Account Access Agreement

Version 2026-10-03.4 · Last updated: October 3, 2026

This agreement sets out what we may and may not do with the access you give us to your Grab Merchant account. It applies on top of our Terms & Conditions and our Privacy Policy. You accept it by ticking the box next to it in your client space before you give us access. Where it says something different from the Terms on the same subject, this agreement applies.

1. Who it is between

"We" and "us" means OYA Studio LLC, a Wyoming, USA limited liability company, which operates The Grab Method™. "You" means the business that owns or runs the restaurant whose Grab Merchant account you give us access to, represented by the person who accepts this agreement. By accepting it, you confirm that you are allowed to give access to that account on the business's behalf.

2. The access you give us

You add us to your account as an employee with the Manager role, through Grab's own staff feature, using an email address we create for your restaurant alone. Grab sends the login for that address to us. You can see this employee in your account at any time, and remove it at any time. Manager is a staff role, not yours as the owner: it lets us read your menu, orders, sales, payouts, reviews and marketing, and change your listing when you ask us to. It gives us no way to move money: not to change where Grab pays you, not to make a payment, not to issue a refund. We never open or record your bank details, your identity papers or your customers' payment details.

3. What we do with it

• We read your account to deliver the service you bought: your menu, prices and photographs, your orders, sales and payouts, your ratings and reviews, your promotions and ads, and the reports Grab makes available.
• For services where we change your account for you (Account Setup, Account Renovation, Account Care and any similar service), we only make the changes you approved in writing in your client space, and we tell you when they are done.
• For services that only read your account (Account Check-Up, Check-Up Plus, Re-Check and similar), we change nothing on it.
• We collect data from your account only when you ask for it: see section 5.

4. What we never do

• Change your bank details, payout settings, tax details or legal identity.
• Make payments, issue refunds or change anything financial on your behalf.
• Contact your customers, or reply to reviews in your name, unless you asked us to in writing.
• Add, remove or change other users of your account.
• Accept new terms with Grab, or sign up for paid Grab programmes, on your behalf.
• Use your access for anything other than your restaurant and the services you bought.
• Sell your data, or share it with anyone in a way that identifies your restaurant, except the service providers listed in section 7.

5. Your business data, and what it is for

Your business data is what we read about your restaurant: menu, prices, sales, orders, ratings, promotions, ads, payments and similar figures. It serves one purpose: analysing your account and delivering your services, within our relationship with you. We keep it while your client account is open, to give you that analysis and advice and to show you how your account changes over time.

Your figures are confidential. Your sales, your margins, your prices and what you do on Grab are business information, whether or not the law calls them personal data. They are never shared with anyone outside the people and software that run your service, never sold, and never published in a form that lets you or your restaurant be identified. What we publish (our resources, the community, examples in our pages) carries no figure that points to you.

We never collect your data again without your agreement. Your data is collected only when you ask for it: once when you give us the access, then each time you ask us for a new collection. Nothing is collected from your account on our own initiative. To see how your data changes over time, follow your performance and get new advice, ask us regularly to run a new collection. A service you subscribe to that includes reading your account at set times (such as Account Care) does so because you asked for it by subscribing, and stops when the subscription ends.

If you close your client account, your data is no longer kept. We delete it, except what the law requires us to keep (such as purchase records, see our Privacy Policy) and what we delivered to you. What we delivered to you is kept for seven years after the end of our relationship: the reports, plans and other deliverables, as proof of the work done and for our accounting and legal obligations, and for nothing else. If a report names a person (your manager, a member of your staff), that name is kept with it for the same time and the same purpose, then deleted. We may keep a version from which you and your restaurant can no longer be identified, used only for statistics. You can close your client account from its Settings: an email asks you to confirm, and says that closing cannot be undone. While an order is still in progress, write to [email protected] and we close it with you.

6. Your customers' personal data, and other personal data

We keep no personal data about your restaurant's customers, the people who order from you on Grab. Some of the files we download from your account can contain some: today only the reviews export does, with the first name of the person who wrote each review, sometimes with an initial. That information is removed when we collect the file, before anything is stored, and it is never used. What we keep is your restaurant's activity only: sales, menu, reviews without their author, advertising and payments.

Your account can also show other personal data, such as the names of your staff. If we come across any while working on your account, you are the party responsible for it, and we act on your behalf as your service provider. We:

• use it only to deliver the services you bought, and never for our own marketing;
• keep it confidential and limit access to the people and software that run your service;
• tell you without undue delay if we become aware of a security incident affecting it;
• remove it, or anonymise it so that nobody can be identified, no later than 12 months after the end of the last service we provided to you, or sooner if you ask us;
• help you answer a request from one of those people about their data.

We follow the data protection law that applies to your restaurant and its customers where they are, such as the data protection laws of Thailand, Singapore, Malaysia, the Philippines, Indonesia or Vietnam. These laws apply because of where the people are, wherever our company is based.

7. Service providers

To run our services we use a small number of providers, who only process data on our instructions: Cloudflare (hosting, storage and security), Stripe (payments) and our email provider. We remain responsible for them.

8. Security

The login for the address we use on your account is kept confidential and used only by the people and software that run your service. The address belongs to your restaurant alone and is never used on another account.

9. Taking the access back

You can remove our access at any time, from the same staff screen in your Grab Merchant account, without telling us first. From that moment we can no longer read or change your account. A service that needs the access will pause until you give it back, and refunds follow our Refund Policy. What we already collected is kept and removed as described in sections 5 and 6.

10. Your side

• You remain the owner of your Grab Merchant account and responsible for it, including Grab's own terms for merchants.
• Grab can change its apps, its screens or its rules at any time. We are not responsible for what Grab does, or for actions taken by other users of your account.

11. We are not Grab

The Grab Method™ is independent and is not affiliated with Grab Holdings Inc. or any other delivery platform.

12. Liability

The limits of liability in our Terms & Conditions apply to this agreement. Nothing in this agreement limits a liability or a right that cannot be limited under the law that applies to you.

13. How long it lasts, and changes

This agreement applies from the moment you accept it until our access to your account has ended and the data has been handled as described above. If we change it, we publish the new version here with a new version date, and we ask you to accept it again before we use your access under it.

14. Law and language

This agreement is governed by the same law as our Terms & Conditions, without taking away any protection that the law of your country gives you and that cannot be set aside by contract. If a translation of this agreement differs from the English version, the English version applies.

15. Contact

Questions about this agreement, or a request about your data: [email protected] or [email protected].