Effective: July 11, 2026 · Version 2026-07-11.v2 · Covers the Grove waiting-list website only.
Short version: we ask for your name and email, we use them to tell you when Grove opens, we encrypt them, and we never sell them. That's the whole business model of this page. The details follow.
1. Who we are
Grove is made by Cultsure, the data controller for everything described here. Questions, requests, complaints: support@groveplantcare.com.
2. What we collect
- What you give us: your first and last name, your email address, your language preference, whether you'd like to join the beta, and your consent record (what you agreed to and when).
- The invite loop: if you join through a friend's link, we record that your signup came through their invite code — that's how the priority list works. We never see or ask for your friends' email addresses; invites are links people share themselves.
- Security logs: our servers record the IP address and browser type of signup requests in an internal audit log, used only to prevent abuse (spam, fake referrals).
- In your browser: a few small items stored locally on your device — see the Cookie Policy. We do not use advertising or cross-site tracking cookies.
That's it. No last name, no location, no phone number, no speculative collection for "future use."
3. Why, and on what legal basis
- Running the waiting list and emailing you about Grove (access opening, the few milestones that matter): your consent (GDPR Art. 6(1)(a)), given when you check the box at signup. Joining the waiting list is marketing consent — we say so right on the form.
- Preventing abuse (rate limiting, referral fraud): our legitimate interest in keeping the list honest (GDPR Art. 6(1)(f)).
Emails are a privilege, not a drip campaign: few, each worth opening, and every one has a working unsubscribe (CAN-SPAM compliant). Withdrawing consent is one click.
4. How we protect it
Your name and email are encrypted at rest (AES-256) and in transit (TLS). Access is restricted, and all access to waitlist data is logged internally.
5. Who we share it with
Nobody, for marketing. Ever. We use a small set of service providers to run this page — website hosting (Vercel), database hosting (Supabase), and an email delivery service — who process data only on our instructions as processors. We never sell personal information, and we never share it with advertisers.
6. International transfers
Data is processed on servers in the United States. For EU residents, transfers are protected by Standard Contractual Clauses with our processors. For Colombian residents, transfers follow the requirements of Ley 1581 de 2012 and its decrees.
7. How long we keep it
Until Grove launches and the waiting-list invitations are done, or until you ask us to delete you — whichever comes first. Unsubscribing stops all emails immediately; deletion requests are honoured within 30 days.
8. Your rights
Wherever you live, you can email support@groveplantcare.com to:
- See everything we hold about you (it's short), and get a machine-readable copy.
- Fix anything that's wrong.
- Delete your data entirely.
- Withdraw consent at any time — same effect as unsubscribing.
EU/EEA residents (GDPR): you additionally have the rights to restriction, objection, and portability, and to lodge a complaint with your local supervisory authority.
California residents (CCPA/CPRA): you have the rights to know, delete, and correct. We do not sell or share personal information as those terms are defined in the CCPA, and we never discriminate against you for exercising your rights.
Colombian residents (Ley 1581 de 2012): you have the rights to know, update, and rectify your data, request proof of authorization, be informed of its use, revoke authorization, and request deletion. Complaints may be filed with the Superintendencia de Industria y Comercio (SIC) after contacting us first.
9. Children
Grove is not directed at children under 13, and we do not knowingly collect their data (COPPA). If you believe a child has joined the list, tell us and we'll delete the record.
10. Changes
If this policy changes in a way that matters, we'll update the version above — and where the change affects what you consented to, we'll ask again rather than assume.