Privacy Policy

If you embed Groager's tracking snippet on your own website, it collects the following about your website's visitors, on your behalf, so we can generate your analytics dashboard:

If you are a visitor to a website that uses Groager's tracking snippet and have questions about that site's data practices, please contact that website directly — they, not Groager, are the data controller for their own visitors and determine how their site uses this data (e.g. what consent notices they show). Groager processes this data as instructed by our customer.

If you are a Groager customer embedding the tracking snippet on your own website, you — not Groager — are solely responsible for obtaining any cookie or tracking consent required from your own visitors under the law that applies to them (for example, ePrivacy/GDPR-influenced consent requirements in the EU/UK, or similar rules elsewhere), for showing any required consent banner, and for your own site's privacy policy disclosing this tracking to your visitors. Groager provides technical support for this (the snippet's data-consent-required flag and consent() API, and respecting Do Not Track by default — see 2.4), but does not, and cannot, assess what consent your specific site and audience legally require — that determination, and the resulting liability if it is wrong, is yours as the site operator. See also our Terms of Service, Section 4, and our Cookie Policy, Section 2.4.

• To provide, operate, and maintain the Service (e.g. generating your analytics dashboard, running SEO audits, powering the AI assistant);
• To send transactional emails: account verification, password reset, team invitations, and alerts you've configured (e.g. a website's Core Web Vitals crossing a threshold);
• To detect, investigate, and prevent fraud, abuse, and security incidents;
• To provide customer support and respond to your requests;
• To improve the Service, including debugging errors (see 1.3);
• To comply with legal obligations.

We do not sell your personal data, or your website visitors' data, to third parties.

• For your account data (Section 1) — Groager is the data controller: we determine why and how that data is processed (running your account, billing, support, product improvement).
• For your website visitors' data collected via the tracking snippet (Section 2) — Groager is the data processor, and you (our customer, the website owner) are the data controller. We process that data only as needed to provide your analytics dashboard, per your instructions (embedding the snippet, configuring what it tracks) — we do not decide independently what to do with your visitors' data beyond that.

Where the EU/UK GDPR applies, here is the legal basis we rely on for each real category of data described above:

Where you (or your visitors) have a choice, you may withdraw consent at any time — see Section 12 (Your Rights) below.

The AI assistant and AI-generated explanations are powered by Anthropic's Claude API — the commercial API product, not the consumer Claude.ai chat product. When you use these features, relevant structured data already in your dashboard (e.g. your analytics figures, audit findings, or the text of your question) is sent to Anthropic to generate a response. Per our product design, the AI is used only to explain and summarize evidence already computed by our backend — it is not given blanket access to your full account.

On AI training: by default, Anthropic does not use data submitted through its commercial API (which is what Groager uses) to train its models. We have not enabled, and our codebase contains no configuration for, any Anthropic feedback, telemetry-sharing, or model-improvement opt-in program that would change this — Groager sends requests to the standard Claude API and nothing more. See Anthropic's Privacy Policy and commercial API terms for Anthropic's own, authoritative statement of this policy, which governs their handling of API data independent of anything stated here.

We share data with the following categories of third-party service providers, only as needed to run the Service:

• Paddle.com Market Limited — payment processing, billing, tax compliance (Merchant of Record for subscriptions);
• Google LLC — OAuth sign-in and, if you connect it, Search Console API access;
• Anthropic PBC — AI processing for the AI assistant and AI-generated explanations (see Section 7);
• ip-api.com — IP-to-location lookups for visitor geolocation in analytics (see 2.3);
• Our email delivery provider (currently Google/Gmail SMTP) — for sending transactional emails;
• Our cloud infrastructure and database backup storage providers, currently including Backblaze B2 for encrypted off-site database backups, and our virtual private server hosting provider for the servers the Service runs on.

We do not have a Content Delivery Network (CDN) in front of the Service at this time; requests are served directly from our servers.

• Account data is retained for as long as your account is active, and for a limited period afterward to allow for reactivation or legally required record-keeping, after which it is deleted or anonymized upon request.
• Analytics data (sessions/events collected via the tracking snippet) is retained indefinitely by default — stated plainly rather than as “a limited period”: there is currently no automated purge or time-based deletion job for this data. It remains available for as long as the associated website stays connected to an account, so historical reporting works, and is deleted only when you request it (see Section 12) or when your account itself is deleted. If you need bounded retention (e.g. to auto-delete analytics data older than N months), that is not yet a feature of the product — contact us to discuss it.
• Database backups are retained for 30 days on our servers and up to 90 days in off-site backup storage, after which they are permanently deleted, independent of when the underlying live data was deleted.
• Error logs are retained as needed for debugging and are not kept indefinitely.

See also our Terms of Service, Section 16.1, for how this applies specifically after account termination or downgrade.

We use the following real, currently-implemented measures to protect data — we describe only what is actually in place, not aspirational security posture:

• Encryption in transit: all traffic to and from the Service is served over TLS/HTTPS.
• Password hashing: account passwords are stored as salted bcrypt hashes — we never store or can view your plaintext password.
• Role-based access control: access within a workspace is governed by real role checks (owner/admin/member/viewer) enforced on the backend, not just hidden in the UI.
• Plan-based access control: access to paid features is enforced server-side based on your subscription plan, not just hidden in the UI.
• Rate limiting: sensitive endpoints (login, signup, password reset, and the public tracking endpoints) are rate-limited to reduce abuse.
• Automated backups: daily encrypted database backups, retained per Section 10 above, with off-site replication to Backblaze B2.
• Audit logging: security-relevant account and billing actions are recorded in an internal audit log.

We do not currently hold SOC 2, ISO 27001, or similar third-party security certifications — we are a small operation and have not pursued formal certification. If a certification becomes a real requirement for our customers, we will evaluate it at that time rather than claim one we don't have. No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you as required by applicable law.

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, or to object to or restrict certain processing. To exercise any of these rights — for your account data, or on behalf of your website if you're requesting deletion of visitor analytics data you collected — contact us at groagerai@gmail.com. We currently process deletion and access requests manually (there is no self-service “delete my data” button yet); we aim to respond within a reasonable time and in any event within the timeframe required by applicable law.

Data portability: on request, we will provide your account and analytics data in a structured, commonly-used, machine-readable format (e.g. CSV/JSON export of your analytics and audit data) so you can transfer it elsewhere.

Data Processing Agreement (DPA): if your organization requires a signed DPA to use Groager (for example, to satisfy your own GDPR compliance obligations as a controller), one is available on request — email groagerai@gmail.com. We do not yet have a standing, pre-drafted DPA published on this site; this is a known gap we intend to close as enterprise demand for it grows, not a promise that a document already exists today.

If you are located in the European Economic Area, United Kingdom, or a jurisdiction with a similar data protection authority, you also have the right to lodge a complaint with your local supervisory authority.

We do not use your personal data for fully automated decision-making that produces legal effects concerning you or similarly significantly affects you (e.g. automated decisions about eligibility, pricing, or access to the Service made without human involvement). AI-generated explanations and scores in the product (Section 7) are informational — they summarize evidence for you to review and act on; they do not automatically grant, deny, or change your access to anything. Where a plan/entitlement decision does gate your access to a feature, it is a deterministic rule (your subscription plan) applied by our backend, not an AI or profiling-based decision.

• The Groager dashboard itself (app.groager.com) does not set authentication cookies — your session token is kept in your browser's local storage, not a cookie.
• The tracking snippet, when embedded on a customer's website, sets first-party cookies (niq_vid, niq_sid, niq_sst, and niq_optout if you opt out) on that website's own domain, described in Section 2.1.
• For the full real cookie inventory (names, durations, flags actually set), see our Cookie Policy.

We are based in India; some of our sub-processors (Section 9) are based outside India, meaning your data may be transferred to and processed in other countries. Where required by applicable law, we rely on appropriate safeguards (such as those sub-processors' own standard contractual clauses or equivalent mechanisms) for such transfers.

If Groager is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or substantially all of its assets, your data may be transferred as part of that transaction. If this happens, we will require the receiving party to honor the commitments made in this Privacy Policy, and will notify you (e.g. via email or an in-app notice) of any such change in ownership or in how your data is handled.

We may disclose your information if required to do so by law, regulation, legal process (e.g. a court order or subpoena), or a valid governmental request, or where we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to an emergency. Where legally permitted, we will make reasonable efforts to notify you before disclosing your data in response to such a request.

The Service is not directed to individuals under 18, and we do not knowingly collect account data from them. If you believe a child has provided us with personal data, contact us at groagerai@gmail.com and we will take appropriate action.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice before they take effect.

Questions about this Privacy Policy, or requests relating to your data, can be sent to groagerai@gmail.com. We currently use this single address for all inquiries; a dedicated privacy@groager.com address is a planned future improvement once we have email hosting set up for our own domain, not yet in place today.