Core, cannot ask us for one, and cannot instruct us to hand it over. What your employer sees is set out in section 6.
The rest of this page is the detail behind those statements.
This matters more than it sounds, so we will be precise about it.
For your Work Core and everything you author in Attun, we are the data controller. We decide, and state publicly, that only you control who sees your material. Your organisation cannot instruct us to disclose it, amend it or hand it over, because that would break the promise the product is built on. We are answerable to you for it.
For team administration data, we act as a processor on behalf of your organisation. That covers the fact of a team existing, who was invited to it, and who has completed intake. Your organisation is the controller of that data and instructs us on it.
For anything your organisation commissions from us, such as a facilitated session or a written read of a team's conditions, we act as processor on your organisation's instructions, working only from material that participants approved for that purpose or from aggregates that identify no one.
If you want to know which category a particular piece of information falls into, ask us at info@thegrinlabs.com and we will tell you plainly.
Account and identity. Your name, work email address, the organisation and team you were invited to, your role in the product, the time you accepted our Terms and the version you accepted.
What you write and choose. Your answers during intake, your Life Context responses, your edits, and the visibility you set on each item.
Speech, where you choose to speak. If you speak an answer, your browser turns your speech into text using its own speech service, the same one it uses for dictation elsewhere, and that text appears in the box as you speak. Attun receives only the text, which you can edit like anything you typed. We never receive, store or analyse your voice.
Approval and visibility events. What you approved, when, and for whom. We keep this so that we can show you, and prove to you, why any given statement is visible to any given person.
Technical and security data. IP address, browser and device type, timestamps, authentication events and error logs. We use this to keep the service running and to detect abuse.
Correspondence. What you send us when you contact us.
We do not collect location beyond what an IP address implies, we do not use tracking pixels in participant email, and we do not run advertising or analytics cookies. Attun sets only the cookies needed to keep you signed in and to keep the service secure.
Some Life Context questions invite you to say things that count as special category data under European law, for example a health condition, a caring responsibility, a religious observance that affects your working week, or a description of how your mind works.
You never have to answer any of them. Every one can be skipped, and skipping leaves no visible gap. Where you do choose to give that information, we process it on the basis of your explicit consent, which you give by choosing to write it and choosing who can see it, and which you can withdraw at any time by deleting the item or changing its visibility.
Run your account and the product.
Draft your Work Core from your answers.
Answer teammates' questions from approved material.
Store special category Life Context you volunteer.
Send you service email about your own account.
Keep the service secure, prevent abuse, debug.
Improve the product using aggregated, non-identifying information.
Meet legal and regulatory obligations.
We do not rely on your employer's consent for anything, and we do not treat participation as consented to simply because an organisation bought the product.
A third party AI model processes your text in two situations: to draft your Work Core statements from your own answers, and to answer a teammate's question using only material you approved for that teammate.
Three things about that arrangement.
Your content is sent to the model provider under a commercial agreement that prohibits using it to train models and requires deletion after processing. It is not fed into any general-purpose training set, ours or theirs.
The model sees only what it needs for the task in front of it. When answering a teammate, it is given material approved for that teammate and nothing else. Material you hold back is never included.
No decision about you is made by the model alone, because the model does not make decisions about you at all. It drafts text you then own, and it retrieves material you already approved. Attun does not produce a score, ranking, profile or classification of any person, and it does not infer emotion from biometric data.
To keep the service reliable, a request may be completed by a backup AI provider when our primary provider is unavailable or slow to respond. The backup receives the same request and nothing more.
We will tell you the identity of our AI providers on request. Write to info@thegrinlabs.com.
Question-set answers. Only you read what you wrote. Your teammates can ask about these answers by default. They never see what you wrote, only answers drawn from it. You can turn this off using the switch above the questions or on your Work Core page.
Your teammates. Only material you approved, at the visibility you set, and only through questions. Material shared with one named individual stays between the two of you, and follows that person if either of you changes team. You can revoke that sharing.
Your team, collectively. Whether a person has completed intake may be shown. Who has not completed intake is never shown.
Your organisation and its administrators. Team membership, invitation status, engagement-level information, and anything you approved for the organisation. Nothing else. There is no administrative route into private material.
Us. Our engineering staff can access infrastructure in order to run and repair the service, under access controls and logging. The system is designed so that private participant material is not readable through any administrative interface. Where a support issue genuinely cannot be resolved without looking at something of yours, we ask you first.
Nobody else, unless you tell us to, or unless we are legally compelled. If we receive a legal demand for participant material, we will tell you before responding wherever the law permits it.
We use a small number of service providers, and each is bound by contract to protect your data and to use it only for the service it provides to us. They fall into four categories:
A current list of our named sub-processors is available on request at info@thegrinlabs.com. If we add a provider that processes participant content, we will update that list before they begin.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in United States state privacy laws.
We are a United States company and our service providers process data in the United States. If you are in the United Kingdom or the European Economic Area, your personal data is therefore transferred outside your country.
Where that happens, we rely on Standard Contractual Clauses approved by the European Commission, together with the United Kingdom Addendum where it applies, and an assessment of the protections available in the destination country. You can ask us for a summary of those safeguards at info@thegrinlabs.com.
Your Work Core is kept for as long as you have an account, because it belongs to you and travels with you across teams.
When your organisation's engagement ends, your approved material stops being visible to that team at that point. Your own account and content stay available to you. If you no longer belong to any team in Attun, we contact you before removing anything, and we do not remove your content for at least 12 months.
When you ask us to delete your account, we remove your content from live systems within 30 days. Encrypted backups age out on their own cycle within a further 90 days, after which nothing remains.
We keep security and audit logs for 12 months, and records we are legally required to keep for as long as the law requires.
Data is encrypted in transit and at rest. Access to production systems is restricted, authenticated and logged. Visibility is enforced in the database itself through row-level security rather than only in the interface, so a bug in the front end cannot expose material to the wrong person.
No system is perfect. If a breach affects your personal data and is likely to put you at risk, we will tell you and the relevant regulator within the time the law requires.
Wherever you live, you can ask us to show you what we hold, correct it, delete it, give you a portable copy, restrict what we do with it, or object to processing based on legitimate interests. Where you gave consent, you can withdraw it, and doing so does not affect what happened before.
If you are in the United Kingdom or the European Economic Area, those rights come from the UK GDPR and the EU GDPR, and you may complain to your national supervisory authority. In the United Kingdom that is the Information Commissioner's Office.
If you are in a United States state with a comprehensive privacy law, you have rights of access, correction, deletion, portability and opt-out, and you may appeal a refusal. We do not sell personal information, do not share it for targeted advertising, and do not use it for profiling that produces legal or similarly significant effects.
To exercise any of this, write to info@thegrinlabs.com. We will respond within 30 days and will not charge you or treat you differently for asking.
Attun is for adults in a workplace. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it.
We will update this page as the product changes. Material changes are announced inside the product before they take effect, and each version is dated. Earlier versions are available on request.
The GRIN Labs LLC
info@thegrinlabs.com