Privacy Policy

Information you provide directly

When you create an account, we collect your name, email address, business name, phone number, city, and industry. When you subscribe to a paid plan, payment information is processed by our payment processor (Stripe) and we do not store your full card details.

Information collected automatically

We collect usage data including pages visited, features used, session duration, device type, browser, IP address, and referring URL. This data is collected via cookies and similar tracking technologies to improve the platform.

Business data you connect

When you connect your Google Business Profile, review platforms, or social accounts, we access data from those platforms solely to provide the services you have requested (e.g. monitoring reviews, posting content, analysing SEO scores).

To provide and improve the platform

We use your data to deliver Grovaly's features — including review monitoring, AI response generation, local SEO analysis, GBP post scheduling, loyalty card management, and AI coaching. We continuously analyse aggregate usage patterns to improve product performance and add new features.

To communicate with you

We send transactional emails (account confirmation, password resets, billing receipts) and product updates. You can unsubscribe from marketing emails at any time via the link in any email. Transactional emails cannot be opted out of while your account is active.

To comply with legal obligations

We may process your data to comply with applicable laws, respond to lawful requests from public authorities, or protect the rights, property, or safety of Grovaly, our users, or the public.

Legal basis for processing (GDPR — EEA users)

If you are located in the European Economic Area, we rely on the following legal bases under GDPR Article 6: (a) Contract — processing necessary to perform our agreement with you (delivering the Service, billing, account management); (b) Legitimate Interests — analytics, fraud prevention, product improvement, and marketing to existing customers; (c) Legal Obligation — tax records, responding to lawful authority requests; (d) Consent — marketing emails and optional analytics cookies (you may withdraw consent at any time).

Automated decision-making

Grovaly uses AI to generate review responses, SEO recommendations, business coach actions, and GBP content. These AI outputs are suggestions only — no automated decision produces a legal or similarly significant effect on you without human review. You have the right to request human review of any AI-generated output that affects your account (e.g. account suspension flags). Contact privacy@grovaly.com to exercise this right.

Service providers

We share data with trusted third-party providers who help us operate the platform, including cloud infrastructure (AWS), payment processing (Stripe), email delivery (Resend), analytics (Posthog), and AI services (Anthropic/OpenAI). These providers are contractually bound to protect your data and use it only for the purposes we specify.

We do not sell your data

Grovaly does not sell, rent, or trade your personal information to third parties for their marketing purposes — ever.

Business transfers

If Grovaly is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

Cross-border data transfers

Grovaly is headquartered in Canada. If you access the Service from the European Economic Area, United Kingdom, or other regions with data protection laws, your data may be transferred to and processed in Canada, the United States, or other countries. Where required, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to safeguard transfers of personal data from the EEA. A copy of the applicable SCCs is available on request at privacy@grovaly.com. Canada has been recognised by the European Commission as providing adequate protection for personal data under GDPR.

Active accounts

We retain your data for as long as your account is active. Review data, AI coach history, SEO scores, and loyalty data are stored to provide a continuous, improving service.

After cancellation

When you cancel your account, we retain your data for 30 days so you can export it. After 30 days, your personal data and business data are permanently deleted from our systems, except where we are required to retain it by law (e.g. billing records, which are kept for 7 years for tax purposes).

Essential cookies

Required for the platform to function — session tokens, authentication state, and security tokens. These cannot be disabled.

Analytics cookies

Help us understand how users interact with the platform. We use privacy-friendly analytics (Posthog) with IP anonymisation enabled. You can opt out via the cookie banner on your first visit.

Marketing cookies

Used to measure the effectiveness of our marketing campaigns. You can opt out at any time via our cookie preferences panel.

Access and portability

You have the right to request a copy of all personal data we hold about you, in a portable format. Submit a request to privacy@grovaly.com and we will respond within 30 days.

Correction and deletion

You can update most of your account information directly in your dashboard. To request deletion of your account and all associated data, email privacy@grovaly.com or use the 'Delete Account' option in your account settings.

Objection and restriction

You have the right to object to or restrict certain processing of your personal data, including direct marketing. Contact us at privacy@grovaly.com to exercise these rights.

GDPR (EEA users)

If you are located in the European Economic Area, you have additional rights under GDPR including the right to lodge a complaint with your local supervisory authority.

Who this applies to

This section applies to California residents under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). These rights are in addition to the rights described in section 6.

Categories of personal information collected

In the past 12 months we have collected the following categories of personal information: Identifiers (name, email, IP address); Commercial information (subscription plan, billing history); Internet/network activity (pages visited, features used); Geolocation data (city/region from your account); Professional information (business name, industry, role); Inferences drawn from your data (AI coach recommendations, SEO scores).

We do not sell or share your personal information

Grovaly does not sell personal information to third parties and does not share personal information with third parties for cross-context behavioural advertising purposes. Because we do not sell or share your data in this way, no opt-out mechanism is required — but we provide one anyway at privacy@grovaly.com.

Your CCPA/CPRA rights

As a California resident you have the right to: (1) Know what personal information we collect, use, disclose, and sell; (2) Delete personal information we have collected from you (with certain exceptions); (3) Correct inaccurate personal information; (4) Opt-out of the sale or sharing of personal information (not applicable — we don't sell); (5) Limit the use of sensitive personal information; (6) Non-discrimination — we will not discriminate against you for exercising your CCPA rights.

How to submit a CCPA request

Submit a verifiable consumer request by emailing privacy@grovaly.com with the subject line 'CCPA Request'. We will respond within 45 days. You may designate an authorised agent to make requests on your behalf — the agent must provide written authorisation or a power of attorney, and we may require you to verify your identity directly.

Sensitive personal information

We collect account login credentials (username and password). We use this solely to authenticate you and do not use it for inferring characteristics about you. You can limit this use by contacting privacy@grovaly.com, though doing so will prevent you from accessing the Service.

Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about our disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. To make a request, email privacy@grovaly.com.

Technical safeguards

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). We use role-based access controls, automated vulnerability scanning, and conduct annual penetration tests. Grovaly is SOC 2 Type II certified.

Breach notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities within 72 hours of becoming aware of the breach, as required by applicable law.

Grovaly may contain links to third-party websites (e.g. Google Business Profile, review platforms). We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

Grovaly is designed for business owners and professionals. We do not knowingly collect personal information from individuals under 16 years of age. If you believe a minor has provided us with their data, contact us immediately at privacy@grovaly.com.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and display a banner in the Grovaly dashboard at least 14 days before the changes take effect. Your continued use of the platform after that date constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or how we handle your data, please contact our Privacy team: