Privacy Policy

Last updated: 22.10.2026

BRONTIR OÜ (“BRONTIR”, “we”, “us”, “our”) operates PlaceGrid, a service available at enrichment.brontir.com that collects publicly listed business information from Google Maps and enriches it with publicly accessible information, such as contact details published on the businesses’ own websites (the “Service”).

This Policy explains what personal data we process, why, and the rights you have. We are subject to the EU General Data Protection Regulation (GDPR).

Controller: BRONTIR OÜ, a private limited company registered in Estonia under registry code 16804491, with registered office at Tartu mnt 67/1-13b, Kesklinna linnaosa, 10115 Tallinn, Harju maakond, Estonia. Contact: the e-mail address on our contact page.

1. Summary

We process the minimum data needed to run the Service.
We do not sell your personal data and do not use it for third-party advertising.
The Service retrieves publicly accessible business information at your instruction — you are responsible for lawful use of that information.

2. Data we process

Account & authentication — your email address and, depending on how you sign up, a password you set or the basic profile data shared by a third-party sign-in provider you choose (such as Google — typically your email and name), together with authentication/session tokens.
Instructions — the regions, place types, filters and enrichment options you choose for a search, and the messages you send to the Service’s assistant.
Results — the places and the information collected about them for your searches, kept in your account so you can view and export them.
Usage & technical data — request logs (timestamp, operation, status), IP address, client/user-agent, and diagnostic data, used for security, abuse prevention, and reliability.
Billing data — your credit balance and its use. Purchases of credits are processed by our payment provider; we receive limited billing metadata (such as the purchase, the state of its payment, your request at checkout for immediate supply, and the receipt), not full card numbers.
Communications — messages you send us (e.g. support).

We do not intentionally collect special-category data; please do not submit it unless necessary and lawful.

3. Cookies and similar technologies

We use cookies and comparable storage on your device (such as local storage) on our website. Under the EU ePrivacy rules, only strictly necessary storage may be used without your consent; everything else stays switched off until you turn it on.

Strictly necessary — signing you in and keeping you signed in, security and abuse prevention, remembering an invitation you followed, and returning you to the right page after a third-party sign-in. These are first-party, last no longer than 30 days, and cannot be switched off, because without them the site cannot do what you asked of it. We also store your cookie choice itself in this category, so that we do not have to ask again.

Analytics (consent required) — measuring how the site is used, which pages people reach and where they get stuck, so that we can improve it.

Marketing (consent required) — measuring our advertising and making the advertising you see elsewhere more relevant.

We ask for your choice the first time you visit, with accepting and refusing offered equally. You can change or withdraw it at any time through the Cookie settings link in the site footer; withdrawal takes effect immediately and is as easy as giving consent. You can also delete or block cookies in your browser settings, though blocking the strictly necessary ones will break sign-in.

Consent-based categories are used only where a service is actually in place; where a third party provides such a service, it processes data under its own privacy policy.

4. Third-party content and the personal data of others

The Service retrieves publicly accessible business information at your instruction, and such information may contain personal data about third parties — for example the name, phone number or e-mail address of a sole trader, or of a named contact on a business’s website.

We retrieve only content accessible without logging into private accounts.
You are the controller for how you use retrieved content. You are responsible for having a lawful basis to process any personal data it contains — including for any direct marketing, where the rules on unsolicited communications apply — and for complying with applicable law and the terms of the source platforms.
With respect to data you direct us to retrieve on your behalf, we act as your processor. For business customers, a Data Processing Addendum (DPA) is available on request.

5. Why we process data (purposes and legal bases)

Purpose	Legal basis (GDPR Art. 6)
Provide and operate the Service	Performance of a contract
Security, abuse/fraud prevention, rate-limiting	Legitimate interests / legal obligation
Maintain and improve reliability	Legitimate interests
Billing and accounting, including refunds and chargebacks	Performance of contract / legal obligation
Support and communications	Performance of contract / legitimate interests
Analytics and marketing cookies on the website	Consent (Art. 6(1)(a)), withdrawable at any time
Comply with the law	Legal obligation

6. Retention

Operational logs: kept for up to 12 months, then deleted or anonymised.
Search results: kept while your account exists; deleted with the project they belong to, or with your account.
Billing records: source accounting documents (e.g. records of purchases and their receipts) are retained for 7 years, as required by Estonian accounting and tax law; other payment-related metadata is kept for up to 1 year.

We do not sell your personal data and do not share it for advertising.

Running the Service relies on a small number of providers. Where a provider processes personal data on our behalf — in particular the infrastructure that hosts the Service and the services that retrieve web content and run AI models for it — it acts as our sub-processor, under contract and only on our instructions.

Some features connect you directly to independent third parties that you choose to use. In these cases you provide your details to that party directly and we receive only limited data back:

a third-party sign-in provider (e.g. Google), if you choose that sign-in option — you authenticate with them directly and they share basic profile data (typically your email and name) with us;
our payment provider (Stripe), when you buy credits — you submit your payment details to the provider directly, and we receive only limited billing metadata (such as the state of the payment and the receipt), never full card numbers.

These independent providers process your data under their own privacy policies.

We maintain a current, named list of our sub-processors, available on request (and provided to business customers under a DPA). We may disclose data where required by law.

8. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and secure storage of credentials. No method of transmission or storage is perfectly secure.

9. Your rights

Under the GDPR you have the rights of access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent (where processing is based on consent). To exercise them, contact the e-mail address on our contact page. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

10. Children

The Service is not directed to children under 16, and we do not knowingly process their personal data.

11. Changes to this Policy

We may update this Policy. We will post the updated version with a new “Last updated” date and, for material changes, take reasonable steps to notify you.

12. Contact

BRONTIR OÜ — the e-mail address on our contact page — registry code 16804491.