Requests from authorities

• We disclose data only on a written request that gives its reasons, is based on an applicable law and comes from an authority with the power to make it.
• We provide only the data the request expressly covers, never more.
• We refuse requests that are plainly unfounded, disproportionate, or that do not follow the applicable procedure, and we challenge them where necessary.
• We give no direct, standing or automated access to our systems.

Requests are sent in writing to support@gracelab.io, on headed paper, signed, with the contact details of the service and of the judge or investigator in charge, so that we can check that they are genuine.

A request must state: the legal basis relied on, the authority issuing it, the account targeted — identified by its phone number in international format —, the exact nature of the information requested, the period covered and the response time sought.

A request for "all the data" on an account, with no period and no reason, is too broad: we ask for it to be narrowed before we answer it.

What we hold depends on what the user provided and on our retention periods, described in the privacy policy. Depending on the case, it may be:

• registration information: phone number, display name, email address where there is one, account creation date;
• sign-in information kept in our logs: dates, IP addresses and devices, within their retention period;
• conversation content still present on our servers, where the request expressly covers it and the applicable procedure allows it;
• material linked to a report already handled by our moderation team.

What we do not hold cannot be provided: deleted or expired messages are no longer on our servers, the content of calls is never recorded, and logs erased at the end of their retention period cannot be reconstructed.

Where there is an imminent danger to a person's life or physical integrity, in particular where a child is in danger, write to support@gracelab.io with "EMERGENCY" in the subject line, the nature of the danger and what is being asked for.

We can then disclose without delay the information needed to prevent that danger, within the limits of what the law allows, and the request is regularised afterwards.

We tell the user that a request targeting them has been sent to us, except where the law or a decision of the authority forbids it, where telling them would compromise an investigation, or where it would put someone in danger.

Where the ban on notifying is temporary, we tell the user as soon as it ends.

An authority can ask us to freeze existing data while it obtains the decision that will allow its disclosure. We then keep that material, without disclosing it, for the period requested if that period is reasonable, renewable under the conditions set by law.

Outside court proceedings, we disclose an account's data to no one. A party to a civil dispute must obtain a court order, which is sent to us at the address above.

A user who wants to obtain their own data must go through the procedure described in the privacy policy, not through this page.

A removal request based on the law must identify the content precisely, set out the legal grounds and state the authority or person making it. Child sexual abuse material and terrorist content are treated as the absolute priority.

Ordinary reports from users go through the "Report" feature in the app and are described in the acceptable use rules.