Who we are
GROS ("GROS", "we", "us") helps businesses see revenue, advertising spend, attribution and tracking health in one place.
This policy covers two groups of people: our customers (the people who create a GROS account and workspace), and the visitors and buyers of our customers' websites whose activity our customers measure with GROS.
For data about their own visitors and buyers, our customer decides what is collected and why, and GROS processes that data on the customer's behalf. If you are a visitor or buyer of a business that uses GROS, that business's own privacy notice also applies, and it is usually the right first contact for your requests.
Information we collect
Account and workspace information:
- Your email address and authentication data, managed by our authentication provider. We do not store your password in readable form.
- Organization and workspace names, membership and roles.
- Display preferences such as language, theme, time zone and currency.
Business configuration that you enter: products, offers, prices, funnels, rules, saved views and integration settings.
Advertising data from ad platforms you connect: ad accounts, campaigns, ad sets, ads and their daily performance metrics such as spend, impressions, clicks and conversions reported by the platform.
Revenue data from payment and commerce providers you connect (for example Stripe, Hotmart, Kiwify, Perfect Pay, Shopify or WooCommerce): orders, amounts, currencies, refunds, chargebacks and subscription events. Where a provider sends a buyer's email address, GROS keeps a one-way hash of it to recognise returning buyers, rather than the address itself.
Website tracking data, collected by the GROS tracking script when a customer installs it on their site:
- A random first-party visitor identifier and session identifier, stored in the browser's local storage (not a cookie).
- Page views and the funnel events the customer sends, such as offer views, checkout starts and purchases.
- Page URL, landing page and referrer, UTM parameters, and advertising click identifiers (fbclid, gclid, ttclid) when they are present in the URL.
- The IP address of the request, used only in memory to limit abusive traffic.
Operational data: integration status and errors, synchronisation history, tracking health checks, audit records of security-relevant actions, and server logs. Logs are written so that they do not contain access tokens or secrets.
How we use information
- To provide GROS: authenticate you, show your revenue, spend, attribution, funnels and tracking health, and run the rules and notifications you configure.
- To connect and synchronise the integrations you authorise, and to tell you when one stops working.
- To keep GROS secure: rate limiting, abuse prevention, audit logs and incident investigation.
- To support you when you contact us, and to act on privacy and deletion requests.
- To maintain and improve the reliability of the service.
We do not sell personal information. We do not use your data, or data imported from your integrations, to advertise GROS or anyone else, and we do not share it with advertisers.
Legal bases
Where laws such as the GDPR or Brazil's LGPD require a legal basis, we rely on: performance of our contract with you (providing the service); our legitimate interests in operating a secure and reliable service; compliance with legal obligations; and your consent where we ask for it. For data our customers collect about their own visitors and buyers, the customer is responsible for having a legal basis and for any consent their site requires.
Meta Platform Data
When you connect a Meta ad account, you sign in with Meta and choose what to grant. GROS requests the ads_read permission only. It lets GROS read your ad accounts, campaigns and their performance metrics. GROS cannot create, edit, pause or pay for ads.
- GROS accesses only the data the permissions you granted allow.
- GROS uses that data only to provide analytics, attribution, reporting and related features inside your GROS workspace.
- GROS does not sell Meta data, does not use it for advertising, and does not use it for purposes unrelated to the service you connected it for.
- The access token Meta issues is stored encrypted and is never shown in the product or written to logs.
- You can revoke access at any time by disconnecting Meta in Settings → Integrations, or by removing GROS in your Facebook settings under Business Integrations. Either way, GROS deletes the stored token and stops synchronising.
- Advertising history already imported stays in your workspace as part of your reports until you ask us to delete it. To request deletion, see the Data Deletion page.
Google data
If you connect a Google Ads account, GROS reads campaign and performance data with the access you grant, and uses it only to provide reporting and attribution in your workspace. GROS's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can disconnect Google at any time in Settings → Integrations.
Third-party integrations
Connected platforms are operated by their own companies under their own terms and privacy policies. Disconnecting an integration in GROS stops GROS's access; it does not delete data held by that platform.
Cookies and local storage
The GROS application uses cookies that are needed to keep you signed in and to remember your display preferences. It does not use advertising cookies.
The GROS tracking script that customers install uses the browser's local storage, not cookies, for the visitor and session identifiers described above. Customers decide whether to ask their visitors for consent before enabling it, and the script can be configured not to run until consent is given.
Retention
We keep account and workspace data while the account is active. Data imported from integrations is kept while the workspace exists, so reports stay consistent over time, unless you ask us to delete it. Access tokens are deleted when you disconnect an integration. When we act on a deletion request we delete or anonymise the data in scope, except where we must keep a record to meet a legal obligation, resolve a dispute or prevent abuse.
Security
Data travels over HTTPS. Integration secrets and access tokens are encrypted at rest and scoped to the workspace they belong to. Access to workspace data is restricted by role and enforced in the database. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
International transfers
Our service providers may process data in countries other than the one you live in, which may have different data protection laws. You can ask us which countries and safeguards apply to your data.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to withdraw consent. You may also have the right to complain to a data protection authority.
To exercise these rights, see the Data Deletion page or contact us. We may need to verify that a request comes from the account holder. If you are a visitor or buyer of a business that uses GROS, please contact that business first; we will help them respond.
Children
GROS is a business tool and is not directed at children. Do not create an account if you are under 18.
Changes to this policy
We will update this page when our practices change and revise the date at the top. If a change materially affects how we use your data, we will tell account holders before it takes effect.
Contact
Use the request form on the Data Deletion page, or, if you can sign in, Settings → Privacy & data.