Privacy Policy
Last updated:
This Privacy Policy explains how IdeasCol, LLC (“Groveback”, “we”, “us”) collects, uses, shares and protects personal data when you visit groveback.com, read our documentation, or use the Groveback platform, dashboard, API, CLI and MCP server (together, the “Service”).
It is also our personal data processing policy (política de tratamiento de datos personales) under Colombian Law 1581 of 2012 and Decree 1074 of 2015. The Spanish version of this policy prevails for data subjects in Colombia.
Who is responsible for your data
The controller (responsable del tratamiento) of the personal data described in this policy is:
- IdeasCol, LLC, a limited liability company organized in Delaware, United States, with its team in Bogotá, Colombia
- Address: 131 Continental Dr, Suite 305, Newark, DE 19713, United States
- Phone: +1 (857) 367-2373
- Privacy requests: jairof@ideascol.com
EU and UK representative (GDPR art. 27): we have not appointed one. People in the EEA and the UK can write directly to jairof@ideascol.com.
Two roles: controller and processor
Groveback plays two different roles, and this policy covers only the first.
Controller. We decide how and why we process data about our own customers and visitors: your account, your workspace membership, billing, support conversations, security logs and visits to our websites. This policy describes that processing.
Processor. Our customers build applications on Groveback and store their own data in it, including data about their end users (for example, the users of an app that signs in through a Groveback project). We call this “Customer Data”. We process Customer Data only on our customer’s instructions, under our Data Processing Addendum. If you are an end user of an application built on Groveback, the company that runs that application is responsible for your data: please contact them first. We will help them answer your request.
Data we collect
Data you give us
- Account data: email address, name, password (stored only as a salted hash), and the workspaces and projects you create or are invited to, with your role in each.
- Sign-in through a third party: if you sign in with Google or GitHub, we receive the email address, name and profile picture that the provider shares according to your settings there.
- Billing data: plan, subscription status and invoices. Payments are handled by Stripe; we never receive or store your full card number.
- Communications: what you send us by email or through support, and your answers to our questions.
- Assistant conversations: if you use the dashboard assistant or knowledge-base answers, the prompts you write and the responses generated.
Data we collect automatically
- Technical and security logs: IP address, browser and device information, timestamps, the API routes called and their result. We use them to run, secure and debug the Service.
- Audit log: administrative actions in a project (who did what, and when). It is visible to the project’s owners and admins.
- Usage metrics: counts such as storage used, function runs and vectors stored, used to apply plan limits and to bill.
- Browser storage: the dashboard keeps your session tokens and interface preferences in your browser’s local storage. See our Cookie Notice.
We do not use advertising cookies, third-party analytics, session replay, or tracking pixels on our websites, the dashboard or our emails.
How we use your data and why we may
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, workspaces and projects, and provide the Service you asked for | Performance of a contract |
| Send service emails: verification, password reset, invitations, security and billing notices | Performance of a contract |
| Charge for paid plans and keep accounting and tax records | Contract; legal obligation |
| Keep the Service secure, prevent fraud and abuse, enforce our Terms of Service | Legitimate interests (security of our users and our platform); legal obligation |
| Answer your support requests | Contract; legitimate interests |
| Understand aggregate use to fix bugs and improve the Service, using de-identified or aggregated data | Legitimate interests |
| Send product news, only if you opted in | Consent, which you can withdraw at any time |
| Comply with the law, respond to lawful requests from authorities, and defend legal claims | Legal obligation; legitimate interests |
We do not sell personal data, we do not use it for interest-based advertising, and we do not use your data or Customer Data to train AI models.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
Artificial intelligence features
The dashboard assistant and knowledge-base answers send your prompt, and the project context needed to answer it (for example, schema definitions or retrieved documents), to the AI model provider that powers the feature. Embeddings for vector search are created by an embeddings provider. These providers act as our subprocessors, may only use the data to provide their service to us, and are listed in Annex 3 of the DPA. AI output can be wrong; review it before you rely on it.
If you connect your own AI provider key to a project, data is sent to that provider under your own agreement with them.
Who we share data with
- Service providers (subprocessors) that host, store, email, bill or run AI features for us, under contracts that require them to protect the data and use it only for us. The current list, with what each does and where, is in Annex 3 of the DPA.
- Other members of your workspace: your name, email and role are visible to the people you work with in the same workspace or project.
- Integrations you connect: if you connect GitHub, Vercel or another service to a project, we send it the data needed for that integration on your instruction.
- Authorities and advisers: when the law requires it, to protect rights and safety, or to our lawyers, auditors and insurers under confidentiality.
- Business transfers: if we are involved in a merger, acquisition or sale of assets, under this policy’s protections.
International transfers
We and our providers process data in the countries listed in Annex 3 of the DPA, which include the United States and may include other countries outside your own.
- From the EEA, the UK and Switzerland, we rely on an adequacy decision where one exists (including the EU-U.S. Data Privacy Framework for certified recipients) or on the European Commission’s Standard Contractual Clauses and the UK Addendum.
- From Colombia, we transfer data to countries the Superintendencia de Industria y Comercio (SIC) considers to have an adequate level of protection, or with your express authorization, or under the other cases allowed by article 26 of Law 1581 of 2012. Providers that process data on our behalf are bound by transmission contracts as required by Decree 1074 of 2015.
You can ask us for a copy of the safeguards we use.
How long we keep data
- Account data: while your account is active. When you delete it, we delete or anonymize it within 30 days, except what we must keep for the reasons below.
- Billing and accounting records: for as long as tax and commercial law require (in Colombia, up to ten years).
- Technical and security logs: for a limited period, normally no longer than 90 days, unless we need them to investigate an incident.
- Audit log: 365 days, then deleted automatically.
- Customer Data: as instructed by the customer and described in the DPA.
- Backups: deleted data can remain in encrypted backups until they rotate out.
Security
We protect data with encryption in transit (TLS), encryption of stored secrets such as integration keys and AI provider keys, hashed passwords, permission-based access control, a fail-closed data plane, sandboxed function execution and audit logging. More detail is in Annex 2 of the DPA. No system is perfectly secure; if you find a vulnerability, write to jairof@ideascol.com.
Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- delete your data (the “right to be forgotten”), unless we must keep it by law;
- restrict or object to processing based on our legitimate interests, and object at any time to direct marketing;
- portability: receive data you gave us in a structured, machine-readable format;
- withdraw consent or revoke your authorization at any time, without affecting earlier processing;
- complain to a data protection authority: in the EEA, the authority of your country; in the UK, the ICO; in Colombia, the Superintendencia de Industria y Comercio.
You can update most account data yourself in the dashboard. For anything else, write to jairof@ideascol.com. We may ask you to confirm your identity. We answer GDPR requests within one month, which may be extended where the law allows.
Colombia: rights and procedure under Law 1581 of 2012
As the data subject (titular), you have the right to: know, update and rectify your personal data; request proof of the authorization you gave us; be informed, on request, of how we have used your data; file complaints with the SIC for breaches of the law; revoke your authorization and request deletion when processing does not respect constitutional and legal principles, rights and guarantees; and access your data free of charge.
Authorization. We process your data with your prior, express and informed authorization, which you give when you create an account, or under the exceptions the law allows. We do not require you to provide sensitive data, and the Service is not intended for children or adolescents.
Who handles requests. Requests are handled by IdeasCol, LLC at jairof@ideascol.com or by mail at 131 Continental Dr, Suite 305, Newark, DE 19713, United States.
Queries (consultas). We answer within ten (10) business days from receipt. If we cannot, we will tell you why and answer within the following five (5) business days.
Claims (reclamos) to correct, update or delete data, or to report a breach. Include your identification, a description of the facts, your address and any documents you want to rely on. If the claim is incomplete, we will ask you to complete it within five (5) business days; if you do not within two (2) months, we will consider it withdrawn. We answer within fifteen (15) business days from receipt; if we cannot, we will tell you why and answer within the following eight (8) business days.
You may file a complaint with the SIC once you have completed this query or claim procedure with us.
Validity. This policy is in force from 2026-10-17. Our databases remain in force for as long as needed for the purposes described here and for the periods required by law.
Children
The Service is meant for professionals and is not directed to anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy. If a change is material, we will notify you by email or in the dashboard before it takes effect. The date at the top shows when it last changed.
Contact
IdeasCol, LLC · 131 Continental Dr, Suite 305, Newark, DE 19713, United States · jairof@ideascol.com