Privacy Policy

Gravity is provided by Grupo Impulso Digital S.A. de C.V., Panfilo Perez 879, Blanco y Cuellar, Guadalajara, Jalisco, Mexico ("we", "us"). This policy covers gravitydocs.io, the Gravity application at app.gravitydocs.io, the API at api.gravitydocs.io, the Gravity CLI, and documentation sites published with Gravity, including those on a customer’s own domain.

Questions about this policy or your data: contact@gravitydocs.io.

We are the controller of the data we collect to run our own business: visitors to gravitydocs.io, people who contact us, account holders’ sign-in and billing details, and the operational logs we keep to secure the service.

For the content and personal data that our customers put into their Gravity workspaces, and for data about the readers of the documentation sites they publish, the customer is the controller and we process it on their instructions under our Data Processing Agreement. If you are a reader of a customer’s documentation and have a request about your data, contact that customer; we will help them answer it.

• Account and identity data: name, email address, organisation, role, sign-in method (password, social login or your SSO provider), and, if you enable it, two-factor authentication settings. Sign-in is handled by Polaris, our identity service.
• Workspace content: pages, drafts, comments, change requests, published versions, uploaded images and files, glossary terms, audiences and their member contact details, and Nucleus memories.
• Source material you send us: when you run the Gravity CLI or connect the GitHub App, excerpts of your source code, OpenAPI documents and repository metadata are sent to Gravity to generate documentation. Gravity reads this material; it never executes it.
• Doc Agent captures: when you point the Doc Agent at a running system, the screenshots and page content it captures, with sensitive regions blurred where the agent detects them.
• Ask AI and search: questions readers and members ask, the answers given and the pages cited. Stored questions are PII-redacted, and workspace admins set how long turns are kept.
• Audit and security logs: for every action in the app and API, the actor’s id and email, role, the action, the resource, the result, the IP address, the user agent and the time.
• Reader analytics on published sites: page views, searches, reading time and referrers, with pseudonymous identifiers.
• Website analytics on gravitydocs.io: pages viewed, referrer, approximate location derived from IP, device and browser data, through Google Analytics and PostHog when enabled.
• Contact form: the name, email, company and message you send through gravitydocs.io/contact.
• Billing: billing contact, plan, invoices and tax details. Card data is collected and held by Stripe; we never see the full card number.
• Error reports: when something fails, a report with the stack trace, request URL, browser and device, and your user id and email if you are signed in.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Generation, revision, translation and Ask AI send the relevant content to a large language model. Depending on your workspace settings, that model is reached through Origin, our AI gateway, or directly at Anthropic or OpenAI, or with an API key you supply. Search and memory embeddings are computed with Cloudflare Workers AI.

We do not use your workspace content or source material to train models. We use AI providers under terms that do not allow them to train on data sent through our API accounts. When you supply your own provider key, your agreement with that provider governs those calls.

• Subprocessors that host and run Gravity for us, listed at gravitydocs.io/legal/subprocessors with what each processes and where.
• Our affiliated Impulso services: Polaris (identity and audit), Origin (AI gateway), Ember (contact form intake) and Meridian (billing).
• Services you connect yourself, such as your source host, identity provider or webhook endpoints, under your agreement with them.
• Authorities or other parties when the law requires it, or to protect the rights and safety of our users or the public. Where we can, we will tell the affected customer first.
• A buyer or successor, if our business is reorganised or sold, under this policy’s protections.

Our providers operate in the United States, Canada and on a global edge network, so personal data may be processed outside your country. When we transfer personal data out of the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum or Swiss amendments) or on an adequacy decision, such as the EU-US Data Privacy Framework for certified providers.

Gravity does not currently offer a choice of data region.

We encrypt data in transit with TLS and rely on our hosting providers’ encryption at rest. Every published version is hashed with SHA-256 and signed, so changes are detectable. Access to the app is role-based, actions are written to a tamper-evident audit log, and our own support access to a workspace requires a recorded reason and is written to that workspace’s audit trail. The Security page describes these controls in more detail.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, to withdraw consent, and to complain to a data-protection authority. This includes rights under the GDPR and UK GDPR, the California Consumer Privacy Act, Canada’s PIPEDA and provincial laws, and Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares (ARCO rights).

To exercise a right, write to contact@gravitydocs.io. We will confirm your identity and answer within the time the law sets, usually 30 days. If your data sits in a customer’s workspace, we will pass your request to that customer.

The app uses strictly necessary cookies to keep you signed in and to protect forms. gravitydocs.io and published documentation sites may use analytics cookies from Google Analytics and PostHog; where the law requires consent, we ask first.

Gravity is a business service and is not directed to children under 16. We do not knowingly collect their personal data.

We will post changes here and update the date above. If a change materially affects how we use personal data, we will notify account owners by email before it takes effect.