Privacy Policy

Gro is run by ER-Media LTD, 70 Scarva Street, Banbridge, BT32 3AD, United Kingdom ("Gro", "we", "us"). Gro is an email, SMS and subscriptions platform for Shopify stores (the "Services"). This policy explains what personal data we collect, why, who we share it with, how long we keep it and the controls you have. It covers our website usegro.co, the Gro app, and Gro when you use it inside AI assistants such as ChatGPT and Claude.

This policy applies to:

Visitors: people who visit our website.
Merchants: store owners and their team members who use Gro.
End customers: the shoppers and subscribers of stores that use Gro. For their data, the store is the data controller and we are its processor. The store's own privacy policy applies, and our Data Processing Agreement sets out how we handle it.

Information we collect

From merchants:

Account data: name, business email, phone number, store name and website, and your role on the team. Sign in is handled by our identity provider, so we never see or store your password.
Billing data: your plan and billing history. Payments are taken by Shopify Billing or Stripe. We never receive or store card numbers.
Content you create: email and SMS templates, campaigns, flows, segments, images and brand settings.
Support data: anything you send us when you ask for help or book a demo.
Usage and log data: IP address, browser and device type, pages and features used, and the time of each request. When an AI assistant connects to Gro, we log which action it asked for, whether it succeeded, the app it came from and when. We do not log the content of your conversation.

From a merchant's store, on the merchant's behalf:

Customer details: name, email, phone number, address, timezone and marketing consent status.
Orders and subscriptions: products bought, order history, subscription plans, delivery dates and preferences.
Engagement: email and SMS sends, opens and clicks, and visits to the store tracked by Gro, including IP address and the page viewed.

From website visitors: cookies and similar technologies, including the Meta Pixel and Google tag, which record page views and ad clicks. See Cookies and tracking technologies.

Data we never collect

We do not ask for, collect or store payment card data, health information, government identifiers such as national insurance or social security numbers, or passwords and other sign in secrets. Our AI connectors only ask for the details needed to do the task you request, such as a campaign or subscription ID. Please do not paste any of this kind of data into Gro or into an AI assistant connected to Gro.

How we use your information

To run the Services: send the emails and SMS you schedule, run subscriptions and billing, show reports, and carry out the actions you ask for in Gro or through a connected AI assistant.
To support you: answer questions and fix problems.
To keep Gro safe: prevent fraud, spam and abuse, check links in campaigns for safety, and keep our systems secure.
To improve Gro: understand which features are used so we can make them better.
To communicate with you: service notices, and product news if you have chosen to receive it.
To advertise Gro: measure our own ads on Meta and Google. This uses website cookies and, when a merchant signs up, a hashed (scrambled) copy of their email address.

We do not sell personal data. We do not use end customer data for our own marketing, and we do not use any data from your store or your AI conversations to train AI models.

We share personal data only with these categories of recipients, and only as needed for the purposes above:

Hosting and infrastructure: Amazon Web Services and Cloudflare (servers, databases, file storage, link tracking).
Analytics: Tinybird, which stores engagement and event data for your reports.
Email and SMS delivery: Amazon SES, SendGrid and Twilio.
Sign in: WorkOS, which manages merchant logins.
Payments: Shopify Billing and Stripe.
AI processing: Anthropic, through Cloudflare AI Gateway, which powers Gro AI inside the app.
Monitoring: Better Stack, which stores our server logs.
Advertising: Meta and Google, for measuring our own ads.
Services you connect: Shopify, Klaviyo, and AI assistants such as ChatGPT (OpenAI) and Claude (Anthropic). These receive only the data needed for the connection you set up.
Legal and business transfers: authorities when the law requires it, and a buyer if Gro is merged or sold.

For end customer data, we act as a processor under the GDPR, UK GDPR and CCPA, and only process it on the merchant's instructions. Our current list of sub-processors is available from privacy@usegro.co.

Data retention

Merchant account and store data: kept while your account is active. When you uninstall Gro, Shopify sends us a deletion request 48 hours later, and we delete your store's data within 30 days of that request. You can also ask us to delete it at any time.
End customer data: kept while the merchant uses Gro. When a merchant or Shopify asks us to remove a customer, we delete or anonymise their data within 30 days, unless it is still needed to run that customer's active subscription.
Billing records: kept for as long as tax and accounting law requires, normally six years in the UK.
Server logs: kept for up to 90 days.
Background job data: deleted automatically within 7 days.
Sign in sessions: the Gro app signs you out after 2 hours.
Gro AI chats in the app: saved only in your own browser until you clear them. We do not store them on our servers.
AI assistant conversations: we never receive them, so we do not keep them.

Your rights and controls

Depending on where you live, you can:

Get a copy of your personal data, or have it corrected.
Have your account and its data deleted.
Object to or limit how we use it.
Stop product news at any time with the unsubscribe link in any email.
Block or delete cookies in your browser settings.
Disconnect an AI assistant at any time from that assistant's settings, which stops its access straight away.
Uninstall Gro from Shopify, which starts deletion of your store's data as described above.

Email privacy@usegro.co to use any of these rights. We reply within 30 days. End customers should contact the store they bought from; we will help the store respond. You can also complain to your local data protection authority. In the UK, that is the Information Commissioner's Office.

AI assistants and connectors

Merchants can connect Gro to AI assistants such as ChatGPT and Claude. You sign in with your Gro login and approve the connection. The assistant can then read your Gro data and, when you ask, make changes for you, such as drafting a campaign or skipping a subscription order. Anything that sends a message or changes a customer's subscription is confirmed with you first.

What the assistant receives: only the data returned by the actions you ask for, from the one store you signed in to.
What we receive: the action requested and the details needed to carry it out, such as a template or subscription ID. We do not receive, store or use your conversations.
Records: changes made through an assistant are saved in your account's activity log under your name.
No training: we do not use data accessed through a connector to train AI models.
Control: you can disconnect at any time from the assistant's settings.

Data you share with an assistant is also handled under that provider's own privacy policy, such as OpenAI's or Anthropic's.

Cookies and tracking technologies

Our website uses cookies to keep it working and to measure our ads. We use the Meta Pixel and the Google tag to count page views and see which ads bring people to Gro. You can block or delete cookies in your browser settings; the site will still work.

International transfers

Some of our providers process data outside the UK and EU, including in the United States. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

Security

We encrypt data in transit, limit staff access to what is needed, and use providers with strong security practices. No system is completely secure, but we work to protect your data and will tell you promptly if a breach affects it.

Children

Gro is a business tool and is not meant for anyone under 16. We do not knowingly collect data from children.

Third-party links

Our website may link to other sites. Their own privacy policies apply, so please read them before sharing your details.

Updates to this policy

We may update this policy from time to time. We will change the effective date above, and tell merchants by email about any significant change.