Privacy Policy

1. Information We Collect

Information you provide directly

• Contact information: Name, email address, phone number, and social media handles you provide when contacting us via WhatsApp, Instagram, or email.
• Account information: Username, password (stored encrypted), and profile details you create when joining.
• Communications: Messages you send to our support team or through in-app chat.

Information collected automatically

• Device and usage data: IP address, browser type, device identifiers, operating system, pages visited, and interaction timestamps.
• Advertising data: Through Facebook Pixel, we receive ad attribution data including which ad you clicked, whether you converted, and aggregated performance metrics. This data is used to measure and optimize our advertising campaigns.
• App activity: Check-in history, points earned, trees planted, streaks, and redemption activity within the platform.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account, process rewards, and facilitate point redemptions.
• Communicate with you, including responding to inquiries and sending service-related notifications.
• Measure, analyze, and improve our advertising campaigns (including Facebook ad performance via Pixel).
• Personalize your experience and recommend features or rewards that may interest you.
• Detect, prevent, and address fraud, security issues, or policy violations.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information to third parties for monetary consideration. We also do not use your personal information for cross-context behavioral advertising without your consent.

3. Sharing of Information

We may share your information with:

• Service providers: Trusted third parties who help us operate (e.g., hosting, payment processing, email delivery, analytics). These providers are contractually required to protect your data and use it only as directed.
• Advertising partners: Aggregated, de-identified data may be shared with advertising platforms (including Meta/Facebook) for campaign measurement and optimization. We do not share your name, email, or phone number with advertisers.
• Legal authorities: When required by law, court order, or governmental request, or to protect our rights, property, or safety.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.

4. Cookies and Tracking Technologies

We use cookies and similar technologies (including Facebook Pixel) to:

• Remember your preferences and cookie consent choice.
• Track ad performance and conversions for our Facebook advertising campaigns.
• Analyze site traffic and usage patterns through aggregated analytics.

Language preference

To display our site in your preferred language, we may store your language choice in your browser's local storage — but only after you manually select a language from the language switcher. We do not use third-party IP geolocation services to infer your language, since doing so would share your IP address with an external provider. Instead, on your first visit we read your browser's own language setting (navigator.language), which never leaves your device. This language preference is not used for advertising, analytics, or cross-site tracking, and it is never sent to our servers.

To opt out of language preference storage, simply do not select a language in the switcher; the site will continue to use your browser language on each visit.

To opt out of Facebook ad tracking specifically, visit Facebook Ad Settings.

5. Your California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know: Request information about what personal data we collect, use, and share.
• Right to delete: Request deletion of your personal information (subject to certain exceptions).
• Right to opt out of sale: We do not sell your personal information. However, you may submit a request to confirm this and to opt out of any potential future sale.
• Right to correct: Request correction of inaccurate personal information.
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights.

To exercise any of these rights, contact us at privacy@grovehaus.com with "CCPA Request" in the subject line. We will respond within 45 days. You may also designate an authorized agent to submit requests on your behalf.

6. Children's Privacy (COPPA)

GroveHaus is intended for users who are at least 13 years old. We comply with the Children's Online Privacy Protection Act (COPPA).

• We do not knowingly collect personal information from children under 13.
• Our advertising and marketing are not directed at children under 13.
• If we become aware that a child under 13 has provided us with personal information, we will promptly delete it.
• If you believe we have collected information from a child under 13, please contact us immediately at privacy@grovehaus.com.

Users between the ages of 13 and 18 should review this policy with a parent or guardian and may need parental consent in certain jurisdictions.

7. Data Security

We implement industry-standard security measures to protect your personal information, including:

• 256-bit SSL/TLS encryption for data in transit.
• Encrypted storage of sensitive data (including passwords using bcrypt hashing).
• Two-factor authentication for account access.
• Regular security audits and penetration testing.
• Role-based access controls for our team.

While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

9. International Users

GroveHaus is operated from the United States. If you access our services from outside the U.S., your information may be transferred to, stored, and processed in the U.S. and other jurisdictions where data protection laws may differ. By using our services, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date and, where appropriate, providing a more prominent notice. We encourage you to review this policy periodically.

11. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to reach our privacy team, please contact us at:

• Email: privacy@grovehaus.com
• WhatsApp: +1 (800) 555-0123
• Mailing address: GroveHaus Privacy Team, 123 Market Street, Suite 400, San Francisco, CA 94105, USA

We aim to respond to all privacy inquiries within 48 hours.