Privacy Policy

When you use Grascio, we collect information to provide, improve, and personalise our service. The categories of data we may collect include:

We do not collect sensitive personal data such as race, religion, health information, or financial account details. We never access the content of private repositories without your explicit authorisation, and all repository access is strictly read-only.

We use the data we collect for the following purposes, each grounded in a lawful legal basis under applicable data protection law:

• To deliver and operate the Grascio service — processing repository signals, generating your Capability Score, building your skill graph, and displaying your verified profile. (Basis: performance of a contract.)
• To personalise your experience — recommending projects to build, skills to develop, and opportunities to pursue based on your profile data. (Basis: legitimate interests.)
• To improve our platform — analysing aggregated and anonymised usage patterns to fix bugs, enhance features, and guide product decisions. (Basis: legitimate interests.)
• To communicate with you — sending transactional emails (verification, password resets, notifications), product updates, and, where opted in, marketing communications. (Basis: consent or legitimate interests.)
• To match you with opportunities — sharing your verified profile summary with employers, recruiters, and collaborators through our Smart Matching system, only when your profile is set to discoverable. (Basis: consent.)
• To meet legal obligations — retaining records where required by applicable law and responding to lawful requests from authorities. (Basis: legal obligation.)

We will never use your data to make fully automated decisions that produce legal or similarly significant effects on you without human review.

Your data is stored on secure cloud infrastructure. We implement industry-standard security practices, including:

• Encryption in transit — all data transmitted between your browser and our servers uses TLS 1.2 or higher.
• Encryption at rest — stored data is encrypted using AES-256.
• Access controls — access to personal data within Altascio is restricted on a strict need-to-know basis. All internal access is logged and audited regularly.
• Password hashing — passwords are never stored in plain text. We use bcrypt hashing with a unique salt per user account.
• Regular security assessments — we conduct periodic vulnerability scans and responsibly address reported security issues.

We retain your personal data for as long as your account is active or as needed to provide services. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law or a legitimate business need such as fraud prevention.

We do not sell your personal data. We may share your information only in the following limited circumstances:

• Service providers — trusted third-party companies that help us operate Grascio, such as cloud hosting providers, email delivery services, and analytics tools. These providers process data solely on our instructions and are bound by data processing agreements.
• Recruiters and employers — only your verified profile summary (name, score, skill graph, and public project signals) is shared, and only when your profile is set to discoverable. You can change this setting in your account at any time.
• Business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. You will be notified in advance with the opportunity to withdraw consent.
• Legal requirements — we may disclose your data when required by applicable law, court order, or to protect the rights, property, or safety of Grascio, our users, or the general public.

When we engage third-party processors, we carry out due diligence to ensure they provide sufficient guarantees around data protection in line with applicable data protection law.

Depending on your jurisdiction, you hold the following rights regarding your personal data. You may exercise these rights at any time by contacting us:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data without undue delay.
• Right to erasure — request deletion of your personal data (the "right to be forgotten"), subject to certain legal exceptions.
• Right to restriction of processing — ask us to limit how we process your data in specific circumstances.
• Right to data portability — receive your data in a structured, commonly used, machine-readable format and transmit it to another service.
• Right to object — object to processing based on legitimate interests or to direct marketing at any time.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email legal@grascio.com. We will respond within 30 calendar days. We may need to verify your identity before processing your request. You also have the right to lodge a complaint with your local supervisory authority or data protection regulator at any time.

We use cookies and similar tracking technologies to operate and improve the Grascio platform. Cookies are small text files stored on your device when you visit our site or use our application.

You can manage or disable non-essential cookies through our cookie preference centre (accessible via the footer) or through your browser settings. Disabling essential cookies may affect the functionality of Grascio. We do not use cookies to build advertising profiles or sell tracking data to third-party advertisers.

If you have any questions, concerns, or requests regarding this Privacy Policy or how Altascio processes your personal data, please get in touch with our legal team:

This Privacy Policy may be updated periodically to reflect changes in our practices or applicable legal requirements. When we make significant changes, we will notify you via email or a prominent notice on the platform. The "Last updated" date at the top of this page will always reflect the most recent revision.