Privacy

Who we are

Grouw is operated by Grouw Inc. ("Grouw", "we", "us"). This policy explains what personal information we collect through the Grouw app, the web-based earning flow you reach by scanning a merchant's QR code, and this website, and what we do with it.

This is a plain-language description of how the product actually handles data today. It is written from the engineering behaviour of the platform rather than adapted from a template, but it has not yet been reviewed by counsel for the specific markets Grouw operates in — see the notice at the top of this page.

What we collect

• Phone number: your primary identifier and how we authenticate you with a one-time code. Required to use Grouw.
• Display name: shown to businesses when you earn or redeem points.
• Secondary email (optional): if you add one for account recovery, it is encrypted at rest.
• Date of birth (optional): only if you choose to enable birthday offers — used to time those offers, nothing else.
• Profile photo (optional): shown on your account, deleted if you delete your account.
• Location (optional): only while granted, used to show you nearby participating businesses. Grouw does not track your location in the background.
• Transaction history: which businesses you earned or redeemed points with, and when — this is the core of how the rewards system works.
• Device and security information: the devices you've signed in from, and technical details (like IP address and device type) tied to sign-ins and security events, used to detect fraud and unauthorised access.

What we deliberately don't collect

Grouw is a points and rewards platform, not a payment system for customers — using the app to earn or redeem points never involves entering a card number or bank details, and we don't store any.

Businesses that use Grouw never see your phone number. They see your display name and your points activity with them specifically — not your contact details, and not your activity with any other business.

How we use it

• To operate the core service: tracking points, processing redemptions, and showing you your rewards card.
• To authenticate you and keep your account secure, including detecting fraudulent QR activity and unauthorised sign-in attempts.
• To show you nearby participating businesses, only when you've granted location access.
• To send offers you've opted into, like birthday rewards.
• To provide customer support when you contact us.
• To meet accounting, tax, and fraud-prevention obligations, for the retention periods described below.

Who we share information with

We use a small number of service providers to run Grouw, each with a narrow, specific role. We don't sell your information, and we don't share it for anyone else's advertising.

• Cloud infrastructure and messaging providers: host our systems and deliver one-time codes by SMS and email, and encrypt sensitive fields like your secondary email at rest.
• A payment processor: handles subscription billing for business accounts only. It does not process customer (points-earning) activity at all — customers never enter payment details anywhere in Grouw.
• Crash and error reporting tools: receive technical reports from the mobile app to help us fix bugs — this can include device and technical information, not your points activity.
• Courts, law enforcement, and government authorities: only when we receive a legally valid request, limited to what that request actually covers, and handled in line with the laws of the applicable jurisdiction.

How long we keep it

We keep different categories of information for different lengths of time, based on why we collected it:

• Your profile and account details: kept for as long as your account is active, removed or anonymised if you delete your account.
• Transaction records: kept for several years for accounting and dispute-resolution purposes, in line with standard financial record-keeping practice.
• Security logs: kept for a shorter, defined period specifically to support fraud detection and investigation.
• See our account deletion page for exactly what is removed versus retained when you delete your account.

Where your data is processed

Grouw processes data using our cloud provider's regional data centres, chosen to serve the markets we currently operate in. As Grouw expands, data may be processed in additional regions closer to where you use the service, with appropriate safeguards for any cross-border transfer — this policy will be updated to reflect that as it happens.

Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal information, or to object to certain uses of it. You can delete your account at any time — see our account deletion page for how that works and what it does.

For any other request about your data, the fastest route is the Help section in the app. Once legal review of this policy is complete, jurisdiction-specific rights and a dedicated privacy contact will be listed here.

Changes to this policy

We'll update the date at the top of this page whenever this policy changes, and for material changes, we'll let you know inside the app.