Last updated: July 19, 2026 · Demo document — final versions reviewed by counsel before launch
Account data: your name, work email, and company details, provided when you sign up or book an audit. Business data: with your explicit authorization, read-only data from systems you connect (CRM/field-service platform, accounting, advertising, call tracking) — used solely to compute your metrics, findings, and reports. Usage data: product analytics (pages viewed, features used), collected only if you accept analytics cookies.
We never sell your data. We never share one client's data with another — benchmarks are computed only from aggregated, anonymized cohorts of 10+ businesses. We never use advertising cookies or trackers. We never train third-party AI models on your business data.
All arithmetic and dollar estimates are computed by our own software from your records. AI language models are used only to write explanations of pre-computed numbers, and every figure in AI-written text is verified against the source computation before you see it. Model providers are contractually barred from training on your data.
We process data under contract (providing the service), legitimate interest (service improvement), and consent (analytics cookies). You may request access, correction, export, or deletion of your data at any time — email privacy@grovistra.com. We respond within 30 days. You can withdraw cookie consent anytime; essential cookies (login session, security) remain, as the app cannot function without them.
Connected-system data is retained while your subscription is active. On cancellation, your data is deleted within 60 days: source credentials immediately, warehouse data and backups on the following backup-rotation cycle. You may request immediate deletion.
Hosting and database (Supabase, AWS US regions), application hosting (Vercel), transactional email (Resend), AI text generation (Anthropic). Each is bound by a data-processing agreement. We notify clients 30 days before adding a subprocessor.
Data is stored in US regions. For clients in the EU/UK we rely on Standard Contractual Clauses with each subprocessor.
Grovistra · New Jersey, USA · privacy@grovistra.com