Privacy Policy

Grovia and the groviaos.com website are operated by Webzworld, based in Mumbai, India. We collect and keep the personal data described in Section 3, with help from the service providers listed in Section 8. • Registered address: 1318, Navjivan Commercial Society, Lamington Road, Mumbai 400 008, India • GSTIN: 27AHMPD3226G1ZK • Grievance Officer and data protection contact: Anirudh Yadav, info@groviaos.com • General enquiries: info@groviaos.com Our Grievance Officer is also the person to contact about data protection if you are in Singapore, the United Arab Emirates, the United Kingdom, Ireland or anywhere else. We acknowledge privacy requests and grievances within 5 working days and respond in full within 30 days, or tell you within those 30 days why we need longer (see Section 14).

We handle personal data in two different roles, and your rights work differently in each. Data we are responsible for. We decide why and how we use personal data about the people who use Grovia accounts, our customers' billing contacts, visitors to our website, people who contact us, and prospective customers. For this data we are the "data fiduciary" (India), the organisation responsible (Singapore) and the "controller" (United Arab Emirates, United Kingdom and Ireland). Data we process for our customers ("Customer Data"). Businesses that subscribe to Grovia ("Customers") store their own business records in it — for example records about their clients, leads, employees, invoices, support tickets, documents, chat messages and field visits. The Customer decides what to store and how to use it, and we process it only on the Customer's instructions, as a "data processor" (India, United Arab Emirates, United Kingdom and Ireland) or "data intermediary" (Singapore). If your personal data is held in a Customer's Grovia account — for example because you work for that business or are one of its clients — please contact that business first. If you contact us instead, we will pass your request to them and help them respond. The Customer's own privacy notice explains how it uses your data.

We collect the personal data below. Most of it comes from you or from the administrator who set up your account. Some is created automatically when you use Grovia. Payment status comes from Razorpay. • Account and profile data: name, email address, organisation name, country, industry, chosen plan, password (stored only as a one-way hash), role and permissions, profile photo if you add one, and two-factor authentication settings. • Billing data: billing contact name, email address and phone number, billing address, GSTIN or other tax registration number, plan, add-ons, billing cycle, currency, invoices and payment status. Card, UPI and bank details are entered into Razorpay's checkout, not into Grovia. • Enquiry and support data: what you send us through our contact form, support tickets, email or calls — usually your name, email address, phone number, subject, message and any attachments. • Security and usage data: IP address, browser and device type, sign-in times and counts, and audit-log entries that record actions taken in an account, including the IP address and browser used. • Mobile app data: push-notification tokens and the device details needed to deliver notifications. For location data in Grovia Field, see Section 7. • AI usage data: the number of AI requests, tokens used, AI model and cost, for each organisation and user. • Website data: the pages you visit and, only if you allow them, analytics and advertising cookie data (Section 10). To show prices in a likely currency, our website reads your browser's time zone. We do not use your IP address for this, and we never treat this guess as your billing country. • Marketing data: your marketing preferences and a record of the marketing emails we have sent you. Some of this, such as passwords and financial information, is "sensitive personal data or information" under Indian rules. You can choose not to give us personal data, but we may then be unable to provide Grovia or answer your enquiry.

Depending on the modules a Customer uses, Customer Data can include: • contact and business records about the Customer's clients, leads, vendors and contacts, such as names, email addresses, phone numbers, addresses, company details and tax registration numbers; • employee and HR records, such as date of birth, gender, bank account details, PAN, salary, payroll, attendance and leave; • field operations records, including the location of field staff (Section 7); • support tickets, emails received into connected mailboxes, team chat messages, files and attachments; • industry-specific records, such as legal case and court information, tax and compliance documents, travel bookings and passport details, and patient details such as blood group and diagnosis; and • anything else a Customer chooses to upload. Each Customer is responsible for having a lawful basis for its Customer Data, for giving people any notice the law requires, for getting any consent the law requires (including verifiable consent from a parent or guardian before processing a child's personal data where the law requires it), and for deciding what to upload. We use Customer Data only to provide, support and secure Grovia for that Customer, to follow its instructions (including the integrations and AI features it switches on), and where the law requires.

We use the personal data described in Section 3 for these purposes: • To create and run accounts and provide Grovia — using account, profile, billing, security and usage data. • To take payments, issue invoices and keep tax and accounting records — using billing data. • To keep Grovia secure, prevent fraud and misuse, and investigate problems — using security and usage data, including audit logs. • To answer enquiries, run demos and give support — using enquiry and support data. • To send service messages, such as sign-up and approval notices, trial reminders, billing notices and security alerts — using account and billing data. • To send marketing about Grovia — using your name, email address and marketing preferences (Section 16). • To measure and improve our website and advertising — using website data, only where you allow analytics or marketing cookies (Section 10). • To provide the AI features your organisation uses (Section 6). • To comply with the law, respond to lawful requests, and establish, exercise or defend legal claims — using the data relevant to the matter. Our legal grounds depend on where you are: • India: we use personal data that you give us voluntarily for the purpose you gave it (for example to sign up, buy a plan or ask for help), personal data you have consented to us using (for example for marketing and non-essential cookies), and personal data the law requires or permits us to use. • Singapore: we rely on your consent, including consent deemed from your voluntarily giving us data for a purpose, and on exceptions allowed by the Personal Data Protection Act 2012. Where we rely on the legitimate interests exception, we will tell you on request. • United Arab Emirates: we rely on your consent, or on grounds that do not need consent under Federal Decree-Law No. 45 of 2021, such as performing a contract with you or meeting a legal obligation. • United Kingdom and Ireland: we rely on performing our contract with you or your organisation, on our legitimate interests in running, securing, improving and marketing a business service (balanced against your rights), on legal obligations, and on your consent for non-essential cookies and, where required, marketing.

Grovia includes optional AI features: GroAI (in the web app and in the "GroAI by Grovia" app, including Ask, AI reports and the daily briefing), AI summaries on module dashboards, AI assistants for particular industries (such as CA firms, law firms, agencies and IT service providers), reading and analysing uploaded documents (such as tax notices, legal notices, contracts and tax statements), "Polish with AI" for support-ticket replies, and Marketing AI. These features are powered by Anthropic, PBC, a company based in the United States, through its Claude API. When someone in your organisation uses an AI feature, we send Anthropic what the feature needs to produce its answer: • the question or instruction typed; • the business records needed to answer, which can include personal data such as names, contact details and amounts; • for document features, the whole document; • for support-ticket replies, the ticket subject and the text of similar past tickets and replies from your organisation; and • recent AI conversation history from your organisation, used as context. How this is limited: • Your organisation's administrators can switch AI summaries off, and can switch support-ticket AI on or off and set a monthly limit, in Settings. • In GroAI chat, names, email addresses and phone numbers in the business records we send are replaced with placeholders, and the real values are put back only in the answer shown to you. This does not cover documents sent for analysis or earlier conversation text, which are sent as they are. • The GroAI mobile app sends nothing to the AI provider until you have read an in-app notice and given permission. You can withdraw permission in the app's Settings at any time; this pauses all AI processing for you in the app, including the daily briefing. • Data is sent over encrypted connections and only to generate the response. • Under our commercial terms with Anthropic, data sent through its API is not used to train its models. • AI questions and answers are stored in your organisation's Grovia account so you can see them again, and can be deleted. AI answers can be wrong. Please check important figures against your own records.

If your employer uses Field Operations, the Grovia Field app collects your device's precise location (GPS): • when the app opens or returns to the screen, and about every three minutes while it stays open and you are signed in; and • when you check in to or out of a field visit. The app is designed not to collect location while it is closed or running in the background. Your name, location and the time are shown to authorised people in your organisation on a live map and in visit reports, and are passed in real time to their screens through our messaging provider, Pusher. Your employer decides whether to use this feature and is responsible for telling you about it. You can turn off location access in your phone's settings, but some Grovia Field features will then stop working.

We do not sell personal data, and we do not share it for other companies to use for their own marketing. Service providers who process personal data for us, under contract and only to provide their service to us: • Amazon Web Services — hosting, database, file storage and backups for all Grovia data, in the Asia Pacific (Mumbai) region, India. • Anthropic — AI features (Section 6). • Razorpay — payment processing for subscriptions and AI credits, for customers in India and in other countries. • Pusher — real-time delivery of updates inside Grovia, such as new chat messages, ticket alerts and field staff locations. • Expo, Google Firebase Cloud Messaging and Apple Push Notification service — delivery of mobile notifications, which may include a short preview of a message or task. • Browser push services — delivery of desktop notifications. • Hostinger — sending account, billing and notification emails. • Google reCAPTCHA — spam protection on our contact, support and checkout forms. • Google Maps Platform — addresses and maps in Field Operations. • Google Analytics, Microsoft Clarity and Meta — analytics and advertising measurement on our public website, only if you allow those cookies (Section 10). • Google Fonts, jsDelivr and Unsplash — delivering fonts, code and images when our pages load, which means they receive your IP address and browser details. Services a Customer connects. If a Customer connects its own Microsoft 365 or Google mailbox, IMAP mailbox, email server, Razorpay account, WhatsApp or SMS provider (such as Interakt, Wati, Gupshup, MSG91 or Twilio), or court-information provider (eCourtsIndia), we send the relevant data to that service on the Customer's instructions. The Customer chooses these services and has its own terms with them. Others: • People in your organisation: administrators of your Grovia account can see the data in it, depending on the roles and permissions they set. • Professional advisers, auditors and insurers, who must keep it confidential. • Government, regulatory or law enforcement authorities, where the law requires it, or where needed to protect people's safety, our rights or the security of Grovia. If a request concerns Customer Data, we will tell the Customer unless the law forbids us. • A buyer or successor, if our business is reorganised, merged or sold, who must continue to protect personal data as described in this policy. We will give you an up-to-date list of our service providers on request.

Where we store data. We host Grovia — including account data, Customer Data, uploaded files and backups — on Amazon Web Services in the Asia Pacific (Mumbai) region, India. Where else data may go. Some of our service providers process personal data outside India, including in the United States (for example our AI provider, and the analytics and advertising tools on our public website if you allow them) and the United Kingdom, Ireland, the Netherlands, Belgium, Finland, Lithuania, Cyprus, Luxembourg, Singapore, Indonesia, Japan, South Korea, Taiwan, Australia, Brazil and Chile. People in your organisation can also view data from wherever they sign in. How we protect transfers between countries: • Leaving India: under the Indian rules in force today, we transfer sensitive personal data only to recipients that protect it to the same standard we do, and only where the transfer is needed for our contract with you or you have consented. Once the transfer provision of the Digital Personal Data Protection Act, 2023 applies, transfers outside India are allowed except to countries the Government restricts by notification. No country had been restricted at the date of this policy; if one we use is restricted, we will stop transferring personal data there. • Singapore: where Singapore's transfer rules apply, we make sure recipients outside Singapore are bound by legally enforceable obligations, such as contract terms, to protect the data to a standard at least comparable to Singapore's Personal Data Protection Act 2012. Our Terms of Service give Customers these commitments for Customer Data. • United Arab Emirates: Federal Decree-Law No. 45 of 2021 allows transfers to countries whose protection the UAE Data Office has approved and, in other cases, on specific grounds — for example where the transfer is needed to perform a contract with the individual, where a contract obliges the recipient to protect the data, or with the individual's explicit consent. At the date of this policy, no such approvals, standard contractual clauses or implementing regulations had been published on the UAE's official legislation portal. We therefore rely on those specific grounds, and on contract terms that require recipients to protect the data. • United Kingdom and Ireland: when personal data leaves the United Kingdom or the European Economic Area for a country without an adequacy decision, which currently includes India, we use the standard contractual clauses approved for that purpose (the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum) or another lawful safeguard. You can ask us for a copy of the safeguards we use (see Section 1).

We use cookies and browser storage to run our website and Grovia and, only if you allow them, for analytics and advertising measurement. • Essential (always on): keeping you signed in, protecting sign-in and forms, processing payments and remembering your cookie choice. • Functional (stored in your browser): remembering choices such as your display currency and how you arrange Grovia. • Analytics (off until you allow them): Google Analytics and Microsoft Clarity on our public website. Clarity records how visitors use pages — clicks, scrolling and what the page showed — so we can improve them. • Marketing (off until you allow it): Meta Pixel on our public website, to measure our Facebook and Instagram ads. We do not use analytics, session recording or advertising tools inside Grovia, the client portal, or pages that show a Customer's or its clients' information. You can change your choice at any time using "Cookie settings" at the bottom of any page on our website. Our Cookie Policy lists each cookie.

We keep personal data only for as long as we need it for the purposes in this policy, or as the law requires, and then delete or anonymise it. • Account data and Customer Data: while the account is active. After a subscription or trial ends, we keep it for 30 days so the organisation can export it or come back, and then delete it from our live systems. • Backups: copies in backups are deleted within 90 days after the data is deleted from our live systems. • Billing, invoice and tax records: for 8 years after the end of the financial year they relate to, to meet tax and accounting laws. • Security logs and audit logs: for 1 year. • Enquiries from people who do not become customers: for 1 year after our last contact. • AI questions and answers: until your organisation deletes them, or until the account data is deleted. • Marketing preferences: for as long as we may contact you. If you opt out, we keep a minimal record so that we do not contact you again. • Website analytics: according to each tool's settings; for example, Google Analytics cookies last up to two years. If we must keep data for longer — for example because of a legal claim or an investigation — we keep only what is needed, and only for that purpose.

We use technical and organisational safeguards suited to the kind of data we hold, including: • encryption of data in transit (HTTPS) and encryption of our database and file storage at rest; • passwords stored only as salted one-way hashes, and optional two-factor authentication; • role-based permissions inside each account, and checks that keep each organisation's data separate; • audit logs of important actions; • regular backups; and • access to production systems limited to the people who need it. No system is completely secure. If you think your account has been misused, please tell us straight away at info@groviaos.com.

If a personal data breach affects data we are responsible for, we will act quickly to contain it and will notify the affected people and the relevant authorities where the law requires — for example the Data Protection Board of India, the Personal Data Protection Commission in Singapore, the UAE Data Office, the Information Commissioner's Office in the United Kingdom, or the Data Protection Commission in Ireland. If a breach affects Customer Data, we will tell the affected Customer without undue delay and give it the information it needs to meet its own duties to notify authorities and individuals.

Wherever you are, you can ask us to: • confirm whether we hold personal data about you, and give you a copy and a summary of how we use it, including who we have shared it with; • correct, complete or update it; • delete it when we no longer need it or when you withdraw consent, unless the law requires us to keep it; • let you withdraw consent you have given, as easily as you gave it — this does not affect what we did before, and we will tell you if it means we can no longer provide part of the service; and • stop sending you marketing. Account owners and administrators can also export their organisation's data from Settings. Additional rights depend on where you are: • India: the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are coming into force in stages, and most of their duties and rights are scheduled to apply from 13 May 2027. From then, you can also nominate another person to exercise your rights if you die or become unable to, and, after using our grievance process, complain to the Data Protection Board of India. Until then, our Grievance Officer handles grievances under the Information Technology Act, 2000 and the rules made under it, and resolves them within one month. • Singapore: under the Personal Data Protection Act 2012, you can ask for your personal data and for information about how it has been used or disclosed in the past year, ask us to correct it, and withdraw consent on reasonable notice — we will tell you the likely consequences. If we cannot respond to an access or correction request within 30 days, we will tell you in writing within that time when we will. You can complain to the Personal Data Protection Commission. • United Arab Emirates: under Federal Decree-Law No. 45 of 2021, you can also ask, free of charge, for information about how we process your data (including who receives it inside and outside the UAE, the safeguards for cross-border transfers and how long we keep it), receive your data in a structured, machine-readable form, ask us to correct, erase or restrict it, ask us to stop processing it (including for direct marketing), and object to decisions based only on automated processing that have legal effects on you or seriously affect you. You can complain to the UAE Data Office. • United Kingdom and Ireland: under the UK GDPR and the EU GDPR, you also have the rights to restriction, to data portability and to object to processing based on legitimate interests, and you can complain to the Information Commissioner's Office (UK) or the Data Protection Commission (Ireland). How to make a request: email info@groviaos.com from the email address linked to your account, or write to Webzworld, 1318, Navjivan Commercial Society, Lamington Road, Mumbai 400 008, India. Please tell us your name, the organisation whose Grovia account holds your data (if you know it), and what you would like us to do. We may need to confirm your identity first. We acknowledge requests within 5 working days and respond within 30 days. If we need longer, we tell you why within those 30 days and respond within a further 60 days where the law allows. If we cannot do what you ask, we will explain why and tell you how to complain. If your request is about Customer Data (Section 2), we will pass it to the Customer concerned and help them respond.

Grovia is a service for businesses, and you must be at least 18 to create an account. We do not knowingly collect children's personal data for our own purposes. If a Customer stores children's personal data in Grovia — for example student records — the Customer is responsible for getting any consent the law requires, including verifiable consent from a parent or guardian under Indian law, and must not use Grovia to track or monitor children's behaviour or to target advertising at them.

We send business contacts marketing emails about Grovia where the law allows it, and ask for consent where the law requires it. Every marketing email tells you how to opt out, and you can also opt out by emailing info@groviaos.com. If we send marketing messages or make marketing calls to a Singapore telephone number, we first check Singapore's Do Not Call registers where the law requires it. Opting out of marketing does not stop service messages about your account.

If you connect a Google account (for Gmail) or a Microsoft 365 account to Grovia, we access your email, labels, contacts and basic profile only with the permissions you approve on Google's or Microsoft's consent screen, and only to provide the email and ticket-inbox features you use: showing, sending and organising emails, and turning emails into support tickets. We do not use this data for advertising, do not sell it, and do not use it to develop or train general AI models. If your organisation uses AI features on tickets or emails, the relevant content may be sent to our AI provider to produce a response (Section 6). People at Grovia do not read this data unless you ask us to (for example for support), unless it is needed for security, or unless the law requires it. Grovia's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can disconnect an account at any time in Settings, or through your Google or Microsoft account settings.

Our website and Grovia may contain links to other websites. This Privacy Policy does not apply to those sites, and we are not responsible for their privacy practices or content. Please read the privacy policies of any website you visit.

We will update this policy when our practices or the law change, and show the date of the latest version at the top of this page. If a change is significant, we will tell account owners by email or in Grovia before it takes effect. If a change means we need your consent for something new, we will ask for it; we will not treat your continued use of Grovia as consent.

• Webzworld, 1318, Navjivan Commercial Society, Lamington Road, Mumbai 400 008, India • GSTIN: 27AHMPD3226G1ZK • Grievance Officer and data protection contact: Anirudh Yadav, info@groviaos.com • General enquiries: info@groviaos.com · https://groviaos.com/contact