Privacy Policy

The data controller for the Granite platform is On Equal Ground, reachable at hello@oneequalground.com and at oneequalground.com.

Where OEG processes personal data on behalf of a humanitarian organisation that is itself a data controller (for example, when an NGO uses OEG SaaS to register beneficiaries), OEG acts as a data processor under that organisation's instructions.

Depending on how you use the Services, we may collect the following categories of personal data:

We do not collect precise GPS coordinates or continuously track your location. When location services are enabled within the app, location is used only on your device to show nearby services and is not transmitted to or stored on our servers.

We use the personal data we collect for the following purposes:

• Providing the Services. Creating and maintaining your account, generating your UBID, enabling you to discover and access humanitarian services, and processing referrals between organisations.
• Consent management. Recording and honouring your data sharing preferences, so that only the organisations you authorise can access your profile fields.
• Security. Detecting and preventing fraudulent registrations, account takeovers, and misuse of the platform.
• Platform improvement. Analysing aggregate, anonymised usage data to improve the Services. We do not use identifiable personal data for this purpose.
• Legal compliance. Fulfilling obligations under applicable data protection and humanitarian standards.

You may optionally register one or more emergency contacts within the Granite app. Emergency contacts are individuals you have chosen to be reached in the event of an emergency affecting you.

How emergency contact data is used:

• Emergency contact information is stored securely in the Granite Registry, accessible only to OEG and to partner organisations with a specific organisational agreement covering emergency response.
• Emergency contacts will only be contacted when OEG or an authorised partner organisation receives credible information suggesting an emergency involving your safety, wellbeing, or whereabouts — for example, if a field worker reports that you are in danger, if you trigger an in-app emergency alert, or if your account is flagged following a documented crisis event in your area.
• Emergency contact data is not shared with organisations for general service delivery, data matching, referral management, or any purpose other than the emergency communication purpose described above.
• You may add, edit, or remove emergency contacts at any time from the Profile section of the Granite app.

By adding an emergency contact, you confirm that you have obtained the consent of that individual to store and potentially use their contact information as described.

We do not sell your personal data. We share it only in the following circumstances:

• Authorised organisations. When you grant consent to a humanitarian organisation using the Granite SaaS platform, that organisation can access only the profile fields you have authorised. All access is logged and auditable by you.
• Service providers. We use third-party infrastructure providers (cloud hosting, database services) who process data on our behalf under strict data processing agreements. As of the effective date, our primary infrastructure providers are Supabase (database) and Railway (application hosting).
• Legal requirements. We may disclose data if required to do so by law, court order, or in response to a lawful request by a public authority. We will notify you of such requests to the extent permitted by law.
• Business transfers. If OEG is acquired or merges with another organisation, your data may be transferred as part of that transaction. We will notify you before your data is transferred to a new data controller or becomes subject to a different privacy policy.

For users in the European Economic Area, United Kingdom, or other jurisdictions with equivalent laws, we process your personal data on the following legal bases:

• Consent (Art. 6(1)(a) GDPR): for data sharing with third-party organisations, for emergency contact storage, and for optional features such as location services.
• Contract performance (Art. 6(1)(b) GDPR): for providing your account, generating your UBID, and delivering the core Services.
• Legitimate interests (Art. 6(1)(f) GDPR): for platform security, fraud prevention, and aggregate analytics. We do not override your fundamental rights with these interests.
• Legal obligation (Art. 6(1)(c) GDPR): where applicable law requires us to retain or disclose data.

We retain personal data for as long as your account is active. If you request deletion of your account:

• Your profile data and UBID record will be anonymised within 30 days of the confirmed deletion request.
• Emergency contact data will be deleted within 30 days of account deletion.
• Consent logs and audit records may be retained for up to 7 years to satisfy legal and organisational accountability obligations.
• Data held by third-party organisations (to whom you previously granted access) is subject to those organisations' own retention policies. You should contact them directly to exercise deletion rights over their copies of your data.

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — request that we limit how we process your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw any consent you have given at any time, without affecting the lawfulness of prior processing.

Many of these rights can be exercised directly within the Granite app (Profile → Privacy). To submit a formal request, contact us at hello@oneequalground.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption at rest and in transit (TLS 1.2+).
• Authentication tokens stored in device secure storage (never in plain localStorage or cookies).
• Role-based access control within OEG systems.
• Regular security assessments of infrastructure providers.

No security system is infallible. If you believe your data has been compromised, contact us immediately at hello@oneequalground.com.

The Granite platform is not directed to children under 16 years of age as independent users. Children may be registered as part of a household record managed by a parent or guardian. We do not knowingly collect personal data directly from children as primary account holders without parental consent.

Your data may be processed in countries other than the country in which you reside. When we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent mechanisms recognised under applicable law.

We may update this Privacy Policy as our Services evolve or as legal requirements change. We will notify you of material changes via email or in-app notification at least 14 days before they take effect. The effective date at the top of this page will always reflect the most recent revision.

For any questions about this Privacy Policy or to exercise your rights, contact our team at:

On Equal Ground
hello@oneequalground.com
oneequalground.com