Privacy Notice
Last updated: 23 October 2026
1. Purpose and scope
This notice explains how we use personal data when you use Gridder. "Gridder" is the service operated by Feesorted Limited, a company registered in England and Wales with number 17201366 and registered office at Second Floor Flat East, 44 Regents Park Road, London, England, NW1 7SX. In this notice "we", "us" and "our" mean Feesorted Limited; "you" means an individual who uses Gridder, or whose details are given to us by the group (the company) that you work for.
Gridder turns collateralised loan obligation offering documents into structured data. It is a business service for professional users. Access is by invitation or, where we offer it, by applying for an account, which we may approve or decline. This notice covers the personal data of users and of the people who administer user groups. It does not cover the content of the offering documents that Gridder processes, which are published by issuers, arrangers and exchanges and are not about our users.
This notice is written to meet Articles 13 and 14 of the UK GDPR. It also applies, with the same content, to users in the European Economic Area, to whom the EU GDPR applies alongside it. It should be read with the Cookie Notice and Contact and Complaints.
2. Who is the controller
For the personal data described in this notice, Feesorted Limited is the controller. Our details are:
- Company name: Feesorted Limited
- Company number: 17201366
- Registered office: Second Floor Flat East, 44 Regents Park Road, London, England, NW1 7SX
- General contact: hello@getgridder.com
- Privacy matters: privacy@getgridder.com
We are registered with the Information Commissioner's Office. We are not required to appoint a data protection officer and have not done so. Privacy questions go to privacy@getgridder.com.
Where a group uploads documents or invites its members, the group's own use of Gridder is its decision. Where we process personal data on behalf of a group under a written subscription, for example the content of a private document that happens to contain a name, we act as the group's processor under the data processing terms agreed with that group, and the group is the controller. This notice describes our role as controller.
3. What personal data we collect
We collect the following categories.
- Account data: your work email address, your name, your company or group name if provided, your role in the group (administrator or member), and a password hash. It also includes anything else you tell us about yourself when you apply for, set up or use an account, such as your professional role, your company, a professional profile link, how you heard of Gridder and what you want to use it for. We may ask for other such information from time to time. We never store your password in readable form. When you create an account, and when you sign in from a new browser, we email you a one-time code to confirm that the address is yours.
- Group and licence data: the group you belong to, the products and seats allocated to you, and invitations sent to you.
- Billing data: the billing contact for a group (name, work email, billing address if given) and invoices and payment status. Card details, where cards are used, are handled by a payment provider and are not stored by us.
- Technical and log data: your IP address and browser user agent, recorded in server logs and when you accept our terms (together with the time and the version accepted).
- Usage data: a log of each request you make to Gridder, recording the user, the time, the channel (website, Excel add-in, data API or MCP server) and the number of bytes returned. We do not record the content of what you view in this log. To secure accounts and detect shared or misused logins, we also record each sign-in attempt and each request you make to the website (account, time, IP address, country, browser type and the page or data route requested, with the identifier of any document it names), and we compare these records to spot accounts used by more than one person or by automated tools. We keep request records for 90 days and sign-in records for 1 year.
- Document data: the private documents you upload and the data produced from them, and any documents you offer for the public list. These are described in section 6.
- Feedback data: the message you write when you use the Feedback button and the screenshot it attaches. Screenshots can show anything on your screen at the time, so please do not capture information you do not wish to share.
- Correspondence: messages you send us by email and our replies.
- Cookie and browser data: described in the Cookie Notice.
We do not knowingly collect special category data or criminal offence data. Please do not put it in the Feedback button or in correspondence.
4. Where the data comes from
Most of the data comes from you. Some comes from your group's administrator, who invites you and sets your seat and product access. Billing data comes from the group's billing contact. Technical, log and usage data is generated when you use Gridder. We do not buy data about our users and we do not combine it with data from other sources.
When we obtain your details from your group's administrator rather than from you (Article 14), the categories are your name, work email and role, the source is your group, and we tell you here at the time of the invitation.
5. Purposes and lawful bases
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Creating and managing your account and sign-in | Account data, group and licence data, cookie data | Performance of the subscription contract with your group, and our legitimate interest in providing the service to your group's users |
| Deciding whether to open an account, preventing abuse of free accounts, and understanding who uses Gridder and why | Account data | Legitimate interest in controlling access to the service and protecting it from misuse |
| Providing the website, Excel add-in, data API and MCP server | Account, usage and log data | Legitimate interest in delivering the service we have contracted to deliver |
| Billing, invoicing and collecting payment | Billing data, group and licence data | Performance of a contract; legal obligation (tax and accounting records) |
| Enforcing licence limits, seats, rate limits and API key restrictions | Usage data, IP address | Legitimate interest in applying the subscription terms and preventing misuse |
| Security, fraud prevention, abuse detection and incident investigation | IP address, user agent, log and usage data | Legitimate interest in protecting the service and its users; legal obligation where security duties apply |
| Recording acceptance of terms | Account data, IP address, user agent, time and version | Legitimate interest in keeping evidence of the terms agreed; performance of a contract |
| Processing private documents and releasing public documents | Document data, account data | Performance of a contract with your group (or our legitimate interest in providing the feature your group asked for) |
| Responding to feedback, support and complaints | Feedback data, correspondence, account data | Legitimate interest in supporting users and improving Gridder |
| Sending service notices (changes to terms, security or outage notices) | Account data | Performance of a contract; legitimate interest |
| Establishing, exercising or defending legal claims; complying with law and regulators | Any of the above as needed | Legitimate interest; legal obligation |
| Backups and disaster recovery | All data held in the service | Legitimate interest in keeping the service available and data recoverable |
Where we rely on legitimate interests, we have considered whether they are outweighed by your interests and rights. Our users are working professionals using a business tool under their employer's subscription, and the data we use is limited to what is needed. You may ask us for more detail on our balancing test at privacy@getgridder.com. You may object to processing based on legitimate interests (see section 11).
We do not rely on consent for any processing described here, so there is no consent to withdraw. We do not send marketing email to users beyond service notices. If we ever introduce marketing, we will update this notice first.
6. Private and public documents
Groups can upload PDFs to Gridder. A private document is visible to every member of the group that uploaded it. It is processed by automated means, including artificial intelligence, into structured data. The PDF is deleted within 90 days of upload; copies in backups age out on normal rotation. Data derived from it stays available to the group while it subscribes, and is deleted within a reasonable period after the subscription ends, unless we must keep it by law or for legal claims. Private documents and their data are not shown to other groups.
If the same document (an identical file) is also submitted publicly by anyone, is already in or later enters the public library, or we obtain it from another source (such as the issuer, an exchange, another customer or public sources), we may keep and use our copy as a public document. Our confidentiality and deletion terms do not apply to information that is public, independently obtained or received from a third party.
A public document is one the group offers for the public list of Gridder documents. We may decline, edit, withdraw or remove it at our discretion. Once released, it can be seen by other subscribers, and the data derived from it forms part of the shared library. We keep public documents and everything derived from them indefinitely, and the uploader's licence to us is described in the terms that apply to the upload.
The documents are offering circulars, prospectuses, trust deeds and similar transaction documents. They may contain names and business contact details of individuals, such as directors or service provider staff. Those details are part of a published or business document, not data we collect about you. If you upload a document, please do not upload one that contains personal data beyond ordinary business details.
7. Who receives your personal data
We share personal data only as needed, with:
- hosting and infrastructure providers (in the UK or EEA);
- providers of artificial intelligence services, but only for document content. They do not receive your account data, your email address, your IP address or your usage data;
- email service providers (in the UK or EEA), which deliver the emails we send you (such as one-time sign-in codes) and host our mailboxes;
- payment and invoicing providers, where used;
- our professional advisers (lawyers, accountants, auditors) and insurers, under duties of confidence;
- law enforcement, courts and regulators, where required by law or to protect rights;
- a buyer or successor, if we sell or reorganise the business, under confidentiality and on the basis that this notice continues to apply.
Customers can ask for a list of the providers that act as our processors by writing to legal@getgridder.com. Within your group, other members and administrators can see your name, email and role, the seats and products assigned to you, and group-level usage. They cannot see your password hash.
We do not sell personal data and we do not share it for advertising.
What you tell us about yourself when you apply for or set up an account is for our internal use only. We do not share it with any third party for that party's own purposes. It is handled only by the service providers above that host and deliver Gridder for us, under contract and on our instructions, or disclosed where the law requires.
8. International transfers
Where personal data goes outside the UK, we use a safeguard recognised under UK data protection law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or adequacy regulations. You can ask us for information about the safeguards used by writing to privacy@getgridder.com.
9. How long we keep it
| Data | Retention |
|---|---|
| Account data | While the account is active, then deleted or anonymised within a reasonable period after it is closed, once no longer needed for the purposes in section 5 or to deal with queries and legal claims |
| Group and licence data | For the subscription term, then for as long as needed to deal with queries, disputes and legal claims |
| Billing data and invoices | As long as tax and company law require (normally 6 years) |
| Server logs including IP address and user agent | Up to 90 days, longer only where needed for an investigation |
| Website request records and sign-in records (account, time, IP address, country, browser type) | Request records 90 days, sign-in records 1 year, to secure accounts and detect shared or misused logins |
| Usage logs (API, MCP and Excel add-in: user, time, channel, bytes) | 90 days |
| Records of terms acceptance (with IP address and user agent) | For the life of the account and afterwards for as long as claims could be brought on the agreement, as evidence |
| Feedback message and screenshot | Screenshots 30 days, then deleted. The message may be kept longer if it leads to a recorded change or complaint |
| Private documents (PDF) | Deleted within 90 days of upload; copies in backups age out on normal rotation |
| Data derived from private documents | While your group subscribes, then deleted within a reasonable period after the subscription ends, unless retention is required by law or for legal claims. The exception for identical or otherwise public documents in section 6 applies |
| Public documents (offered for the public list) and everything derived from them | Indefinitely |
| Backups | Rolling; deletions pass through as backups are overwritten |
| Correspondence and complaints | For as long as needed to handle the matter and for legal claims, normally up to 6 years |
When a retention period ends, we delete the data or anonymise it so that it can no longer be linked to a person.
10. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Article 22). The data that Gridder shows is produced by automated means, including AI, from documents. It is not a decision about any individual, and it is described in the Data Disclaimer and No-Reliance Notice. Access limits, such as rate limits, apply automatically to every user in the same way and can be reviewed by a person on request.
11. Your rights
Under the UK GDPR and, where it applies, the EU GDPR you have the right to:
- be informed about how we use your data (this notice);
- access a copy of your personal data;
- have inaccurate data corrected and incomplete data completed;
- have your data erased, where a legal ground applies;
- restrict our processing, where a legal ground applies;
- receive data you gave us in a structured, commonly used, machine-readable form, where processing is based on a contract and carried out by automated means (portability);
- object to processing based on our legitimate interests, on grounds relating to your situation. We will stop unless we show compelling grounds or the processing is needed for legal claims;
- not be subject to solely automated decisions with significant effects (see section 10).
These rights are not absolute and some have exceptions. To use them, write to privacy@getgridder.com. We may ask for information to confirm your identity. We will respond within one month, and may extend by up to two further months for complex or numerous requests, telling you why. There is no fee unless a request is manifestly unfounded or excessive. If your data is held for a group that is the controller, we will pass the request on or tell you to contact the group.
12. Complaints
Please tell us first, so we can try to put things right: privacy@getgridder.com. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:
- website: ico.org.uk
- address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
If you are in the EEA you may also complain to your local supervisory authority. Our wider complaints route is in Contact and Complaints.
13. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords, one-time sign-in codes and restricted access to our systems. No system is perfectly secure. If a personal data breach is likely to result in a risk to your rights, we will notify the ICO within 72 hours of becoming aware, and tell you without undue delay where the risk is high.
14. Children
Gridder is a professional service for people working in finance. It is not for children, we do not offer it to anyone under 18, and we do not knowingly collect data from children. If you think a child has given us data, tell us at privacy@getgridder.com and we will delete it.
15. Whether you have to give us the data
You need to provide an email address and a name to have an account, and, where we ask for it, the information we need to decide whether to open the account. Without it we cannot give you access. IP address and user agent are recorded automatically and are needed to secure the service. Our contract with your group requires some of the data in section 3, and we cannot supply the service without it.
16. Changes to this notice
We will update this notice when our processing changes. The date of the current version is at the top. For material changes we will notify group administrators by email or on the website before they take effect. Earlier versions are available on request.