Privacy Policy

Updated: February 11, 2026

At Grocalo Inc. ("Grocalo," "we," "our," or "us"), your privacy is important to us. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our creator operations platform (the "Service"), including our website, applications, and related services. It also describes your rights in relation to that information and provides guidance on how to contact us if you have questions.

This Privacy Policy applies to your use of the Grocalo platform, our websites, and any related online services that display a link to this document (collectively referred to as the "Service"). By accessing or using the Service, you acknowledge and agree to the collection, processing, storage, transfer, and disclosure of your information in accordance with this Privacy Policy. If you do not agree with any part of this policy, you should not use the Service.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. Any revisions will be posted within the Service, with the "Updated" date changed accordingly. Your continued use of the Service following these updates constitutes acceptance of the revised Privacy Policy.

1. Privacy Policy Scope

This Privacy Policy forms an integral part of our Terms of Use and works in conjunction with any additional privacy statements or specific notices displayed on certain pages of the Service. Regardless of where your information is processed, transferred, or stored, if it is gathered through your use of the Service, it will be handled according to the provisions of this Privacy Policy.

2. Information We Collect

We collect information from two primary sources: details you provide directly and data collected automatically through your use of the Service.

2.1 Account Information

When you create an account, we collect:

Registration details — your email address and password (or authentication via a third-party identity provider such as Google).

Profile information — your name, display name, and any other profile details you choose to provide.

Customer support submissions — your email address and copies or records of communications you have with our support team.

2.2 Connected Social Media Account Data

When you connect your third-party social media accounts to Grocalo, we collect certain information stored in those accounts. You enter your credentials directly on the social network's website or app. Grocalo never views, processes, or stores your social network account passwords. We access your connected accounts using OAuth, a secure authorization mechanism that allows you to revoke Grocalo's access at any time.

The specific data we collect depends on which platforms you connect:

Meta (Instagram / Facebook)

Your Instagram Business or Creator account profile information (username, profile picture, account ID)

Your Facebook Page information (page name, page ID) and page access tokens

Comments and messages on your Instagram posts (used to provide keyword-triggered engagement responses you configure)

Publishing capabilities to post Reels and videos to your connected Instagram and Facebook accounts

TikTok

Your TikTok account profile information (username, display name, avatar, account ID)

Access tokens (which are automatically refreshed every 24 hours)

Publishing capabilities to upload and post videos to your connected TikTok account

YouTube

Your YouTube channel information (channel name, channel ID)

Access tokens and refresh tokens for authorized API access

Publishing capabilities to upload videos to your connected YouTube channel

2.3 Content Data

We collect content you upload or create through the Service, including:

Content you upload or create for publishing to your connected platforms

Captions, descriptions, and other metadata you provide for your content

Configuration settings for features you use within the Service

2.4 Usage Data and Analytics

We automatically collect information about how you interact with the Service, including pages viewed, features used, actions taken, and the date and time of your interactions.

2.5 Device and Technical Information

We may collect your IP address, browser type and version, operating system, device type, time zone, and general location information (derived from IP address).

2.6 Cookies and Tracking Technologies

Cookies — Small data files stored on your device that may be required for certain features. You may disable them in your browser settings, though some functionality may be affected.

Web Beacons — Small graphic files embedded in the Service that help measure usage and track performance.

3. Legal Grounds for Processing

If you are situated within the European Economic Area (EEA) or the United Kingdom (UK), we handle your personal data only where a valid legal basis applies:

Consent — Where you have given clear permission for specific uses, such as connecting your social media accounts.

Performance of Contract — Where processing is required to deliver the Service's features and meet our agreement with you.

Legitimate Interests — Where processing supports purposes such as improving the Service, maintaining security, and preventing fraud.

Compliance with Legal Obligations — Where we must process your data to comply with applicable laws.

4. How We Use Your Information

We use the information we collect for the following purposes:

Providing the Service — Delivering the features and functionality you use, including publishing content to your connected social media accounts, managing audience engagement, and managing your platform connections.

Processing data on your behalf — When you instruct us to perform actions on your connected accounts, we carry out those actions using the data from your connected accounts.

Maintaining and improving the Service — Monitoring performance, fixing bugs, and developing new features.

Security and fraud prevention — Detecting and preventing unauthorized access, abuse, or fraudulent activity.

Communicating with you — Sending service-related messages, updates, and responding to your inquiries.

Legal compliance — Meeting obligations required by applicable laws and regulations.

User Responsibility for Compliance — You are responsible for ensuring that any content published through the Service complies with applicable intellectual property laws, advertising and disclosure requirements, community guidelines, and the terms of the relevant social media platforms. Grocalo does not independently review or moderate content prior to publication.

Social media data collected through your connected accounts will only be used by Grocalo to provide you with the services you expect. This data will not be shared with any third parties for their own purposes.

We will not use your content to train, fine-tune, or improve any generalized AI or machine-learning model — neither our own nor those of any third party. We will not use your content for advertising or for any purpose other than providing the Service.

Grocalo offers AI-assisted features that process your content to help you manage, organize, and reason about your own work. These features are powered by foundation-model and machine-learning providers acting as our subprocessors. These providers process your content only to return a result for your request and, under their contractual terms with us, do not retain it after the request and do not use it to train their models. Each creator's content is used only to power that creator's own experience; we do not aggregate one user's content into features that serve other users. Platform-specific details, including for YouTube, are described in Section 6.

5. Information Sharing and Disclosure to Third Parties

5.1 Connected Social Media Platforms

When you use the Service to publish content or engage with your audience, we transmit data to the connected social media platforms as necessary to carry out your requested actions (e.g., uploading a video to your YouTube channel, posting a Reel to your Instagram account, replying to a comment on your behalf).

5.2 Infrastructure Service Providers

We use third-party service providers to host, operate, and secure the Service, including cloud infrastructure, authentication, database, and hosting providers. All service providers are bound by contractual obligations to handle your information only for the purposes we specify and in accordance with this Privacy Policy.

5.3 We Do Not Sell Your Personal Information

We do not sell your personal information. We have not sold any personal information in the preceding twelve months. We do not share your personal information with third parties for their own marketing or advertising purposes.

5.4 Legal and Safety Disclosures

We may disclose your information if we believe it is necessary to:

Comply with applicable laws, regulations, or legal processes.

Respond to valid governmental or law enforcement requests.

Protect the safety, rights, and property of Grocalo, our users, or the public.

Prevent or address fraud, security risks, or technical issues.

5.5 Business Transfers

We may share or transfer your information in the event of a business transaction, including mergers, acquisitions, asset sales, or bankruptcy proceedings, where your information may be part of the transferred assets.

6. Platform-Specific Data Disclosures

6.1 Meta (Instagram / Facebook)

When you connect your Instagram or Facebook account to Grocalo through Meta's official OAuth flow, we access the following data on your behalf:

Your Instagram Business or Creator account profile information

Your Facebook Page information and page access tokens

Comments and messages on your Instagram posts (to provide keyword-triggered engagement responses)

Publishing capabilities (to post Reels and videos to your connected accounts)

We do not use data obtained through the Meta Platform to make eligibility determinations regarding housing, employment, education, insurance, or credit. We do not use Meta Platform data to perform or facilitate surveillance.

You may disconnect your Meta account at any time from the Connections page in Grocalo. When you disconnect, we revoke your access tokens and stop accessing your Meta account data. You may also manage Grocalo's access to your Meta data through your Facebook Business Integrations settings.

6.2 TikTok

When you connect your TikTok account to Grocalo through TikTok's official OAuth flow, we access the following data on your behalf:

Your TikTok profile information (username, display name, avatar)

Access tokens (which automatically refresh every 24 hours)

Publishing capabilities (to upload and post videos to your TikTok account)

Your TikTok data belongs to you. We use it solely to provide the publishing features you request. We will not share your TikTok data with any third party without your consent. We do not share API credentials with third parties.

You may disconnect your TikTok account at any time from the Connections page in Grocalo. When you disconnect, we revoke your access tokens and stop accessing your TikTok account data.

6.3 YouTube / Google

Grocalo uses the YouTube API Services to integrate with your YouTube channel. By connecting your YouTube account, you agree to be bound by the YouTube Terms of Service, and your use of Grocalo's YouTube features is subject to Google's Privacy Policy.

What we access

When you connect your YouTube channel through Google's official OAuth flow, Grocalo requests the following scopes:

How we use this data

Grocalo's use of information received from YouTube API Services adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use YouTube data solely to provide and improve user-facing features that you have requested — content publishing, analytics display, earnings reporting, comment management, content library indexing, and AI-assisted features (described below).
• We do not use YouTube data, including derived data, to serve ads to you or to others.
• We do not transfer YouTube data to third parties except as necessary to provide the requested features (e.g., storing data with our cloud infrastructure providers), to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you.
• We do not sell YouTube data.
• We do not use YouTube data to determine credit-worthiness or for lending purposes.
• We do not use YouTube data — including derived data such as transcripts, embeddings, or summaries — to develop, train, fine-tune, or improve any generalized AI or machine-learning model, including our own and those of any third-party provider.

AI-assisted features

Grocalo offers AI-assisted features that operate on your own YouTube content to help you manage and reason about your work. Your YouTube content (including video files, transcripts, metadata, and comments you have authorized us to access) is processed by foundation-model and machine-learning providers acting as our subprocessors. These providers process the data only to return a result for your request and, under their contractual terms with us, do not retain it after the request, do not use it to train their models, and do not share it with other customers. A current list of subprocessors is available upon request by emailing support@grocalo.com.

YouTube data that powers your AI features stays scoped to your own account. Any artifacts derived from your YouTube content — including data used to personalize features for you — are stored on a per-user basis and used solely to serve your own experience. We do not aggregate one creator's YouTube content into features that serve other creators. We may compute anonymized aggregate statistics, insights, and benchmarks across our user base to operate and improve the Service, provided no individual creator's content or identity can be identified from the result. Any other use of your YouTube content would require your explicit opt-in. Derived artifacts are deleted alongside the source data when you disconnect or delete your account.

How we store and protect this data

• Access tokens and refresh tokens are encrypted at rest using AES-256-GCM with keys managed by AWS KMS.
• YouTube data is stored in our PostgreSQL database (hosted by Supabase) with row-level security restricting access to your own user account.
• All data transmission between Grocalo and Google (and between Grocalo and our AI subprocessors) is encrypted in transit using TLS 1.2 or higher.
• Internal access to YouTube data is restricted to the minimum number of personnel required to operate the Service.

Your control

• You can review and revoke Grocalo's access to your YouTube data at any time via the Google Security Settings page.
• You can also disconnect your YouTube account from the Connections page in Grocalo at any time.
• Upon revocation or disconnection, Grocalo will delete all YouTube user data associated with your account — including derived artifacts such as transcripts, embeddings, and cached analytics — within 30 days, except where retention is required to comply with applicable law.
• You may request deletion of specific YouTube data by emailing support@grocalo.com.

7. OAuth and Connected Accounts

Grocalo connects to your social media accounts through each platform's official OAuth authorization flow. This means:

We never view, process, or store your social network passwords. You authenticate directly with each platform (Meta, TikTok, or Google), and they provide Grocalo with a limited access token.

Access tokens are stored securely and encrypted. They allow Grocalo to perform specific actions on your behalf (such as publishing content or reading comments) without having access to your login credentials.

You can disconnect any connected platform at any time from the Connections page in Grocalo. Disconnecting immediately revokes Grocalo's access to that platform.

Each platform may also allow you to revoke Grocalo's access directly from their settings (see Section 6 for platform-specific links).

8. Your Choices for Managing Your Information

Account Information

You can review or update the information you have shared with us at any time through the account settings within the Service. If you wish to delete your account, you may do so by contacting us at support@grocalo.com.

Promotional Communications

You can opt out of receiving promotional or marketing messages from us by following the unsubscribe instructions included in those communications. Please note that opting out will not affect transactional or service-related messages.

Disconnect Connected Platforms

You may disconnect any connected social media account at any time from the Connections page. You may also revoke access through each platform's settings:

Meta/Instagram/Facebook — Facebook Business Integrations

YouTube/Google — Google Security Settings

TikTok — Manage connected apps in your TikTok account settings

9. How Long We Keep Your Information

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy and our Terms of Use, or as otherwise required by law. Once the applicable retention period has ended, we securely delete or anonymize all related data.

Retention Periods

Account information — Retained until you delete your Grocalo account.

Connected platform tokens — Retained while your account is connected. Deleted when you disconnect a platform or delete your account.

YouTube data — Deleted within 30 calendar days of access revocation, including derived artifacts such as transcripts, embeddings, and cached analytics.

Usage logs — Retained for a reasonable period for troubleshooting and security purposes.

Customer support inquiries — Retained until we have resolved your request or issue.

Account Deletion

You may delete your account by contacting us at support@grocalo.com. Upon deletion, we will remove your account information, connected platform data, and stored content within 30 days. Content previously published to third-party platforms will remain on those platforms pursuant to their respective terms.

10. Children's Privacy

The Service is not designed for individuals under the age of 18. We do not intentionally collect personal information from anyone under 18. If you become aware that a child has provided us with personal information, please contact us promptly at support@grocalo.com so we can take appropriate action.

11. Transferring Your Data

Information collected through the Service may be stored or processed in the United States or in any other location where Grocalo or our service providers operate. By registering for and using the Service, you consent to the transfer and processing of your information in these jurisdictions, as described in this Privacy Policy.

12. Security

We take reasonable measures to protect your information:

Encryption in transit — All data transmitted between your browser and our servers is encrypted using TLS/SSL.

Encryption at rest — Sensitive data, including access tokens, is encrypted in our database.

Access controls — We implement role-based access controls and security policies to restrict access to your data.

Infrastructure security — Our infrastructure is hosted on cloud providers that maintain industry-standard security certifications.

While we take reasonable steps to safeguard your information, no method of transmission or storage is completely secure. You are responsible for protecting the confidentiality of your account credentials.

Data Breach Notification — In the event of a data breach affecting your personal information, we will notify affected users and, where required, relevant regulatory authorities in accordance with applicable law.

13. External Links

The Service may include links to external websites or services. These third parties have their own privacy practices and policies, which are not governed by this Privacy Policy. We encourage you to review their policies before interacting with those services.

14. For EEA/UK Residents (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), the following additional provisions apply:

Data Subject Rights

In addition to the rights listed in Section 8, you have the right to:

Restrict or object to processing of your personal data

Request portability of your personal data

Withdraw consent at any time (without affecting the lawfulness of prior processing)

Lodge a complaint with your local data protection supervisory authority

Data Controller

Grocalo Inc. is the data controller for personal information collected through the Service. For social media data processed on your behalf through connected accounts, Grocalo acts as a data processor.

International Data Transfers

Your data may be transferred to and processed in the United States, where our servers and infrastructure are located. We rely on appropriate safeguards, including standard contractual clauses, to ensure adequate protection for your data.

15. For California Residents (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Categories of Personal Information Collected

Identifiers — email address, name, IP address, social media account IDs

Internet activity — browsing history, search history, interactions with the Service

Professional or employment-related information — social media account profile information

Inferences — preferences and characteristics derived from your use of the Service

Your California Privacy Rights

Right to Know — You may request that we disclose the categories and specific pieces of personal information we have collected about you.

Right to Delete — You may request that we delete your personal information, subject to certain exceptions.

Right to Opt-Out of Sale/Sharing — We do not sell or share your personal information as defined by the CCPA/CPRA.

Non-Discrimination — We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at support@grocalo.com.

16. Do Not Track

Do Not Track (DNT) is a browser-based setting that allows users to indicate their preference not to be tracked. At this time, we do not respond to DNT signals or similar mechanisms sent by browsers.

17. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Updates will be posted within the Service with a new "Updated" date. In some cases, we may provide additional notice of material changes. By continuing to use the Service after changes take effect, you agree to the revised policy.

18. How to Contact Us

If you have questions about this Privacy Policy, or if you wish to submit a request concerning your personal information, please contact us at support@grocalo.com.