Griptonite
Privacy Policy
Effective date: 17-10-2026
CASCOM LIMITED, trading as Griptonite. Registered in England and Wales, company number 05543830.
Registered office and privacy correspondence: 53 Welburn Park, Newcastle upon Tyne, NE2 2JY, United Kingdom.
Email: info@griptonite.io
This policy explains what information we use, why we use it, who receives it and your choices. It covers Griptonite and related Cascom services, including Grip on Tight, where this policy is presented. A particular app, event or feature may provide additional information. The Terms and Conditions govern the service and content licences; they do not replace a legally required privacy consent.
1. Who is responsible
Cascom, we, us and our mean CASCOM LIMITED. Our services include websites, apps, gym tools, events, Quests, rewards, video analysis, signage and integrations.
We are a controller where we decide why and how information is used, including platform accounts, our communications, security, and our own product development and promotion. Where we handle information solely on a gym’s or another customer’s documented instructions, that customer is the controller and we are its processor. The applicable data processing agreement governs that work. Hosting customer information does not give us unrestricted permission to reuse it for independent purposes.
Gyms, organisers, sponsors, reward suppliers and connected services are responsible for the activities they control. Their own notices apply to those activities. Responsibility depends on what each organisation actually does, not just its contractual label. Where joint control applies, we provide the information required about that arrangement.
2. What we collect and why
Information comes from you, your use of our services, authorised gyms and organisers, integrations, other users’ relevant submissions, payment providers and correspondence. We may also use public professional contact details and referrals for business development. The categories depend on the features you use.
| Information | Examples |
|---|---|
| Accounts and preferences | Names, email addresses, login and verification details, profile images, age or date of birth, supplied gender information, settings and communication choices. |
| Climbing and participation | Gyms, sessions, routes, attempts, grades, scores, event entries, rankings, memberships, visits and associated dates; Quest entries, eligibility, Credits, expiry and redemptions. |
| Media and analysis | Videos, photos, audio, comments, upload metadata, annotations, movement measurements, results and other derived information. Visibility and development restrictions are in sections 4 and 5. |
| Device, location and usage | IP addresses, device and app information, identifiers, sessions, feature-use durations, interactions, diagnostics, relevant location checks and security records. Section 3 explains location and measurement. |
| Business and payment records | Contacts, orders, subscriptions, billing and payment status, provider references, staff permissions, equipment records and contracts. Payment providers explain how they handle payment credentials. |
| Correspondence and permissions | Support messages, complaints, account requests, promotion choices, consent and objection records, and the notices or terms associated with them. |
An account identifier, public video or coded performance record may still identify someone. Removing a name does not automatically make information anonymous. Avoid submitting unnecessary medical details, identity documents or other sensitive information. A purpose involving legally protected sensitive information requires the additional conditions applicable to it.
We use information for the following purposes. Where UK or European law requires a lawful basis, these are the bases for processing we control:
| Purpose | Lawful basis and interest |
|---|---|
| Provide accounts, requested analysis, activities, rewards, transactions and support | Performance of the individual’s contract where necessary; legitimate interests in administering business customers and providing related operational support. |
| Personalise features, recommendations and relevant content | Contract where necessary for a requested feature; legitimate interests in making the service useful and relevant using activity, preferences, ability, discipline and appropriate supplied profile information. |
| Measure performance, correct faults, research and improve products and models | Legitimate interests in service quality, security and development, where the necessary assessment supports the use; consent for private-media contributions and wherever otherwise required. See section 5. |
| Publish chosen community content and conduct permitted promotion | Contract for a sharing feature the user requests; assessed legitimate interests for disclosed community and promotional activities; consent where required for communications, tracking, identifiable media or sponsor use. |
| Protect systems, verify activity, prevent abuse, enforce agreements and handle claims | Legitimate interests in security, accurate administration and protecting rights; legal obligation where applicable. |
| Keep required records, handle rights requests and manage business transactions | Legal obligation for applicable compliance and record-keeping; legitimate interests in business administration, legal claims and properly controlled investment or business transfers. |
Legitimate interests requires a necessary and proportionate use balanced against individual rights. A company contract does not automatically supply the contract basis for every employee’s information. Consent is obtained where the activity or law requires it and may be withdrawn. Fields needed for a feature, transaction or eligibility check may be necessary to provide it; optional marketing is different. Further information or consent is provided before a new use where required.
3. Location, analytics and device technologies
Gym-presence checks. For location-verified Quests, the app obtains precise location with the relevant device permission and checks proximity to a gym. It sends latitude, longitude and the accuracy reading to our API for verification. The presence record retains the account, gym, time, calculated distance from the gym and reported accuracy, rather than storing the submitted latitude and longitude as presence-record fields. These records can show attendance and proximity to a gym; they are not anonymous. This feature is for participation verification, not unrelated location advertising.
Turning off location permission may prevent completion of a location-dependent task or its Credit award. Gym associations, logged climbs and membership check-ins can separately indicate where and when you climb. Device permission for one feature does not authorise unrelated marketing or model development.
Service measurement. We measure sessions, feature interactions, usage durations, performance and errors to improve and personalise the service. Some measurement is linked to account identifiers and attributes such as climbing ability; it is not all anonymous. We do not publish individual app-usage histories or provide that analytics information for independent advertising across unrelated services. Public contributions and expressly permitted sponsor disclosures are separate.
Diagnostic information can include relevant app-screen images, interface information and request or error context. It is handled for troubleshooting, security and reliability, not as an unrestricted promotional or training source. Our technical providers are described in section 7.
Cookies and similar technologies. Our websites and apps use storage, identifiers and software components for sign-in, security, settings, diagnostics and measurement. Applicable consent and exemption rules apply to both websites and apps. Where consent is required, it must precede the relevant technology’s use; an exemption is used only where its conditions are met. A technology-specific notice or control provides required information about purposes, duration, providers and choices.
Device and browser settings control relevant permissions and some storage. They do not necessarily control every app component. Notification settings, media privacy and any analytics choices serve different functions. Continued use does not replace required consent.
4. Your media, publication and removal
Private and shared content
Photos and videos uploaded in private mode are not made available to gym staff through the service. Without your express consent, they are not used for advertising, shared development, model training or evaluation, or external datasets. This also excludes their annotations and derived measurements from those wider uses; removing a name or converting the upload into measurements does not bypass the restriction.
We and authorised providers may process private uploads to supply the analysis, storage and other private features you request, and for necessary support, security and legal compliance. A separate sharing instruction is needed to disclose private media to another participant, gym, coach or sponsor. Private mode does not switch off independent usage measurement, separately logged climbing activity or all account processing.
Content you publish, associated profile details, leaderboards and event results may appear through the relevant app, website, gym screen or other distribution explained for that feature. Public material can be viewed, copied or redistributed by others, including overseas. Public submission alone does not supply consent for unrelated advertising.
Promotion
Subject to the content licence and applicable permissions, we may use eligible media, names, images, voices and associated activity to demonstrate or promote our services and related gym, event or sponsor campaigns. Channels can include apps, screens, websites, social media, presentations, email, print and advertising. Participating gyms and named sponsors may use permitted media within the agreed scope; they do not obtain unrestricted access to private accounts or contact lists.
A valid permission may cover a defined campaign or category of uses without approval of every edit or display. Where separate consent or a release is required, it must identify the relevant use and recipient. Uploaders must have the rights they grant, including permissions needed for other people appearing in the material. Private-media restrictions continue to apply.
Removal from our channels and external platforms
Use an available media control, or contact us with enough detail to identify the material and where it appears. A request to remove an in-app upload does not necessarily identify every separate promotional post, so provide the post link or campaign details where available; we also take the steps the law requires to locate and notify relevant recipients.
When removal or cessation is required, we act without undue delay on copies and uses we control, including posts on social-media accounts we operate. Where another platform or recipient controls a copy, we use the available removal or notification process and take any further steps required by law. We cannot guarantee the time an independent platform takes to complete removal, or recall every repost, downloaded copy, cached result, backup or printed item already distributed.
A valid withdrawal stops the relevant future use as required but does not retrospectively invalidate earlier lawful use. Limited evidence may remain for legal or compliance purposes. These practical limits do not excuse leaving up a post we can and must remove, or override applicable erasure and recipient-notification duties. We do not promise a wider internet-wide recall, fixed third-party removal deadline or discretionary compensation.
5. Research, improvement and anonymised datasets
We use eligible information to assess and improve the accuracy, performance and usefulness of climbing and movement-analysis services and related products. Work may include human review and annotation, testing, statistical analysis, dataset preparation, model training and evaluation, and development of relevant measurements, recommendations and comparisons. Some current accuracy testing is ad hoc and human-led; this is not a statement that every upload is automatically used to train a model.
These purposes describe our use of information, not a commitment to launch a particular feature. They do not authorise unrelated uses simply because those uses might interest us commercially. For eligible information we rely on assessed legitimate interests where appropriate, or consent where required. Private media and its derived data remain subject to section 4. Children’s information and information held solely on a customer’s instructions have additional restrictions.
We may create group statistics and benchmarks using eligible performance and profile information. Outputs are reduced, combined or withheld where necessary to prevent identification; a small group or unusual combination of characteristics can be identifying. An individual’s identifiable source record remains protected even where a resulting statistic is anonymous.
Hackathons and external development. We may organise, sponsor or participate in hackathons, research collaborations and developer programmes. We may prepare and release genuinely anonymised or appropriately tested synthetic datasets, statistics and other non-personal materials for those activities. Releases may be to selected participants or publicly available under a separate licence, and may support research, development, testing and permitted commercial use by Cascom and recipients.
Before a release, we assess whether individuals could reasonably be identified from the material, alone or with other available information, taking account of the intended recipients and whether release is public. Removing account names, replacing identifiers or blurring a face is not, by itself, sufficient. Recognisable footage, voices, distinctive events and linkable records are not released under this anonymous-data provision. Private media cannot be used to construct such a dataset without the express permission required by section 4.
Anonymising source information is itself processing and needs a lawful basis. Material that remains personal information requires a separate lawful arrangement, safeguards and any necessary permission before external use; a hackathon label is not an exemption. We may impose dataset-use restrictions, including prohibitions on re-identification and unauthorised onward disclosure.
Once material is genuinely anonymous, privacy rights do not require us to recover a contribution we can no longer identify. Public copies may not be retractable. This does not excuse a failed anonymisation or a continuing duty concerning identifiable information. Cascom may retain and commercially use lawful non-personal datasets, statistics, software and models after account closure; identifiable inputs remain subject to applicable rights and retention limits.
6. Promotions, sponsor emails and communications
Optional sponsored promotions. Promotions may run through Griptonite, Grip on Tight, Grippy or another Cascom app. Before choosing to join a promotion involving sponsor contact-data sharing, you will be told the sponsor’s identity, which details will be disclosed, the purpose and where to find the sponsor’s privacy information. We may provide your email address and other specifically identified participation details when you expressly choose that disclosed sharing and the required lawful conditions are met. Funding a promotion does not automatically entitle a sponsor to every participant’s details.
You may choose not to enter the promotion and continue using unrelated service features. Information genuinely needed to administer that promotion or supply its reward may be required for that activity. A sponsor’s independent email marketing is a distinct use: the request must expressly cover it, identify the sponsor and be separate from general acceptance of our Terms. It remains an optional choice where the law requires one; the ability to skip the entire promotion does not by itself establish valid marketing consent.
The sponsor is responsible for its independent use, notices and unsubscribe arrangements. We record relevant permissions and handle required withdrawals or recipient notifications. Changing Griptonite’s own marketing setting may not automatically change a sponsor’s separate mailing list; use the sponsor’s unsubscribe route or contact us for assistance with a request concerning a disclosure we control.
Our own messages. Use the app’s available category controls for notifications, updates, marketing and promotions. Email and push choices are separate, and device push controls do not automatically stop email. You can also use the unsubscribe route in a message or make another valid request. Necessary account, security, billing and participation messages are not optional marketing.
Marketing to individuals uses consent where required. A permitted existing-customer exception is used only when its conditions are met; a free registration does not automatically qualify. Permitted business-contact marketing may rely on legitimate interests with an objection route.
Preference changes pass through our systems and providers. A message already sent or being delivered may still arrive. We apply valid opt-outs promptly and suppress queued marketing under our control as required; a queue is not permission to continue marketing indefinitely. Limited suppression records may remain to prevent re-enrolment.
7. Who receives information
We disclose relevant information to authorised gyms, organisers, linked systems, reward suppliers, named sponsors and chosen recipients for the roles described above. A gym association does not automatically open records to every gym or chain member. Private media is excluded from ordinary gym-staff access.
Technical providers support hosting, storage, delivery, communications, diagnostics, payments and analysis. Components used in our service include Amazon Web Services, Google Firebase, Mixpanel, Sentry, Brevo/Sendinblue, RevenueCat and Beam for relevant functions. Not every provider receives every category. For example, subscription administration may involve contact and entitlement information; requested analysis may require the video to be processed by an authorised technical provider. We limit provider use through the arrangements required for their role. A provider’s independent activity is governed by its own relevant notice.
We may disclose information to advisers, insurers, auditors, debt-recovery providers, authorities, courts or other parties where necessary for compliance, claims, fraud prevention or protecting rights. Necessary information may also be disclosed under suitable safeguards to prospective investors, purchasers, advisers and successors in a business sale or reorganisation. A business transfer does not override applicable privacy restrictions or private-media choices.
Genuinely anonymous datasets and statistics may be licensed or published as described in section 5. Identifiable sponsor disclosures are handled under section 6, not treated as anonymous reporting. We do not permit providers to use personal app analytics for independent cross-service advertising merely because they supply a technical service.
8. Storage, international access and security
Storage and processing locations depend on the service, infrastructure and providers involved. They may include the United Kingdom, European locations and other countries where authorised providers or recipients operate. A user’s gym or country does not itself guarantee that every database, media copy, diagnostic record or provider record remains there. Public sharing and expressly chosen overseas disclosures are separate from our own storage arrangements.
Our support team is based in the United Kingdom and normally works 09:00-17:00 GMT. Authorised UK personnel may access relevant information to provide support and administer the service. Cross-border access and disclosure are assessed under the applicable law and the actual organisations involved.
Restricted international transfers require an applicable adequacy arrangement, approved contractual safeguards or another lawful mechanism. Depending on the transfer, these may include the UK International Data Transfer Agreement or Addendum and European standard contractual clauses, with any required assessment and supplementary protection. General account acceptance is not a substitute. Contact us for applicable location and safeguard information, including a copy where legally required and subject to lawful redaction.
We apply technical and organisational measures appropriate to the information and risk. No system is guaranteed immune to compromise, loss or interruption. Protect your credentials, devices and staff permissions. We meet applicable security, breach-assessment and notification duties; this policy does not promise a particular certification or recovery service level.
9. Retention and account deletion
Use the in-app deletion control for ordinary account closure. Requests enter our deletion process rather than necessarily taking effect immediately. Routine live-account deletion normally completes within a few days; exceptional technical issues or lawful restrictions may require additional handling. Applicable legal deadlines continue to apply. Email us promptly if a request was a mistake. We may need to verify it, and cannot guarantee interception or recovery after deletion has completed.
Account closure is distinct from erasure of every record and from cancellation of a separately billed app-store subscription. Some records require limited retention for a lawful purpose. Media removal and independent-platform copies are addressed in section 4.
| Records | How retention is determined |
|---|---|
| Accounts, ordinary climbing history and private uploads | For the account and requested functions, then deletion, anonymisation or a specific lawful retention ground. Private uploads do not become general development material on closure. |
| Public and promotional material | For the chosen publication or permitted use, subject to applicable removal and withdrawal duties. Evidence of permission may remain separately. |
| Quests, Credits and verification | For administration, expiry and reconciliation, plus necessary fraud, re-entry, dispute or compliance records. This does not require indefinite retention of a complete profile. |
| Billing and business records | For applicable tax, accounting, audit, debt and legal-claim periods. |
| Analytics, diagnostics, support and security | For their still-necessary operational purpose, reducing identifying detail or deleting it when no longer needed. |
| Development data | For a defined development or evaluation purpose, subject to source restrictions, necessity review and individual rights. An unspecified possible future use is not an indefinite retention basis. |
| Consent, objection and suppression evidence | For as long as needed to honour choices, prevent unwanted re-enrolment or demonstrate compliance. |
| Backups | Until expiry, replacement or deletion under the applicable backup cycle, with residual erased information excluded from ordinary use. |
Residual backup copies are not used as a fresh source for marketing or development. Recovery must reapply relevant deletions and restrictions before returning restored information to ordinary use. We make recipient notifications required by law. Independent gyms, sponsors and platforms may hold their own lawful records; we remain responsible for our own processing and any assistance required as a processor.
10. Your choices and rights
Use the app for available communication preferences, media visibility and deletion controls. For another request, an unavailable control, a development objection or an inaccessible account, contact info@griptonite.io. These are recommended routes, not barriers to another legally valid request.
Depending on applicable law, you may request access, correction, erasure, restriction, portability or information about use; withdraw consent; object to legitimate-interests processing; and exercise rights concerning certain automated decisions. We assess a legitimate-interests objection under the relevant legal test. You can object to direct marketing at any time, including associated profiling. Withdrawal does not invalidate earlier lawful processing.
Recommendations, rankings, verification and rewards can involve automated calculations or profiling. Their significance depends on how the result is used. Where legal safeguards apply to a significant automated decision, the responsible controller provides the required information and route for representations, human intervention and challenge. Contact the gym for decisions it controls and us for decisions we control.
We may seek necessary, proportionate verification or clarification. Requests are normally free; fees or refusal apply only where legally allowed. The usual UK/EU rights-response period is one calendar month, subject to lawful verification, clarification and extension rules. Other territorial deadlines apply where relevant. Rights have legal exceptions, including necessary claim records and protection of others’ information; our support hours and contract do not override them.
Overseas and US rights. Mandatory local rights remain applicable. Where a relevant US state law covers the activity, additional rights can include opting out of sale, sharing, targeted advertising or specified profiling, limiting certain sensitive uses, and appealing a rights decision. Contact us with the request or appeal; an authorised agent may act where permitted. We honour qualifying universal opt-out signals where required and do not retaliate for exercising a protected right.
Statutory sale or sharing can include arrangements other than selling a list for cash. A sponsor-funded disclosure is assessed on its actual terms; a consent checkbox is not an automatic exemption. Required collection, sale/sharing or financial-incentive notices and controls apply before covered activity begins. A promotion’s own notice identifies the relevant arrangement. The data categories, purposes, recipients and retention criteria above should be read with any required local supplement.
11. Younger users
General self-operated accounts require age 13, any higher local age and legally required parental permission. Quests and promotional Credit wallets require age 18 or the local age of majority if higher. Other event-participation records, including records supplied by a parent or organiser, require their own lawful arrangements; an adult uploader does not turn a child’s information into adult data.
Children’s media and records are not admitted to advertising, hackathon releases or shared model-development uses solely under a general content licence. Age-appropriate safeguards, the required legal conditions and permissions apply. A new identification-biometric or sensitive health-inference use is not authorised by a general video upload. Parents and guardians can contact us concerning a child’s information, subject to appropriate authority and the child’s own rights.
12. Updates, questions and complaints
We may update this notice as our services, processing or legal requirements change. We identify the effective date and give any required further notice or obtain necessary fresh consent before a new use. An update does not convert private media into public material or supply missing permissions.
Send privacy questions or complaints to info@griptonite.io or the registered office above. Explain the concern and relevant account, material or activity. For complaints within the UK statutory privacy-complaints process, we acknowledge receipt within 30 days, investigate and respond without undue delay, provide required updates and communicate the outcome. Rights-request deadlines are separate.
You may complain to the Information Commissioner’s Office or another competent regulator. Contractual liability limits and court provisions do not remove non-excludable privacy rights or regulatory powers.