groas

GDPR overview

The terms commit both parties to the EU GDPR, the UK GDPR and Data Protection Act 2018, and the CCPA, and assign the roles explicitly: the customer is controller, groas is processor. Several measures are concrete. Personal data is deleted from active systems on request, anything kept for legal reasons is isolated from further processing, groas notifies the customer once a deletion is done and assists with data-subject requests. Transfers out of the European Economic Area, Switzerland or the United Kingdom rely on the EU standard contractual clauses or the UK International Data Transfer Agreement, with a copy supplied on request. The gaps are just as concrete: no Article 27 EU representative, no named data protection officer, no published data processing agreement, no subprocessor list and no EU establishment.

Who owns the data?

The customer keeps ownership of its data. Under the terms, the customer, or the customer's own client, is the data controller, and groas acts only as data processor, or service provider under the CCPA, processing personal data solely to deliver the service and on documented instructions. Customer personal data is additionally treated as the customer's confidential information. Two carve-outs matter. groas may keep and exploit aggregated, anonymised data indefinitely, including published performance benchmarks. And by default it may use the customer's name, logo and testimonials in its own marketing unless a separate non-disclosure agreement says otherwise, with removal within thirty days of a written request.

Reuse rights

Nothing in the terms restricts the customer from reusing its own campaign data; the restrictions run the other way. groas grants only a limited, non-exclusive, non-transferable licence to access the service for the customer's internal business purposes, reserves every right not expressly granted, including the algorithms behind the platform, and requires that copyright and proprietary notices stay on reports and materials. Confidentiality binds both parties and survives five years, indefinitely for trade secrets and personal data. Separately, groas reserves the right to use campaign performance data, advertising metrics and behavioural patterns to train and improve its own AI models, but only once that data has been irreversibly anonymised and aggregated.

Data retention & training

Hosting summary

groas names neither a hosting provider nor a datacentre region. The terms state that customer data may be processed and stored on servers outside the customer's own country, including in the United States, and that where data leaves the European Economic Area, Switzerland or the United Kingdom for a country without an adequacy decision, the parties rely on the EU standard contractual clauses or the UK International Data Transfer Agreement, with a copy of the mechanism supplied on request. Security is described rather than certified: appropriate technical and organisational measures, encryption of personal data where appropriate, access controls and staff training in the terms, plus AES-256 at rest, SSL in transit, strict access controls and continuous audits in the privacy policy. No SOC 2, ISO 27001 or comparable certification is mentioned, and no subprocessor list is published. The company operates under Wyoming law, so United States jurisdiction is the practical default for hosted data.