Company Terms

These Company Terms are between GRTwo Digital LLC ("Gryz", "we") and the organisation that sets up a company on Gryz ("the Company"). They sit on top of our Terms of Service, which every person who uses Gryz also accepts. If the two conflict on company matters, these Company Terms win.

For counsel [COUNSEL]: Confirm the order of precedence (Company Terms, then DPA, then Terms of Service, or another order) and whether an order form or pilot agreement sits above all of them. Today a company is set up by a Gryz admin, so the Company accepts these terms through a signed order form or pilot agreement that links here, not with a click in the app.

If you accept these terms for an organisation, you promise you have the authority to bind it. If you do not have that authority, do not accept them. If you accept anyway, you are personally responsible for the Company's use of Gryz.

For counsel [COUNSEL]: Confirm the personal-responsibility wording for someone who accepts without authority.

• Company: the organisation above, and its space on Gryz.
• Owner: a person the Company makes an owner. Owners can change roles, settings, AI app rules, legal hold and billing.
• Admin: a person who can invite and remove members, manage projects and see activity.
• Member: anyone the Company lets into its space.
• Company Content: documents, memory, tasks, skills, projects and other items in the company space, including documents members move in.
• Company Records: the activity records Gryz keeps for the Company.
• Private space: a person's own space in their Gryz account.

The Company owns Company Content. When a member moves a document in, it becomes Company Content and cannot be moved back out. We get only the license we need to run Gryz for the Company.

For counsel [COUNSEL]: Does a member's move transfer copyright, or only control? An assignment from the member may be needed. The cleaner path may be a license plus the member's own employment terms.

The Company decides who joins, their roles and when they leave. It is responsible for what its members, agents and connected apps do in the company space.

Owners and admins can see Company Content and Company Records. That includes which agents and apps did what and, if the Company turns it on, which items apps opened. The Company must tell its members this, and get any consent or agreement it needs (for example from employees or a works council), before it uses these features.

We email every member before item records start, and we start them 7 days later. That does not replace the Company's own duty to tell its people.

For counsel [COUNSEL]: Confirm the Company's notice and consent duty, including employee monitoring notice laws (for example New York Civil Rights Law s.52-c, and similar laws in Connecticut and Delaware) and works council rights (for example Germany, s.87(1) no.6 BetrVG).

On an ordinary account, a member's private space is theirs, not the Company's, and the Company cannot see it. [S8 placeholder: on a managed work account the private space belongs to the Company, as set out in "Managed work accounts" below.]

The Company decides whether AI apps can reach Company Content, which ones, and with what limits. Apps that members connect, and the AI providers behind them, are third parties chosen by the Company or its members. They are not our sub-processors, and we are not responsible for what they do with data after they read it. We check access on every call and keep records as described in our documentation.

We keep Company Records for the periods in our documentation. Today, the lines about agents and connected apps are kept for 365 days, and other lines are kept while the Company exists. Nobody using Gryz can change or delete them. Daily seals help show if records changed, but they are not proof against someone with full database access.

An owner can turn on a legal hold. While it is on, we keep Company Records past their normal period, nobody can remove company memories, and the Company cannot be deleted.

A legal hold is a tool to help the Company meet its own duties to keep information. It is not a promise that we keep everything, and the Company stays responsible for its own duties to preserve information. People can still delete company documents during a hold.

For counsel [COUNSEL]: Product gap: company documents can still be deleted during a legal hold today. Either the product blocks that before these terms take effect, or the last sentence above stays to say it plainly. Confirm the wording either way.

If the Company asks, our support team may act on Company Content and settings, for example adding or removing members. Those actions show in Company Records as "Gryzsupport".

When the Company removes someone, their company access ends at once, and so do their company agents, keys and app access to the company. What they wrote stays with the Company.

We delete their account and private space. Company Content they wrote stays with the Company. If the Company has a legal hold, its records keep an anonymous "Former member" in their place.

An owner can ask us to delete the Company when no legal hold is on. Before that, owners can export Company Content. After the Company is deleted or its plan ends, we delete Company Content and Company Records within [30 / 90] days, except backups that expire on their own schedule and anything the law makes us keep.

For counsel [COUNSEL]: Pick the deletion window. There is no self-serve export of a whole company yet, so the export promise needs a product build (or a support-run export) before a paying customer. Confirm how long backups last before they expire.

A new company may get a free trial of [30] days. At the end of the trial the company space [becomes read only / is locked] until someone buys a plan. Paid plans are billed per seat through Stripe, [monthly / yearly], and renew until cancelled. A locked company locks only the company space, never a member's private space.

For counsel [COUNSEL]: Placeholder until the company billing plan is decided (day-30 trial behaviour, billing period, prices on the Pricing page only). Confirm renewal, refund and tax wording.

For Company Content and Company Records, the Company decides what is processed and why, and we process it for the Company. Our Data Processing Addendum applies and is part of these terms. The services that help us run Gryz are listed on our sub-processors page.

Where your data lives. Gryz stores and processes all data in the United States. We do not offer hosting in the EU or anywhere else. If your company is in the EU, the UK or another place with rules about sending personal data abroad, you are responsible for deciding whether using Gryz meets those rules, before you add anyone's personal data. Our Data Processing Addendum includes the EU Standard Contractual Clauses for this.

For counsel [COUNSEL]: US hosting alone does not breach the GDPR: transfers can rest on the Standard Contractual Clauses plus a transfer impact assessment, or on the EU-US Data Privacy Framework if GRTwo Digital LLC certifies (it is not certified today). Saying the transfer decision is the Company's does not fully shift responsibility, because the GDPR can apply to Gryz directly (Art. 3(2)) and processor duties (Art. 28 and Art. 44 onward) cannot be waived by contract. Options: SCCs in the DPA (baseline), DPF certification, and keeping EU companies out of the pilot until counsel agrees.

For counsel [COUNSEL]: Confirm the US-only statement is accurate for every service on the sub-processors page (our hosting network and Cloudflare can handle a request at a location near the user before it reaches the United States). Confirm the transfer wording for EU, UK and Swiss customers.

We keep Company Content confidential and protect it with the measures in our security documentation.

For counsel [COUNSEL]: Confirm the confidentiality clause (mutual or one way) and which security document it points to. There is no published security page yet.

The Company will defend us against claims that come from Company Content, or from the Company not telling its people or not getting the consents described in "Telling your people".

For counsel [COUNSEL]: Confirm the indemnity scope and whether Gryz gives a matching indemnity (for example for IP claims about the service itself).

Each party's total liability under these terms is limited to [the fees the Company paid in the 12 months before the claim / another cap], except for [carve-outs, for example confidentiality, data breach and indemnity].

For counsel [COUNSEL]: Set the business liability cap and carve-outs. The consumer cap in the Terms of Service (fees in 12 months or $10) does not fit a business customer.

We will tell owners about material changes at least [30] days before they take effect. An owner accepts them for the Company.

For counsel [COUNSEL]: Confirm the notice period, and that members cannot block a company-level update by not accepting it.

[S8 placeholder, not built yet] The Company may verify a domain it controls. Accounts on that domain become managed after we give each person at least 14 days' notice and a chance to change their email or delete their account. The Company owns the private space of a managed account, but while the person works there nobody at the Company can read it. When someone leaves, the Company can transfer their private space to a successor or delete it, after telling them at least 7 days before (unless an owner marks it urgent and gives a reason). The Company decides whether a departing person can download a copy. The Company must have the right, under its own policies and the law, to do this.

For counsel [COUNSEL]: Is a successor transfer of a private space lawful without the person's agreement in each country? Works council involvement and employee notice. Remove this section if S8 is not live when these terms take effect.

Questions about these terms? Email us at info@grtwo.com.