How Grepped handles your data
Your data stays yours. Your people stay out of it.
You're thinking about licensing your company's data to AI labs. Here is exactly what happens to it with Grepped, who sees what, and what we put in writing before a single file moves.
This page is a summary of our Data Supply Agreement. The clause numbers in grey, like cl. 3.1, point to the matching section. Ask us for the full agreement and have your own lawyer read it. We expect you to.
What happens to your data, step by step
The same sequence for every company and every dataset. The steps marked in yellow need your approval before we go further.
You describe it, you don't send it
You tell us what you have through our data inventory form. No data comes to us until we've agreed in writing what will be shared, and anything you mark off-limits stays with you. cl. 2.1 cl. 1.5
We find a buyer
We take a description of your data to AI labs and bring offers back. You don't have to accept any of them, and you pay nothing up front, or at all if no deal closes. cl. 2.2 cl. 11.2
You sign off on the deal
Each sale gets its own one-page Deal Schedule. In it you approve the lab, the exact data, how they may use it, exclusivity, the term, the price and your share. cl. 2.3
You send it to us securely
Data travels by the encrypted transfer method we specify, to Grepped only. It is encrypted at rest, and only named staff with multi-factor sign-in can open it. cl. 2.4 cl. 4.2
We de-identify it
Our in-house team, working with brilliant third-party privacy experts, scans every file with detection tools, then reviews it by hand and tries to re-identify people before anything is released. Details below. cl. 3.3
You see what we removed
Before delivery you get a release summary: what was taken out, how it was reviewed and a sample of the output. You have 5 business days to object, and nothing ships while you do. cl. 2.5
The lab gets the clean copy, under strict terms
Only the lab named in your Deal Schedule receives it, and only after signing the protections listed further down. cl. 7.1
We delete your original
Your source data and every working copy are deleted within 30 days of final delivery, of your request, or of the agreement ending, whichever comes first. We confirm it in writing. cl. 4.3
How we take people out of the data
"De-identified" has a fixed meaning in our agreement. Every dataset has to pass all of this before a lab sees it. Where the law sets a stricter standard for your data, such as health records or data from the UK and EU, we meet the strictest one that applies. cl. 3.1 cl. 3.2
| What | For example | What we do |
|---|---|---|
| Direct identifiers | Names, email addresses, phone numbers, postal addresses, usernames, faces, identifiable voices | Removed, or replaced with consistent placeholders like [PERSON_1], so the work still makes sense |
| Indirect identifiers | Exact birth dates, precise locations, IP addresses, device IDs, rare combinations of facts | Generalised (a year instead of a date, a region instead of a street) or removed |
| Sensitive and intimate data | Health, sex life or orientation, ethnicity, religion, politics, union membership, biometrics, criminal records, immigration status, ID and card numbers, anything about children | Removed entirely |
| Credentials and secrets | Passwords, API keys, access tokens | Removed |
| Other people's confidential material | Your clients' confidential information, legally privileged communications | Removed |
| Anything you hold back | Any folder, field, client or topic you mark off-limits | Never passed on to anyone |
Scope
We agree with you what's in the data, where it came from and what must stay out, and keep excluded material out at the source where we can.
Automated detection
Every file is scanned with privacy detection tools for identifiers, credentials and sensitive topics, which are then removed or replaced.
Human review
Trained Grepped reviewers check every dataset by hand for what software misses. Higher-risk data, like HR records, customer messages, health information, audio and video, gets a larger sample and a second reviewer.
Re-identification test
Before release, a reviewer tries to identify people using the dataset plus public sources. If they can, the data goes back through detection and review.
Release log
We record what was removed, who reviewed it and what each lab received, so every delivery can be traced.
We work with brilliant third-party de-identification experts alongside our own team. They are bound by terms at least as strict as ours, we stay responsible for their work, and we'll tell you which ones touched your data if you ask. cl. 3.4
If we can't get it fully clean, we don't sell it.
When a dataset can't be brought to this standard, we deliver none of it. We tell you, and delete or return your data. cl. 3.5
What we promise, and what every lab signs
Grepped's own commitments, and the terms we put into every lab contract that touches your data.
Grepped will never
- Give a lab your original data. Labs only ever receive the de-identified copy. cl. 2.4
- Sell your source data, or use it to train any model of our own. cl. 4.2
- Deliver to a lab you didn't approve, or outside the use you agreed. cl. 6
- Name you publicly as a data supplier without your written consent. A lab only learns who you are if your Deal Schedule says so. cl. 12.4
- Tell a lab anything about your data that you haven't confirmed in writing. cl. 6
Every lab agrees to
- Never try to identify anyone in the data, alone or by combining it with other data.
- Never contact anyone it thinks appears in the data.
- Use it only for the agreed purpose, and not resell or share it.
- Keep it secure, and delete it when the licence ends or we ask, confirming in writing within 10 business days.
- Report anything we missed within 48 hours, stop using it and delete it. cl. 7.1
We enforce these terms, tell you about any breach that affects your data, and help you if you take action against a lab. cl. 7.2
If something slips through
No process is perfect, so the response is written down in advance. If personal information turns up in data a lab received, whoever finds it, this is what we're bound to do. cl. 8
We stop all delivery of the affected data and instruct every lab that has it to stop using and delete it.
You get written notice: which data, what was exposed, which labs had it and when. Updates follow as we learn more.
Written deletion confirmations from each lab, and our incident report on the cause and how we changed the process.
A cleaned replacement goes out only with your approval, and you can pause all deliveries until you're satisfied.
You stay in control of disclosure. You decide whether to notify regulators or the people affected, and we give you everything you need to meet any legal deadline. We won't contact them or name you without your consent unless the law requires it. cl. 8.4
If it was our mistake, we pay. Grepped covers its own clean-up and reimburses your reasonable costs of legally required notifications, credit monitoring where required, and legal advice. We also indemnify you against third-party and regulator claims caused by our failure, within the limits set in the agreement. cl. 8.5 cl. 9.1
What stays in your hands
Your rights
- You keep ownership. You license the data; you never sell the rights to it. cl. 2.6
- Pull data any time before it's delivered, without ending the agreement. cl. 13.3
- Mark anything off-limits: a folder, a field, a client, a topic. cl. 1.5
- See the money. You're paid your share within 30 days of each lab payment, with a statement, and can ask to see the lab's payment records. Any referral fee comes out of Grepped's cut, never yours. cl. 11
- Leave on 30 days' notice. cl. 13.1
What we ask of you
- You have the right to license it, including after selling a business or its assets.
- Personal data was collected lawfully, and the people involved were given the notice or consent this use needs.
- You tell us where sensitive data sits, like health, HR or children's records, so we can remove it.
- You name the source of any third-party, purchased or scraped content.
- You tell us within 5 business days if any of this stops being true. cl. 5
You make no promise about how well we de-identify. That part is our responsibility. cl. 5.3
Questions owners ask us
Will my customers or staff be exposed?
No person should be identifiable in anything a lab receives. That's the standard every dataset has to pass, it's checked by software, by people and by a re-identification test, and data that can't meet it isn't sold. If something is ever missed, the response above is already in the contract.
Will the lab know the data came from my company?
Only if you choose that in your Deal Schedule. Otherwise the lab licenses the data without learning who supplied it, and we never name you publicly without your written consent.
What if a lab misuses the data?
Every lab signs not to re-identify, contact, resell or share, and to delete on request. We enforce those terms, tell you about any breach affecting your data, and help you if you decide to act against the lab yourself.
What happens to my original files?
They're held encrypted, opened only by named staff, never kept on personal devices, and deleted within 30 days of final delivery or your request, with written confirmation. If anyone gets unauthorised access, we tell you within 48 hours.
What does it cost me?
Nothing up front, and nothing at all if no deal closes. Grepped is paid from the lab's fee.
Can my lawyer review the agreement first?
Yes, and we recommend it. Email us for the Data Supply Agreement. Nothing is shared until it's signed and you've approved a specific deal.
Start by telling us what you have. Nothing more.
Questions, or want the agreement? e@grepped.ai