LEGAL
Privacy policy
Last updated: 13 October 2026
This policy explains what personal data Grand Pipeline collects when you visit this site, answer our ads, contact us or work with us, and what we do with it.
Who we are
Grand Pipeline plans content, runs ads and handles enquiries for businesses that run on leads. In this policy, “we” and “us” mean Grand Pipeline, of 338 Batabano Road, West Bay, Grand Cayman, Cayman Islands.
We decide how and why your personal data is used, which makes us the data controller under the Cayman Islands Data Protection Act (2021 Revision).
Questions or requests about your data: email policy@grandstudio.agency or write to us at the address above. We reply within 30 days.
What we collect
We collect only what you give us, or what is created when you deal with us. We do not buy contact lists.
Visiting this site. Our web host keeps standard server logs: IP address, browser type, pages requested and time. The site sets no tracking or advertising cookies and runs no analytics.
Our Facebook and Instagram lead forms. Meta passes us your name, phone, email, business type and your answers to our questions, such as roughly what one sale is worth to you.
Emailing, calling or messaging us. Your name, contact details and what you tell us. On Instagram or Facebook we also see your public profile name. On a call we see your number and the time.
Working with us. If you are a client or a client’s team member: your name, work email, role, login and two-step sign-in details for our client portal, billing contacts, the content you approve, and the messages and voice notes you send us there.
Appearing in content we produce. Photos, video and voice recorded at shoots, used only with the permission of the person filmed or the client who commissioned it.
We do not ask for sensitive data, such as health, religion or bank details. Please do not send it to us.
How we use it
We use your data to answer you, to deliver our services and to run our business. We never sell it. Each use rests on a reason the law recognises:
Replying to your enquiry, calling you back and booking a pipeline review: you asked us to, and it is in our legitimate interest to respond.
Deciding whether we are a good fit, using your answers about your business: our legitimate interest in focusing on clients we can help.
Delivering a client contract, including portal accounts and approvals: performance of that contract.
Keeping the portal secure, preventing misuse and keeping backups: our legitimate interest in protecting our clients’ data and our service.
Sending news about our services: only with your consent, which you can withdraw at any time.
Measuring how our own ads perform, such as the number of leads and cost per lead: our legitimate interest. We use totals, not individual profiles.
Keeping records for tax, accounting and legal claims: legal obligation and legitimate interest.
Publishing photos or video of you: your permission, or the permission of the client who commissioned the work where they hold it.
We do not make decisions with legal or similarly significant effects about you by automated means alone. A person on our team reviews every enquiry.
Who we share it with
We share personal data only with the service providers that run our business, and only what each needs to do its job for us.
Meta (Facebook, Instagram and WhatsApp) runs our ads and lead forms, delivers messages and publishes our posts. Meta also uses data under its own Privacy Policy when you use its apps.
Hostinger hosts this website, some of our email and some of our servers. Google runs the rest of our team email and stores backups of portal data in Google Drive.
Supabase stores client portal data and enquiries, Vercel runs the portal, Upstash protects it from misuse by counting requests by IP address, and Resend sends its emails.
Anthropic helps our team draft text and summarise enquiries inside the portal. ElevenLabs turns voice notes sent in the portal into text.
Image and video production services edit and produce the photos, video and graphics in the content we make, so photos you appear in may pass through them.
We may also share data with our professional advisers, with a buyer if our business is sold, or when the law requires it.
Most of these providers are based outside the Cayman Islands, mainly in the United States and the European Union. When data leaves the Cayman Islands, we rely on each provider’s contractual commitments to protect it to the standard the Data Protection Act requires.
When we act for our clients
Our clients use our portal, grandstudio.app, to manage their content, ads and enquiries. If you answered a client’s ad, booked through a client’s booking page or messaged a client, that data belongs to the client.
In that case the client is the data controller and we process your data only on its instructions. Please send requests about that data to the client. If you contact us instead, we will pass your request on.
Each client’s data is kept separate and is never used to market Grand Pipeline.
How long we keep it, and how we protect it
We keep data only as long as we need it, then delete it.
Enquiries and leads that do not become clients: 24 months after our last contact.
Client records and contracts: the length of the contract plus 6 years, for tax and legal claims.
Portal accounts: deleted from the portal within 90 days of the client relationship ending.
Backups, including the archive copy made when a portal account is deleted: kept on the same timetable as client records, then deleted.
Website server logs: as long as our web host keeps them.
Portal access needs a password, and our staff also use two-step sign-in. Data is encrypted in transit, social account tokens are encrypted at rest, and each client sees only its own data. If a breach puts your data at risk, we will tell you and the Ombudsman as the law requires.
Your rights
Under the Cayman Islands Data Protection Act you have the right to:
- be told how your data is used, which is what this policy does
- see the personal data we hold about you
- have wrong data corrected
- ask us to stop using your data
- stop direct marketing at any time
- not be subject to decisions made only by automated means
- seek compensation if our breach of the Act causes you damage
- complain to the Ombudsman
To use any of these rights, email policy@grandstudio.agency. We may ask you to confirm who you are. We answer within 30 days and do not charge for it.
Marketing. We send marketing only if you agreed to it. Every message tells you how to stop it, or you can simply reply “stop”.
Cookies. This site sets no tracking or advertising cookies. Meta’s own cookies apply when you use Facebook or Instagram, under Meta’s Privacy Policy at facebook.com/privacy/policy.
Complaints. Please tell us first so we can put it right. You can also complain to the Office of the Ombudsman on +1 345 946 6283. Its guide to these rights is at ombudsman.ky/data-protection.
Changes to this policy
We update this policy when our services or the law change. The date at the top of this page shows the latest version. If a change affects how we use data you already gave us, we will tell you before it takes effect.
READY?
Hand it off.
Start with a conversation. Tell us about your business, where you are, and where you want to be.
Services
Content strategy & production
Ads management
Leads & CRM