Contents
Who is responsible
AICapacity is a marketplace for datacenter capacity operated by Gridhall AB. Gridhall AB is the controller of the personal data described in this policy. Questions and requests: hello@aicapacity.ai.
When an operator or buyer organization uploads documents or messages about third parties in a deal room, the organization decides what it shares; for that content we act as its processor under our data processing agreement.
What we collect
- Account: name, work e-mail address, role title, password (stored only as a hash by our authentication provider) and sign-in history.
- Organization: company name, website, country, registration and VAT numbers, team members and their roles.
- Marketplace content: capacity listings, requests for proposals (RFPs), scoring criteria, interest decisions, deal-room messages and documents.
- Billing (operators): plan, invoices, success-fee schedules and the payment details handled by our payment provider. We do not store card numbers.
- Contact form: name, e-mail, company and your message.
- Security and audit: IP address and browser identifier for sign-ins and for audited actions such as identity reveals, document downloads and staff access.
- Analytics, only with consent: pages visited and features used, linked to a pseudonymous identifier.
Why we use it, and on what basis
- To provide the marketplace (contract): accounts, listings, RFPs, matching, introductions, deal rooms and notifications.
- To vet participants and keep the marketplace safe (legitimate interest): checking companies, screening free text shown anonymously for contact details, preventing abuse, and keeping an audit log.
- To bill operators and keep accounting records (legal obligation and contract).
- To reply to you (legitimate interest) when you use the contact form.
- To improve the product (consent): analytics cookies, which are off unless you turn them on.
Who sees what
Buyers and operators are anonymous to each other until both have said yes to a match. Before that, operators see a buyer's requirements and industry segment, and buyers see a site's specifications and region, never names or contact details. This is enforced by access rules in the database.
When both sides say yes, the organizations' names and the contacts named for the deal are shared with the other party. Our staff can see marketplace content to vet, qualify and support deals; their access is logged.
No AI processing
AICapacity does not send your listings, RFPs, messages or documents to AI models. Matching is a rule-based score computed from the answers you give. If we ever offer an AI-assisted feature, it will be optional, described before you use it, and used only with your consent.
Service providers
We use the following providers to run the platform. Each processes personal data only on our instructions under a data processing agreement. Where a provider is outside the EU/EEA, transfers rely on the European Commission's standard contractual clauses or an adequacy decision.
Provider Purpose Location When Supabase Inc. Database, authentication and file storage EU (Stockholm, Sweden) Always Vercel Inc. Application hosting and content delivery EU (Stockholm, Sweden) for application functions; global edge network Always Resend Inc. Transactional e-mail EU (Ireland) Always Stripe Payments Europe Ltd. Subscription payments and invoices for operators EU (Ireland) Operators with a paid plan Inngest Inc. Scheduling of background jobs (receives record identifiers, not content) United States Always PostHog Inc. Product analytics EU (Frankfurt, Germany) Only with your consent How long we keep it
- Account and organization data: while the account exists.
- Deleted drafts of listings and RFPs: removed for good after 30 days.
- Data exports you request: available for 7 days, then deleted.
- Signed deals, invoices and fee schedules: as long as accounting law requires (currently up to 7 years), without your name once you delete your account.
- Audit log: as long as needed to show how identities and documents were accessed.
- Contact-form messages: up to 24 months after we last replied.
Your rights
You can access, correct, export or delete your data, object to processing based on legitimate interest, and withdraw consent at any time. In your account, Privacy and data lets you download a copy of your data and delete your account yourself. For anything else, write to hello@aicapacity.ai.
You may also complain to a data protection authority, for example where you live or where we are established.
Changes
We will update this policy when our processing changes and show the new version date at the top. For material changes we will tell signed-in users before they take effect.