Privacy policy

This is what Grofly collects, why, who sees it and how long it is kept, written for the contractor whose business runs on it and for the homeowner who got a card or a text because of it.

1. What we collect from you

Your account: a work email, a password we store only as a hash, and the name of the business. Your business details, when you give them: legal name, address, phone, license number, and the details the carriers require to register a business for texting. Your brand kit: business name, phone, offer, service area, services and proof points. Photos and clips you add, with the tags you give them. Contacts you add by hand. Payment details go straight to Stripe, and we never see the card number.

2. What arrives because you use it

Leads: names, phone numbers, email addresses, addresses and messages that arrive through a Meta lead form, a text, a message or comment on one of the pages you linked, a Google review (with the reviewer's name and words), the form on the page Grofly hosts for you (reached from your postcard's code, a link to it or, when switched on, a Google search ad), and, when those are switched on, a Google Local Services lead or a missed call to your Grofly number. Public records about the addresses in your service area: county assessor rolls, permit records and storm data, which are public and are not about you. Logs of what the service did, kept for security and for the reports on your Stats door.

3. Homeowners

When you use Grofly to mail, text or advertise, we handle homeowners' information on your behalf and on your instructions, and you are the business they hear from. A homeowner who wants their information removed can ask the business on the card, or ask us, and we will remove it from your account. A homeowner who replies STOP to a text is not texted again.

4. How we use it

To run the service: to compose cards, posts and captions, to find and rank addresses, to print and mail, to send and receive texts, to run ads from your account, and to count what got booked. We do not sell information. We do not use your content to train any model. Mobile information is not shared with third parties or affiliates for marketing or promotional purposes.

To improve ad suggestions, we may combine results across businesses in the same trade into patterns, such as which kinds of ad bring leads at what cost. A pattern is only used when it combines at least five businesses, and it never contains your ads, photos, words, name, customers or contact details.

5. Who sees it

Companies that do one job for us, and only what that job needs. Supabase holds the database and the files. Vercel runs the site. Railway runs the machines that turn your photos and clips into posts and ads, so they sit there while they are being made. Stripe takes payments. Resend sends our emails, so it receives the address and the words of each one, including the review requests your customers get by email. Lob prints and mails the postcards, so it receives the names and addresses on them. Telnyx carries texts, so it receives phone numbers and messages, and the business details you give us to register your texting with the carriers. Zernio publishes posts and ads to the accounts you link, so it receives the media, the captions and the connection to those accounts, and it carries the messages, comments, reviews and lead form answers that come in through those accounts, and your replies. Meta and the other platforms you link receive what you publish to them. Anthropic, which makes the AI model your agent uses, receives the text conversations your agent answers, that customer's name, how they came in and where they stand in your contacts, and your business name, town, services, offer and tone, your published prices and how many visits you have booked in the next two weeks, so it can write the replies. GitHub's machines run our nightly backup of the database and files and keep the copies, encrypted so the stored copies cannot be read.

Others do a job only when that job is switched on for your account, and those jobs are off unless you are told otherwise. If you let us read your website when you sign up, Firecrawl fetches pages from your website, and Anthropic reads their text to propose your services and your offer. If you let us look your business up, Google receives the name and town you gave. If reading your photos and clips is switched on, Anthropic receives the frames being read. If you ask us to make a picture or an AI video, Kie receives your description (for an AI video, your kind of business, your town, your offer and a few of your services); your own photos and clips are never sent to it. If you ask us to check whether AI names you, DataForSEO receives the questions we ask AI search tools and the Google searches we run for you, made from your trade and the towns you serve. Your name and website are checked on our side and never sent to it. If address checks are switched on, when you get a batch ready to mail, RentCast receives the addresses of the houses about to get a card and a few next in line, and their ZIP codes to check what is for sale, so we can skip homes that just sold or are listed and put the owner's name on the card. If you say yes to an AI-made shot in a video, fal receives a short written description of that shot. Your photos, clips, face and voice are never sent to it. If captions, ad rewording, texting your agent, the planner, the monthly ad review, reading an ad you paste for its angle, Google search ads or video editing are switched on, Anthropic receives your brand kit, your photo tags, your ad results and the words you send it, and for video editing, what is said in your clips, a few still frames from them, and small copies of your photos of the same job. If booked-lead reporting is switched on, Meta receives each Meta lead's later stage, with Meta's own lead id and a scrambled email (never a phone number), so your ads can learn which leads book. If the local ad read is switched on, ScrapeCreators receives the kind of work you do and your town, to search Meta's public ad library for the ads businesses like yours run. If you turn on alerts, your browser's push service (Apple, Google, Mozilla or Microsoft) carries them to your device, encrypted so it cannot read them. If missed-call text-back is switched on, Telnyx also carries calls to your Grofly number, so it receives the caller's number. Nobody else, unless the law requires it. The one exception is a visitor to a business's own page who says yes to its ad cookies: Meta and Google then see that visit (section 7).

6. How long we keep it

Your account, brand kit, contacts and leads are kept while your account is open. When you close it, ask us and we delete them. Photos and clips for as long as your account is open. Postcard, text and ad records for as long as the account is open, because they are what your reports are made from. Backups roll off on their own schedule after that.

7. Cookies and security

On grofly.io itself, only the cookies that keep you logged in. On a business's own page under grofly.io/c/, if that business has turned it on, we ask each visitor before loading Meta's or Google's advertising tags, which let the business show that visitor its ads again later. Nothing loads unless the visitor says yes, a browser sending Global Privacy Control is treated as a no, and a yes can be taken back from the same page. We do not use these tags for Grofly's own advertising. Everything travels encrypted, every account is walled off from every other at the database, and access on our side is limited to what is needed to run and support the service.

8. Your rights

You can ask us to show, correct, export or delete what we hold about you, or to close your account, at any time, and we do it for you. If you live in California, you have the rights the California Consumer Privacy Act gives you: to know what we collect, to have it deleted or corrected, to opt out of sale (we do not sell), and not to be treated differently for asking. Write to us at Grofly, 750 Otay Lakes Rd #2017, Chula Vista, CA 91910, or through the contact details published on grofly.io, and we will answer within the time the law allows.

9. Children and changes

Grofly is for businesses and is not for anyone under 18. If we change this policy we will post the new version here with a new date, and if a change matters we will email the address on your account.