Effective Date: July 09, 2026
Last Updated: July 09, 2026

Groxx App LLC respects your privacy and is committed to handling personal information responsibly, transparently, and securely.

This Privacy Policy explains how Groxx App LLC collects, uses, stores, discloses, and otherwise processes personal information when you access or use:

• the Groxx mobile application;
• the Groxx website at groxx.app;
• Boss Mode onboarding;
• Groxx Brain;
• This Week;
• Red Flag;
• Play functionality;
• card-level AI chat;
• AI Crew;
• subscriptions, communications, support, and related Groxx services.

Together, these are referred to as the “Services.”

Please read this Privacy Policy carefully. It describes our current practices and may be updated as the Services, our providers, or applicable legal requirements change.

1. Who We Are

Groxx is operated by:
Groxx App LLC
Identification Number: 405870035
Georgia, Tbilisi, Vake District
8a Arakishvili Street
Floor 5, Apartment 29
Country of Georgia

Contact information:

• Privacy: [email protected]
• Legal: [email protected]
• Support: [email protected]
• Website: groxx.app

In this Privacy Policy, “Groxx,” “we,” “us,” and “our” mean Groxx App LLC.

For purposes of applicable privacy and data-protection laws, Groxx App LLC generally acts as the controller of personal information processed through the Services.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information processed by Groxx through the Services.

It does not govern the independent privacy practices of third parties that operate under their own privacy policies and terms, including Apple, Google, OpenAI, or third-party websites linked from Groxx.

Depending on the service and processing activity, third-party providers may act as:

• processors or service providers acting on our behalf;
• independent controllers responsible for their own processing;
• or a combination of these roles.

3. Age Requirement

Groxx is intended only for adults who are at least 18 years old.

We do not knowingly offer the Services to children or knowingly collect personal information from anyone under 18.

If you believe that a person under 18 has provided personal information to Groxx, contact us at [email protected]. We will take reasonable steps to investigate and delete the information where appropriate.

4. Information We Collect

The information we collect depends on how you access and use the Services.

4.1 Account and authentication information

We may collect:

• your name;
• email address;
• account identifiers;
• authentication method;
• account status;
• login and authentication records;
• communication preferences;
• information received through Sign in with Apple;
• information received through Google Sign-In;
• information associated with passwordless email authentication;
• one-time email codes, verification events, and related security information.

Groxx does not require a traditional account password. Users may authenticate through:

• Sign in with Apple;
• Google Sign-In;
• a one-time passwordless email code or link.

Apple and Google may separately process information related to authentication under their own privacy policies.

4.2 Boss Mode onboarding information

Boss Mode is the Groxx onboarding experience.
During Boss Mode, we may ask you to answer:

• structured or multiple-choice questions;
• open-ended questions;
• questions about your company, business circumstances, goals, priorities, resources, challenges, and risks.

Information collected through Boss Mode may include:

• your company or business name;
• your role or relationship to the business;
• business type and industry;
• business model;
• business stage;
• products or services;
• customer or market information;
• business goals;
• growth priorities;
• current challenges;
• operational information;
• marketing information;
• team and resource information;
• strategic priorities;
• business risks;
• financial ranges or business metrics you choose to provide;
• your answers to open-ended questions;
• other information about your business and its circumstances.

We may change, remove, or add onboarding questions as the Services develop.

4.3 Priority mode selection

During Boss Mode, you may select a priority mode that helps configure the emphasis and direction of recommendations provided through Groxx.

Current priority modes may include:

• More Cash Mode;
• Smooth Ops Mode;
• Need You Less Mode;
• Scale Up Mode;
• Profit Mode;
• Survival Mode.

We collect and use your selected mode as part of your business profile.

These mode names are product labels intended to help you communicate your current business priority. They are not:

• promises or guarantees;
• financial projections;
• professional diagnoses;
• representations that a specific outcome will occur;
• findings that your business is profitable, unprofitable, scalable, or at risk of failure.

Your selected mode may influence the focus of recommendations, but Groxx may also identify and present other areas that appear relevant based on the information available.

4.4 Business profile information

During your continued use of Groxx, we may collect or maintain information concerning:

• your business context;
• goals and priorities;
• challenges;
• products and services;
• operations;
• marketing;
• growth;
• resources;
• team structure;
• performance indicators;
• risks;
• changes to your business circumstances;
• interactions with recommendations;
• information you choose to add, update, or clarify.

Because some fields are open-ended, you may voluntarily provide information beyond what Groxx specifically requests.

4.5 This Week information and interactions

This Week currently presents up to four suggested weekly actions, priorities, or areas of focus.

To provide and personalize This Week, we may process:

• Boss Mode answers;
• your selected priority mode;
• your business profile;
• previous recommendations;
• relevant interactions within Groxx;
• the status of recommendation cards;
• whether you opened, viewed, played, or interacted with a card;
• questions or follow-up information provided in connection with a card.

The number, sequence, subject, and presentation of recommendations may change over time.

4.6 Red Flag information and interactions

Red Flag identifies potential business risks, warning signals, or areas that may require attention and may suggest possible actions for addressing or reducing those risks.

To provide and personalize Red Flag, we may process:

• Boss Mode answers;
• your selected priority mode;
• your business profile;
• relevant business context;
• previous recommendations;
• previous risk signals;
• your interactions with Red Flag cards;
• questions or follow-up information submitted within a card.

A Red Flag output is a potential risk signal, not a finding that harm will occur. The absence of a displayed Red Flag does not mean that no risk exists.

4.7 Play interactions

This Week and Red Flag cards may include a Play control.

When you select Play, we may process:

• the structured content of the relevant card;
• the underlying recommendation or risk signal;
• your Boss Mode information;
• your selected priority mode;
• relevant business profile information;
• relevant prior interactions;
• additional context you provide.

Play uses AI-powered processing to expand the card into more detailed, context-aware guidance.

The resulting content may include:

• explanations;
• suggested steps;
• examples;
• questions to consider;
• possible implementation approaches;
• additional context relating to the recommendation or potential risk.

4.8 Card-level AI chat

A This Week or Red Flag card may contain an AI-powered chat field that allows you to ask follow-up questions about that card.

We may collect and store:

• your questions and prompts;
• AI-generated responses;
• conversation history;
• relevant card information;
• relevant business context;
• technical and usage information relating to the interaction.

Responses in card-level AI chat may be generated substantially by third-party AI services.

The fact that a chat appears inside a Groxx Brain-supported card does not mean that every chat response has been independently validated by Groxx Brain or reviewed by a human.

4.9 AI Crew information

Groxx provides AI Crew, an AI-powered conversational feature that may include:

• Resource Crew;
• Growth Crew;
• Strategy Crew;
• Ops Crew;
• Marketing Crew.

These names identify software assistants and their intended areas of focus. They do not identify human employees, consultants, or licensed professionals.

When you use AI Crew, we may collect and process:

• prompts and messages;
• follow-up questions;
• conversation history;
• relevant business context;
• information from your Groxx profile;
• uploaded files and extracted content;
• AI-generated responses;
• technical information concerning the interaction.

4.10 User content and uploaded files

We may collect and store content you submit through Groxx, including:

• prompts;
• messages;
• business notes;
• open-ended onboarding answers;
• conversation history;
• instructions;
• feedback;
• documents;
• images;
• spreadsheets;
• presentations;
• other files;
• file names and metadata;
• content extracted from files;
• content generated through AI-powered features.

Because free-form fields, chats, and file uploads allow you to submit information of your choice, User Content may contain personal information about you or another person.

You must not provide personal information about another person unless you have the lawful right and any necessary permission to do so.

Do not submit:

• passwords;
• authentication codes;
• private cryptographic keys;
• complete payment-card information;
• bank-access credentials;
• government identification numbers;
• health or medical records;
• biometric information;
• information about children;
• highly sensitive personal information;
• confidential third-party information you are not authorized to disclose.

Groxx is not designed as a repository for regulated or highly sensitive personal data.

4.11 Device, technical, and usage information

When you access or use the Services, we may automatically collect:

• IP address;
• device type;
• operating system;
• application version;
• browser type;
• language and regional settings;
• approximate location inferred from IP address;
• application and device identifiers;
• session identifiers;
• push notification tokens;
• login timestamps;
• pages and screens viewed;
• features used;
• buttons and cards selected;
• recommendation and risk-card interactions;
• AI feature interactions;
• referral source;
• application events;
• network and connection information;
• security signals;
• performance information;
• crash and diagnostic information.

We use this information to operate, secure, analyze, troubleshoot, and improve the Services.

4.12 Analytics information

We currently use Google Analytics or related Google Analytics technology on the Groxx website and in the mobile application.

Depending on the actual configuration, analytics information may include:

• app and website interactions;
• session activity;
• screen and page views;
• feature usage;
• approximate geographic information;
• general device information;
• application instance or analytics identifiers;
• referral source;
• engagement information;
• performance events.

We do not intend to use Google Analytics for cross-context behavioral advertising.

Where consent is required for non-essential website analytics, we seek consent before activating those technologies.

Google states that Google Analytics does not log or store individual IP addresses from users in the EEA, United Kingdom, or Switzerland and provides controls for retention, deletion, and advertising personalization.

4.13 Communications information

If you contact us, we may collect:

• your name;
• email address;
• message content;
• support request details;
• attachments;
• correspondence history;
• technical information needed to investigate or respond to your request.

4.14 Subscription and transaction information

Paid Groxx subscriptions are purchased through the Apple App Store.

Groxx may receive limited transaction and entitlement information from Apple, including:

• subscription status;
• product or plan identifier;
• purchase date;
• renewal or expiration information;
• original transaction identifier;
• transaction identifier;
• entitlement status;
• storefront or country information;
• refund, cancellation, or revocation status.

Groxx does not receive or store:

• your complete payment-card number;
• your bank-account credentials;
• your Apple Account password.

Apple processes subscription payments, renewals, cancellations, and refund requests under Apple’s own terms and privacy practices.

4.15 Referral and affiliate information

If you use an affiliate or referral code, we may collect:

• the referral code;
• attribution source;
• installation or registration attribution;
• qualifying subscription or conversion information;
• aggregate performance information associated with the code.

Referral partners may receive aggregated information such as:

• attributed installations;
• qualifying subscriptions or conversions;
• commission-related totals.

We do not provide referral partners with individual users:

• names;
• email addresses;
• account profiles;
• private business information;
• AI conversations;
• uploaded files.

4.16 Marketing information

Where permitted, we may collect:

• marketing preferences;
• subscription and unsubscribe status;
• campaign source;
• message-delivery information;
• email engagement information, where enabled;
• links clicked in marketing communications.

Transactional emails, such as one-time login codes, security notices, account notices, and essential service communications, are separate from marketing communications.

5. Sources of Information

We collect information:

• directly from you;
• automatically from your device and use of the Services;
• from Apple when you use Sign in with Apple or purchase a subscription;
• from Google when you use Google Sign-In;
• from analytics, security, and infrastructure providers;
• from referral or attribution systems;
• from providers acting on our behalf;
• from communications you send to us.

6. How We Use Personal Information

We may use personal information for the purposes described below.

6.1 Create and manage your account

We may use information to:

• register and maintain your account;
• authenticate you;
• send one-time login codes;
• maintain account security;
• manage sessions;
• recognize subscription entitlements;
• communicate account-related information.

6.2 Complete Boss Mode and maintain your business profile

We may use information to:

• present relevant onboarding questions;
• record structured and open-ended answers;
• create and maintain your business profile;
• record your selected priority mode;
• understand your stated circumstances, goals, and priorities;
• personalize the Services.

6.3 Operate Groxx Brain

Groxx Brain is Groxx’s proprietary internal decision-support system.

Groxx Brain applies Groxx-developed business frameworks, structured analytical methods, rules, algorithms, and know-how to information made available through the Services.

We may use personal and business information through Groxx Brain to:

• identify and prioritize areas that may require attention;
• generate and prioritize the structured foundation for recommendations displayed in This Week;
• identify potential risks or warning signals displayed in Red Flag;
• suggest possible actions for addressing or reducing risks;
• adapt the direction and emphasis of recommendations based on your selected priority mode;
• maintain continuity between recommendations, risk signals, and the business context you provide;
• improve the relevance of your Groxx experience.

Groxx Brain does not:

• operate your business;
• execute recommendations;
• independently verify all information you provide;
• make legally binding decisions on your behalf;
• make decisions intended to produce legal or similarly significant effects about you;
• guarantee any business outcome.

The internal source code, scoring, weighting, decision rules, prompts, methodologies, models, architecture, and other confidential elements of Groxx Brain are proprietary to Groxx and are not disclosed through the Services or this Privacy Policy.

6.4 Provide This Week

We may process your information to:

• generate and prioritize up to four weekly recommendations;
• personalize the subject and emphasis of recommendations;
• display recommendations in the applicable order;
• maintain recommendation continuity;
• respond to your interactions with recommendation cards;
• adapt future content based on updated business information.

6.5 Provide Red Flag

We may process your information to:

• identify potential business risks or warning signals;
• prioritize potential areas requiring attention;
• suggest ways to monitor, reduce, or address a potential risk;
• connect risk-related guidance to the context you provided;
• respond to your interactions with Red Flag cards.

Red Flag is not a complete risk assessment, audit, legal analysis, financial analysis, cybersecurity assessment, or insurance opinion.

6.6 Provide Play and card-level AI chat

When you select Play or use the AI chat inside a card, we may use:

• relevant card content;
• the underlying structured recommendation or risk signal;
• relevant Boss Mode answers;
• your selected priority mode;
• relevant business profile information;
• relevant conversation history;
• the question or instruction you submit.

We use this information to:

• expand a recommendation or potential risk;
• tailor guidance to the context made available about your company;
• generate explanations, examples, and suggested steps;
• answer follow-up questions;
• maintain conversation continuity.

6.7 Provide AI Crew

We may process relevant information to:

• generate conversational responses;
• tailor responses to your business context;
• respond from the functional perspective of the selected AI Crew assistant;
• process uploaded content;
• maintain conversation history;
• answer follow-up questions.

AI Crew assistants are automated software interfaces and are not human or licensed professional advisers.

6.8 Use third-party generative AI

We use third-party generative AI services, including the OpenAI API, to support certain functionality.

Depending on the feature, generative AI may be used to:

• tailor structured Groxx Brain material to your company context;
• convert structured material into clear natural language;
• explain or expand recommendations;
• expand This Week and Red Flag cards after you select Play;
• answer card-level follow-up questions;
• provide AI Crew conversations;
• process prompts and uploaded content;
• organize and improve the readability of responses.

The relative roles of Groxx Brain and generative AI vary by feature.

For example:

• the structured foundation for This Week and Red Flag may be generated or prioritized through Groxx Brain;
• generative AI may tailor, explain, format, or expand that material;
• AI Crew responses and certain follow-up responses may be generated substantially through generative AI.

6.9 Maintain conversation history

We may store AI Crew and card-level chat history in order to:

• display previous conversations;
• maintain conversational continuity;
• allow you to return to prior interactions;
• provide contextually relevant follow-up responses;
• maintain account functionality.

6.10 Operate, secure, and troubleshoot the Services

We may use information to:

• maintain technical functionality;
• authenticate users;
• protect accounts;
• detect suspicious activity;
• prevent fraud and misuse;
• enforce usage limits;
• investigate security incidents;
• diagnose failures;
• maintain system availability;
• protect Groxx, users, and third parties.

6.11 Analyze and improve the Services

We may use information to:

• understand how features are used;
• measure performance;
• identify technical issues;
• improve reliability;
• evaluate user experience;
• develop or improve features;
• assess aggregate product trends;
• improve the presentation and operation of the Services.

We may use aggregated or de-identified information where it no longer reasonably identifies an individual.

Groxx does not use private business information, private AI conversations, or uploaded files to train generally available Groxx machine-learning models.

6.12 Communicate with you

We may send:

• authentication emails;
• one-time login codes;
• security notices;
• account notices;
• subscription information;
• service and product communications;
• push notifications;
• support responses;
• marketing communications where permitted.

You may unsubscribe from marketing communications using the unsubscribe control included in those messages.

You may continue to receive essential transactional, account, security, or legal communications.

6.13 Comply with law and protect legal rights

We may process information to:

• comply with applicable law;
• respond to lawful requests;
• maintain required business records;
• establish, exercise, or defend legal claims;
• investigate unlawful activity;
• enforce our agreements;
• protect the rights and safety of Groxx, users, or third parties.

7. Legal Bases for Processing in the EEA, United Kingdom, and Switzerland

Where European data-protection law applies, we rely on one or more of the following legal bases.

7.1 Performance of a contract

We process information where necessary to:

• create and manage your account;
• authenticate you;
• complete Boss Mode;
• maintain your business profile;
• provide Groxx Brain functionality;
• provide This Week and Red Flag;
• process Play requests;
• provide card-level AI chat and AI Crew;
• maintain conversation history;
• manage paid access;
• respond to support requests;
• otherwise perform our agreement with you.

7.2 Legitimate interests

We may process information based on legitimate interests such as:

• securing the Services;
• preventing fraud, abuse, and unauthorized access;
• maintaining reliability and performance;
• understanding feature usage;
• improving the Services;
• protecting legal rights;
• maintaining reasonable business and technical records.

Before relying on legitimate interests, we consider the nature of the information, the expected benefit, and the potential effect on users.

7.3 Consent

We rely on consent where required, including for:

• non-essential website analytics;
• certain marketing communications;
• optional push notifications;
• other optional processing where consent is required by applicable law.

You may withdraw consent at any time.

Withdrawal does not affect processing that was lawfully carried out before withdrawal.

7.4 Legal obligations

We may process information where necessary to comply with applicable legal, tax, accounting, regulatory, judicial, or law-enforcement obligations.

7.5 Protection of rights and vital interests

In limited circumstances, we may process information to protect the rights, safety, or vital interests of a user or another person.

8. AI Processing and OpenAI

Groxx currently uses OpenAI API services to support certain AI-powered features.

Depending on the feature, information processed through OpenAI may include:

• structured recommendations or potential risk signals;
• relevant business context;
• user prompts;
• card content;
• conversation history;
• uploaded files or extracted file content;
• system instructions;
• AI-generated responses.

Groxx is designed to exclude direct account identifiers, such as your email address and internal account identifier, from standard OpenAI API requests where those identifiers are not required.

However, users may voluntarily include identifying, personal, confidential, or third-party information in:

• open-ended Boss Mode answers;
• prompts;
• chat messages;
• uploaded files;
• other free-form content.

Such information may be included in content processed through OpenAI when necessary to respond to the relevant request.

Groxx has disabled voluntary sharing of API inputs and outputs for model improvement.

OpenAI states that business and API data is not used to train its models by default unless the customer affirmatively opts in.

Under the current configuration, OpenAI may temporarily retain certain API input, output, and related data for security, service operation, or abuse-monitoring purposes, depending on the endpoint and feature used.

Groxx has disabled API call logging in its OpenAI organization settings. This does not necessarily eliminate all temporary provider-side security or abuse-monitoring retention.

9. Automated Recommendations and AI Transparency

Groxx uses automated systems to generate:

• suggested business actions;
• weekly priorities;
• potential risk signals;
• explanations;
• implementation suggestions;
• conversational responses;
• other decision-support content.

When you use AI Crew, Play, card-level AI chat, or another feature identified as AI-powered, you are interacting with automated software rather than a human.

Automated outputs:

• may be incomplete or inaccurate;
• depend on the information available;
• may contain assumptions;
• do not constitute a guarantee;
• do not replace independent professional judgment;
• do not make legally binding decisions about you.

You remain responsible for reviewing and deciding whether to act on a recommendation or response.
Additional information is available in the Groxx AI Disclaimer.

10. No Training on Private User Content

Groxx does not use your private:

• business profile;
• Boss Mode answers;
• AI conversations;
• prompts;
• uploaded files;
• This Week content;
• Red Flag content

to train generally available Groxx machine-learning models.

We may use aggregated, statistical, technical, or de-identified information that no longer reasonably identifies you to:

• measure performance;
• understand feature use;
• improve reliability;
• detect errors;
• prevent fraud or abuse;
• plan and develop the Services.

We may also use feedback that you intentionally provide to us, subject to this Privacy Policy.

11. Human Access and Review

Groxx does not routinely conduct manual review of private AI conversations or private business content.

Authorized personnel may access limited information where reasonably necessary to:

• respond to your support request;
• investigate suspected abuse or fraud;
• resolve a technical issue;
• protect account or service security;
• comply with law;
• enforce agreements;
• establish, exercise, or defend legal rights.

Access is intended to be limited to persons with an appropriate business or technical need.

The fact that limited authorized access may occur does not mean that a human adviser has reviewed or approved a recommendation.

12. How We Disclose Personal Information

We may disclose personal information to the categories of recipients described below.

12.1 Infrastructure, database, and hosting providers

We use Supabase for services that may include:

• database hosting;
• authentication;
• file storage;
• server-side and edge functions;
• logs;
• backend infrastructure.

Our primary Supabase project is hosted in the United States in the:

AWS US West (Oregon), us-west-2 region
Supabase and its underlying infrastructure providers may process information on our behalf in order to provide these services.

12.2 Artificial intelligence providers

We may disclose relevant information to OpenAI where necessary to provide:

• recommendation tailoring;
• Play;
• card-level AI chat;
• AI Crew;
• file processing;
• other AI-powered functionality.

12.3 Authentication providers

Apple and Google may process account and authentication information when you use their sign-in services.

12.4 Analytics providers

We may disclose device, usage, and interaction information to Google Analytics or related Google analytics services to understand and improve use of the Services.

12.5 Apple App Store

Apple processes:

• subscription purchases;
• payments;
• automatic renewals;
• cancellations;
• refund requests.

We receive only limited transaction and entitlement information needed to administer access.

12.6 Email and communication providers

We may use infrastructure and delivery providers to send:

• passwordless login emails;
• one-time authentication codes;
• security notices;
• account messages;
• support messages;
• product communications;
• marketing communications.

12.7 Referral attribution providers and partners

We may process referral codes and aggregate attribution information to:

• identify attributed installations or registrations;
• identify qualifying subscriptions;
• calculate referral or affiliate performance;
• administer commissions.

Referral partners receive aggregate attribution information and not individually identifiable private user profiles.

12.8 Professional advisers

We may disclose information where reasonably necessary to:

• lawyers;
• accountants;
• auditors;
• insurers;
• security professionals;
• other professional advisers.

12.9 Legal, regulatory, and safety recipients

We may disclose information where we reasonably believe disclosure is necessary to:

• comply with applicable law or legal process;
• respond to a lawful governmental request;
• protect a user or another person;
• investigate fraud, misuse, or a security event;
• enforce our agreements;
• protect Groxx’s rights, property, or safety.

12.10 Corporate transactions

If Groxx is involved in a:

• financing;
• merger;
• acquisition;
• corporate reorganization;
• sale of assets;
• insolvency proceeding;
• similar transaction,

information may be disclosed or transferred as part of that transaction, subject to appropriate confidentiality and legal protections.

12.11 At your direction or with your consent

We may disclose information where you direct us to do so or provide valid consent.

13. No Sale or Behavioral Advertising Sharing

Groxx does not sell personal information for monetary consideration.

Groxx does not share personal information for cross-context behavioral advertising as those terms are defined under applicable California privacy law.

We do not provide affiliate or referral partners with:

• personally identifiable user profiles;
• private business information;
• prompts;
• AI conversations;
• uploaded files.

We do not intend to use Google Analytics for targeted advertising.

If our practices materially change, we will update this Privacy Policy and provide any choices required by applicable law.

14. Cookies and Similar Technologies

The Groxx website may use cookies, software development kits, pixels, local storage, and similar technologies.

14.1 Strictly necessary technologies

These technologies may be used for:

• security;
• network management;
• session management;
• authentication;
• fraud prevention;
• remembering privacy preferences.

14.2 Analytics technologies

We use Google Analytics to understand website activity and improve the Services.

Where required by law, non-essential analytics are activated only after the user provides consent.

You may manage your choices through the cookie or privacy controls presented on the website.
Further information is available in the Groxx Cookie Notice.

15. Push Notifications

With your device permission, Groxx may send push notifications concerning:

• weekly recommendations;
• This Week;
• Red Flag;
• account activity;
• product reminders;
• service updates;
• other Groxx functionality.

You may disable push notifications through your device settings.

Disabling push notifications does not prevent us from sending necessary account, authentication, security, legal, or subscription communications by email.

16. Marketing Communications

Where permitted, Groxx may send communications about:

• product updates;
• new features;
• business content;
• offers;
• events;
• Groxx-related news.

You may unsubscribe using the unsubscribe control included in the communication or by contacting [email protected].

We may retain limited information in a suppression list so that we can continue to honor your unsubscribe request.

17. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining security, complying with law, and resolving disputes.

Retention depends on:

• the category of information;
• the purpose of processing;
• the status of the account;
• security requirements;
• applicable legal obligations.

European data-protection principles require organizations to retain personal data no longer than necessary and to establish periods for deletion or review.

17.1 Account, Boss Mode, and business profile information

We generally retain account, Boss Mode, priority-mode, and business-profile information while your account remains active.

Following a valid account-deletion request, we ordinarily delete or de-identify this information from active production systems within 30 days, unless continued retention is required or permitted by law.

17.2 This Week and Red Flag information

We may retain recommendations, risk signals, card status, and related interactions while your account is active in order to:

• display relevant content;
• maintain product continuity;
• support your account;
• improve the operation and reliability of the Services.

Following account deletion, we ordinarily delete or de-identify this information within 30 days, subject to limited legal, security, and backup exceptions.

17.3 AI conversations and user content

AI Crew conversations, card-level chats, prompts, and uploaded content may be retained while your account is active so that we can provide:

• conversation history;
• continuity;
• related functionality;
• account access.

Following account deletion, we ordinarily delete or de-identify this information from active systems within 30 days, subject to limited legal, security, fraud-prevention, and backup exceptions.

17.4 OpenAI processing

Under the current configuration, OpenAI may temporarily retain certain API information for service operation, security, or abuse monitoring, subject to the provider’s endpoint-specific rules and applicable legal requirements.

17.5 Analytics information

Google Analytics information is retained in accordance with our configured Google Analytics retention settings.

We seek to limit user-level analytics retention to a period reasonably necessary for product analysis, security, and service improvement.

17.6 Authentication, technical, and security records

Authentication, security, fraud-prevention, and technical records may be retained for a reasonable period necessary to:

• maintain account and service security;
• investigate incidents;
• prevent abuse;
• establish or defend legal rights;
• comply with legal obligations.

17.7 Transaction and legal records

Certain subscription, transaction, accounting, tax, consent, dispute, fraud-prevention, or legal records may be retained for longer periods where required or reasonably necessary under applicable law.

17.8 Backups

Residual copies may remain in backups, if maintained, until they are overwritten through the normal backup-rotation process.

Backup copies:

• are not used for ordinary business operations;
• are subject to access restrictions;
• may be restored where reasonably necessary for disaster recovery, security, or legal compliance.

Where data is restored from a backup, we will take reasonable steps to ensure that previously processed deletion requests remain respected.

18. Account and Data Deletion

You may initiate deletion of your Groxx account from within the mobile application.

You may also contact [email protected] for assistance.

Account deletion generally includes:

• closing your Groxx account;
• ending active sessions;
• deleting or de-identifying account information;
• deleting or de-identifying Boss Mode information;
• deleting or de-identifying your business profile;
• deleting or de-identifying This Week and Red Flag information;
• deleting or de-identifying AI conversation history;
• deleting or de-identifying uploaded content;
• revoking Sign in with Apple credentials where applicable;
• removing information that Groxx is not legally required or permitted to retain.

We ordinarily complete deletion from active production systems within 30 days after verifying and processing the request.

Limited information may be retained where reasonably necessary to:

• comply with law;
• maintain tax, accounting, or transaction records;
• prevent fraud;
• investigate security incidents;
• resolve disputes;
• enforce agreements;
• demonstrate compliance;
• protect legal rights.

Apple requires apps that support account creation to allow users to initiate account deletion from within the app. Where Sign in with Apple is used, the associated user token must also be revoked during deletion.

Subscription cancellation is separate

Deleting your Groxx account may not automatically cancel an active Apple App Store subscription.

To prevent future renewal charges, you must separately cancel the subscription through your Apple Account subscription settings.

Further information is available on the Groxx Data Deletion page.

19. Security

Groxx uses administrative, organizational, and technical safeguards designed to protect personal information.

Depending on the system and context, these safeguards may include:

• authentication controls;
• access controls;
• role-based or restricted administrative access;
• encrypted network connections;
• service-provider security controls;
• monitoring and logging;
• data minimization;
• key-management practices;
• incident-response procedures.

No online service, database, or transmission method can be guaranteed to be completely secure.

We cannot guarantee that information will never be:

• accessed without authorization;
• disclosed;
• altered;
• lost;
• destroyed.

You are responsible for maintaining the security of:

• your email account;
• Apple Account;
• Google Account;
• devices;
• authentication methods.

Contact [email protected] promptly if you suspect unauthorized access to your Groxx account.

20. International Data Transfers

Groxx App LLC is established in the country of Georgia.

The Services use providers and infrastructure located in the United States and potentially other countries.

Your information may therefore be processed in countries with privacy and data-protection laws different from those of your country of residence.
For example:

• our primary Supabase infrastructure is hosted in Oregon, United States;
• OpenAI may process information through infrastructure covered by its applicable business and API arrangements;
• Google and Apple may process information through global infrastructure;
• authorized Groxx personnel may access systems from the country of Georgia or another authorized location.

Where required by applicable law, we use appropriate safeguards for international transfers, which may include:

• data-processing agreements;
• contractual data-protection obligations;
• European Commission Standard Contractual Clauses;
• supplementary technical and organizational measures;
• an applicable adequacy decision;
• another legally recognized transfer mechanism.

The GDPR’s protections continue to apply when covered personal data is transferred outside the EEA, and the European Commission recognizes mechanisms including adequacy decisions and Standard Contractual Clauses for such transfers.

You may contact [email protected] for further information about relevant safeguards.

21. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• request access to personal information;
• receive a copy of personal information;
• request correction of inaccurate information;
• request deletion;
• request restriction of processing;
• object to certain processing;
• withdraw consent;
• request data portability;
• opt out of marketing;
• appeal certain decisions where applicable;
• complain to a privacy or data-protection authority.

These rights may be subject to legal limitations and exceptions.

To submit a request, contact:
[email protected]

We may need to verify your identity before completing a request.

Information provided for verification will be used only to process and protect the request.

Where applicable, an authorized agent may submit a request on your behalf. We may require evidence of the agent’s authority and direct verification with you.

We will not unlawfully discriminate against you for exercising an applicable privacy right.

22. EEA, UK, and Swiss Privacy Rights

If you are located in the European Economic Area, United Kingdom, or Switzerland, you may have the right to:

• access your personal data;
• correct inaccurate personal data;
• request erasure;
• restrict processing;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• receive portable data where applicable;
• withdraw consent;
• lodge a complaint with a competent supervisory authority.

Where processing is based on consent, withdrawal does not affect processing carried out lawfully before the withdrawal.

Where processing is based on legitimate interests, you may object based on your particular situation.
Groxx does not intend to subject users to solely automated decisions that produce legal or similarly significant effects.

You may contact us first at [email protected], but you are not required to contact Groxx before complaining to a supervisory authority.

23. California and Other U.S. State Privacy Rights

To the extent applicable, residents of California and certain other U.S. states may have rights to:

• know what personal information is collected;
• know the sources and purposes of collection;
• know the categories of recipients;
• access personal information;
• request deletion;
• request correction;
• obtain a portable copy;
• opt out of sale;
• opt out of certain sharing or targeted advertising;
• limit certain uses of sensitive personal information;
• appeal certain privacy-request decisions;
• receive equal service when exercising privacy rights.

Groxx does not sell personal information and does not share it for cross-context behavioral advertising.

23.1 Categories collected

Depending on how a person uses the Services, Groxx may collect the following categories:

• identifiers;
• account and authentication information;
• customer-record information;
• commercial and subscription information;
• internet or electronic-network activity;
• approximate geolocation information;
• professional or employment-related information;
• business information;
• user-generated content;
• inferences derived from information provided;
• sensitive personal information that a user voluntarily submits through open-ended content.

23.2 Sensitive personal information

Groxx does not request that users submit highly sensitive personal information through open-ended fields, AI chats, or file uploads.

We do not use or disclose sensitive personal information for the purpose of inferring personal characteristics.

Account login and authentication data may be processed as necessary to provide and secure the Services.

23.3 Purposes of collection and disclosure

We may process and disclose relevant categories for:

• providing the Services;
• authentication;
• personalization;
• AI processing;
• security;
• analytics;
• support;
• subscription management;
• referral attribution;
• legal compliance;
• internal operations.

23.4 Categories of recipients

Applicable categories may be disclosed to:

• hosting and infrastructure providers;
• AI providers;
• analytics providers;
• authentication providers;
• Apple;
• email and communication providers;
• professional advisers;
• legal or governmental recipients where required;
• corporate transaction recipients.

We do not knowingly sell or share personal information of users under 18.

24. Global Privacy Control and Do Not Track

Groxx does not sell personal information or share it for cross-context behavioral advertising.

Where legally required and technically applicable, we will seek to recognize valid browser-based privacy preference signals, such as Global Privacy Control.

Some browsers provide a “Do Not Track” setting.
Because there is no uniform industry standard for all Do Not Track signals, the Services may not respond to every such signal.

25. Data Processing on Behalf of a Business

Groxx is primarily designed for users to provide information about their own businesses.

If you submit personal information on behalf of a company or another organization, you are responsible for ensuring that:

• you are authorized to provide the information;
• an appropriate lawful basis exists;
• any required privacy notices have been provided;
• any required consent has been obtained;
• only information reasonably necessary for the relevant purpose is submitted.

Unless Groxx enters into a separate written agreement expressly stating otherwise, Groxx does not agree through these consumer-facing terms to act as a specialized processor for regulated categories of third-party personal data.

26. Third-Party Links and Independent Services

The Services may contain links to third-party websites or services.

Groxx does not control and is not responsible for the privacy, security, content, or practices of third parties acting independently of Groxx.

Review a third party’s privacy terms before providing information directly to that party.

27. Product and Feature Names

Names used in the Groxx interface—including:

• Boss Mode;
• More Cash Mode;
• Smooth Ops Mode;
• Need You Less Mode;
• Scale Up Mode;
• Profit Mode;
• Survival Mode;
• This Week;
• Red Flag;
• Play;
• AI Crew;
• Resource Crew;
• Growth Crew;
• Strategy Crew;
• Ops Crew;
• Marketing Crew

are product labels used for navigation, categorization, and the product experience.

Unless expressly stated otherwise, such names are not:

• promises;
• guarantees;
• professional conclusions;
• financial forecasts;
• diagnoses;
• warranties;
• representations that a particular result will occur.

28. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• changes to the Services;
• new or modified features;
• changes to Groxx Brain;
• changes to AI providers or configurations;
• changes to analytics or infrastructure providers;
• legal or regulatory developments;
• security or operational requirements.

We will post the updated version at groxx.app/privacy-policy and revise the “Last Updated” date.

Where required by applicable law, we will provide additional notice through:

• the application;
• email;
• the website;
• another appropriate method.

Material changes will apply prospectively unless applicable law permits otherwise.

29. Contact Us

For privacy questions, concerns, complaints, or requests, contact:

Groxx App LLC
Identification Number: 405870035
Georgia, Tbilisi, Vake District
8a Arakishvili Street
Floor 5, Apartment 29
Country of Georgia

Privacy: [email protected]
Legal: [email protected]
Support: [email protected]
Website: groxx.app

Privacy

policy