Privacy Policy

For the people who use Grova (business owners and their teams), we decide how your personal data is used, so we are the data user.

For a business’s own customers — people who fill in a form, chat or buy through a page or tool Grova runs for that business — the business is the data user and Grova processes the data on its behalf. Those customers should contact the business first; we will help it respond.

• Account details: your name, email address, mobile or WhatsApp number, language, sign-in times and security settings. Your password is stored only as a secure hash, and 2-step login secrets are encrypted.
• Business details: company and brand names, industry, location, website, products, prices, costs, stock, photos, brand assets, your answers to the AI interview, and your deal and agreement.
• Marketing and sales records: pages, posts and pictures, connected ad and social accounts and their results, and the orders you record, which may include your customers’ names, phone numbers and email addresses.
• Messages: support requests and screenshots, emails with us, and WhatsApp conversations if you connect WhatsApp Business.
• Technical details: IP address (used for security and to limit abuse), browser and device type, error reports, and the cookies described below.
• Visitors to pages Grova runs for a business: what they choose to submit (name, phone, email, message and their consent), which page, post or ad brought them (campaign tags and ad click identifiers), a random visitor number and a reference code.
• Public information about your business that we read from your website when you sign up.

• To provide the Service: understand your business, build and publish marketing you approve, run advertising within your limits, and answer your support requests.
• To trace sales back to the marketing that brought them, and to calculate and invoice commission under your agreement.
• To send you the messages the Service needs: sign-in and confirmation codes, security alerts, approvals, statements and support replies.
• To keep the Service and your account secure, and to prevent fraud and abuse.
• To improve the Service, using aggregated and anonymised information that does not identify you or your customers.
• To meet our legal obligations.

We do not sell personal data. We do not send you promotional email without your agreement, and you can opt out at any time.

To draft plans, pages, posts, replies and pictures, we send the business information needed for each task to AI providers: currently Anthropic, and OpenAI for AI pictures when that feature is on. Under their business terms, data sent through their services is not used to train their models.

In Approval Mode, a person approves each AI draft before it is used; in Autopilot Mode, Grova acts only within limits the business has approved. Decisions about money — commission, attribution and advertising limits — are fixed calculations, not AI decisions.

Only as needed to provide the Service:

• Hosting: DigitalOcean (our servers).
• Email delivery: Resend.
• AI: Anthropic, and OpenAI when AI pictures are on.
• Platforms you connect: Google, Meta (Facebook, Instagram and WhatsApp), TikTok, social posting services and payment providers, as you choose.
• Meta, when Grova advertises a business on Facebook or Instagram from Grova’s own accounts: the ads and their results, and — only if a visitor allows it on that business’s page — the visit and enquiry events described under Cookies.
• Your own team, according to the roles you give them.
• Professional advisers, and authorities when the law requires it.
• A buyer or successor if our business is sold or merged, under the same protections.

We never share one business’s data with another business.

Our servers are in the United States (DigitalOcean, New York), and several of our providers are based in the United States. When personal data leaves Malaysia, we take the steps the Personal Data Protection Act requires to keep it protected to a comparable standard, including contracts and security measures with our providers.

• Account and business data: while your account is open. When you ask us to close it (through Get help or WhatsApp), we delete or anonymise it within 90 days, except records the law requires us to keep.
• Commission, statement and payment records: 7 years, as Malaysian tax and company law requires.
• Data we process for a business about its customers: for as long as the business uses Grova. It is deleted when the business closes its account, or earlier if the business asks us.
• Backups: one copy each day; the 14 most recent are kept and older copies are deleted.

• Grova_session: keeps you signed in (up to 30 days). Essential.
• Grova_2fa: holds a 2-step sign-in for up to 10 minutes. Essential.
• Gv_lang: remembers whether you chose English or Chinese.
• Gv_m and gv_t: remember which homepage message and colour you last saw, so the next visit is different.
• On pages Grova runs for a business: a random visitor number (grv_vid) and campaign tags (grv_attr) stored in the browser, so an enquiry can be traced to the ad or post that brought it.
• Also on those pages, only if the visitor clicks Allow: the Meta pixel (Meta’s _fbp cookie), which tells Meta about the visit, an enquiry or a WhatsApp tap so the business’s ads can be measured. The choice is remembered in the browser (grv_mc). Visitors who choose No thanks are not measured by Meta.

Grova’s own pages (the home page, sign-in and the app) use no third-party advertising cookies. You can clear cookies in your browser, but you will need to sign in again.

We use encrypted connections, hashed passwords, encryption for sensitive secrets, strict separation between businesses’ data, role-based access, audit logs of important actions, and daily backups. Only staff who need access to support you or run the Service can see your data.

If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the people affected as the law requires.

You can ask to see the personal data we hold about you, correct it, withdraw consent, limit how it is used (including for direct marketing), and, where the law provides, receive a copy of it to move to another service. Most details can be changed directly in your Account page. How to have your data deleted, including data Grova received through Meta, is explained at grova.work/data-deletion.

For anything else, contact us on WhatsApp +60 17-387 1472. We may need to confirm your identity, and we will reply within 21 days as the law requires. If you are not satisfied, you may complain to the Personal Data Protection Commissioner.

If you are outside Malaysia, you may have further rights under your own country’s law; see the next section.

Grova serves businesses in several countries. If you, your team or your customers are outside Malaysia, the data protection law of that country may also apply. Where it gives you more protection than this policy describes, we follow it.

Where a law asks us to state our legal basis for using personal data (for example the UK GDPR), we rely on:

• Performing our contract with you, to provide the Service you signed up for;
• Our legitimate interests in running, securing and improving the Service and communicating with business customers, balanced against your rights;
• Complying with our legal obligations, such as keeping tax records;
• Your consent, where the law requires it, for example for optional marketing emails. You can withdraw consent at any time.

Depending on where you are, you may have the right to access, correct or delete your personal data, restrict or object to how we use it (including for direct marketing), receive a copy to move to another service, and withdraw consent. Grova does not make decisions about individuals based solely on automated processing that have legal or similarly significant effects on them.

Your data is stored in the United States and handled by the providers listed above. When the law of your country requires safeguards for sending data abroad, we use them — for example standard contractual clauses approved for the EU or UK, the ASEAN Model Contractual Clauses, or equivalent contract terms — together with the security measures described in this policy.

We will answer requests within the time your local law sets, or within 21 days if that is sooner. You can also complain to the data protection authority where you live, such as Singapore’s Personal Data Protection Commission, Thailand’s Personal Data Protection Committee, the Philippines’ National Privacy Commission, the Office of the Australian Information Commissioner, or the UK Information Commissioner’s Office.

If a business uses Grova to handle its own customers’ data outside Malaysia, that business remains responsible for following its local law, and Grova processes the data on its instructions. We will sign a data processing agreement on request. Where a law requires us to appoint a local representative, we will do so and list their details here.

Your name, email, mobile number, password and basic business details are needed to provide the Service; without them we cannot open an account. Fields marked optional are up to you.

Grova is for businesses and is not meant for anyone under 18. We do not knowingly collect children’s personal data.

We will update this policy when how we handle personal data changes, and tell you in the Service or by email before a significant change takes effect.

NINE FISHERY SDN BHD (1525415-W), Unit 2-1, Level 2, The Podium, Tower 3, UOA Business Park 1, Jalan Pengaturcara, Seksyen, U1/51a, 40150 Shah Alam, Selangor, Malaysia. WhatsApp +60 17-387 1472.