Legal

Privacy Policy

How Grxd collects, uses, and protects your data.

Last updated May 10, 2026

Overview

This Privacy Policy describes how Grxd Inc. ("Grxd," "we," "us," or "our") collects, uses, and shares information when you use our websites, applications, and services, including grxd.app, marketing.grxd.app, and any related products or APIs (collectively, the "Services"). It also describes the choices you have regarding our use of your information and how you can access and update it.

By using the Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Services.

Information we collect

We collect information you provide directly to us, information collected automatically when you use the Services, and information from third parties, including advertising platforms you authorize us to access on your behalf.

Information you provide

We collect information you provide when you create an account, configure your workspace, use our features, or communicate with us. This includes:

Account information such as your name, email address, password, company name, job title, and phone number.
Billing information such as billing address and payment method details. Payment card information is processed by our payment processors and is not stored on Grxd servers.
Content you upload, create, or share through the Services, including advertising creatives, campaign configurations, audience definitions, and notes.
Communications you send to us, including support requests, feedback, and survey responses.

Information we collect automatically

When you use the Services, we automatically collect certain information about your device and how you interact with the Services, including:

Device and connection information such as IP address, device type, operating system, browser type, language preference, and unique device identifiers.
Usage information such as pages viewed, features used, links clicked, session duration, referring URLs, and timestamps.
Log data generated by our servers when you access or use the Services.
Cookies, pixels, and similar technologies as described in the "Cookies and similar technologies" section below.

Information from advertising platforms and other integrations

When you connect an advertising platform, social media platform, analytics provider, or other third-party service to Grxd, we receive information from those platforms to provide the Services to you. This includes information from:

Google Ads (campaign data, ad account details, audience information, performance metrics, conversion data)
Meta Marketing API (Facebook Ads, Instagram Ads — ad account details, campaign data, ad creatives, audience definitions, performance metrics, business asset information)
TikTok Marketing API (ad account details, campaign data, creatives, audiences, performance metrics)
X Ads API (when authorized — ad account details, campaign data, performance metrics)
Microsoft Advertising (ad account details, campaign data, performance metrics)
Reddit Ads API (ad account details, campaign data, performance metrics)
Pinterest Ads API (ad account details, campaign data, performance metrics)
LinkedIn Marketing Developer Platform (when authorized — ad account details, campaign data, performance metrics)

We only access information from these platforms that is necessary to provide the Services you have requested, and we only access information for accounts and assets you explicitly authorize. We do not access personal data of end users of those platforms beyond what is required to deliver the specific features you use.

Information from other sources

We may receive information about you from third parties such as identity providers (for example, Google or Microsoft single sign-on), analytics providers, advertising partners, and publicly available sources. We combine this information with information we collect directly.

How we use information

We use information to:

Provide, maintain, operate, and improve the Services.
Authenticate your account and secure access to your data.
Process transactions and send related information, including confirmations and invoices.
Send technical notices, security alerts, support messages, and administrative communications.
Respond to your comments, questions, and customer service requests.
Monitor and analyze trends, usage, and activities in connection with the Services.
Detect, investigate, and prevent fraudulent transactions, abuse, security incidents, and other harmful or illegal activity.
Personalize and improve the Services and provide content or features that match user profiles or interests.
Develop new products and services.
Comply with our legal obligations, resolve disputes, and enforce our agreements.
With your consent, send marketing communications about products, services, offers, and events offered by Grxd. You can opt out at any time.

We do not use information we receive from advertising platforms via their APIs to build or augment user profiles for advertising purposes, to sell to data brokers, or for any purpose other than providing the Services you have requested.

Legal bases for processing (EEA, UK, Switzerland)

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases:

Performance of a contract — to provide the Services you have requested and to perform our contract with you.
Legitimate interests — for purposes such as securing the Services, preventing fraud, improving and developing the Services, and conducting business operations, provided those interests are not overridden by your rights.
Consent — for certain marketing communications, cookies, and other purposes where consent is required. You can withdraw consent at any time.
Legal obligation — to comply with applicable laws and regulations.

We do not sell personal information as defined under applicable law, including the California Consumer Privacy Act ("CCPA"). We do not "share" personal information for cross-context behavioral advertising as defined under the California Privacy Rights Act ("CPRA"). We may share information in the following circumstances:

Service providers. We share information with vendors and service providers who perform services on our behalf, such as cloud hosting, payment processing, customer support, analytics, and email delivery. These providers are contractually obligated to protect your information and use it only for the purposes we specify.
Authorized integrations. When you connect a third-party platform, we share information with that platform as necessary to perform the integration you requested. Information shared with third-party platforms is governed by that platform's own privacy policy.
Business transfers. If Grxd is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality protections.
Legal requirements. We may disclose information when we believe disclosure is required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Grxd, our users, or others.
With your consent. We may share information for other purposes with your consent or at your direction.

Data from advertising platforms

When you connect an advertising platform such as Google Ads, Meta, TikTok, X, Microsoft, Reddit, Pinterest, or LinkedIn to Grxd, the following terms apply:

We access and process data from these platforms solely to provide the features you have authorized within Grxd.
We do not transfer data received from these platforms to data brokers or other parties not directly involved in providing the Services to you.
We do not use data received from these platforms for advertising purposes outside the platform from which the data originated.
We retain data received from these platforms only as long as necessary to provide the Services or as required by the platform's developer terms, whichever is shorter.
You can disconnect any platform at any time from your Grxd workspace settings. Disconnecting will stop further data collection from that platform and, where required by the platform, we will delete data received from that platform within a reasonable period.

Our use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Our use of data received from Meta APIs adheres to the Meta Platform Terms and Developer Policies. Our use of data received from TikTok APIs adheres to the TikTok Developer Terms of Service. We comply with the developer terms of each platform we integrate with.

Cookies and similar technologies

We use cookies, pixels, local storage, and similar technologies to operate the Services, remember your preferences, analyze usage, and personalize content. Categories of cookies we use include:

Strictly necessary cookies that are required for the Services to function.
Functional cookies that remember preferences and settings.
Analytics cookies that help us understand how users interact with the Services.
Marketing cookies that may be used to measure the effectiveness of our marketing.

You can control cookies through your browser settings and through our cookie preferences interface where available. Blocking some cookies may affect the functionality of the Services.

Data retention

We retain personal information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements.

Account information is retained for the duration of your account plus a reasonable period after termination for backups, dispute resolution, and legal compliance.
Data received from advertising platforms is retained only as long as your integration with that platform is active and for a limited period afterward, subject to that platform's developer terms.
Log and usage data is typically retained for up to twelve months.
Backups containing personal information are retained according to our backup retention schedule and are securely deleted when no longer needed.

When personal information is no longer needed, we delete it or anonymize it in accordance with our retention policies.

Your rights and choices

Depending on your location, you may have the following rights regarding your personal information:

Access — request a copy of the personal information we hold about you.
Correction — request that we correct inaccurate or incomplete information.
Deletion — request that we delete your personal information, subject to certain exceptions.
Portability — request a copy of certain personal information in a portable format.
Restriction — request that we restrict certain processing of your personal information.
Objection — object to certain processing, including processing based on legitimate interests.
Withdraw consent — withdraw consent at any time where we rely on consent to process your information.
Lodge a complaint — file a complaint with your local data protection authority.

To exercise these rights, contact us at privacy@grxd.app. We will respond within the timeframes required by applicable law. We will not discriminate against you for exercising your rights.

California residents

If you are a California resident, you have additional rights under the CCPA and CPRA, including:

The right to know what categories of personal information we collect, the sources of that information, the purposes for which we use it, and the categories of third parties with whom we share it.
The right to delete personal information we have collected about you, subject to certain exceptions.
The right to correct inaccurate personal information.
The right to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law.
The right to limit the use of sensitive personal information.
The right to non-discrimination for exercising your rights.

You may exercise these rights by contacting us at privacy@grxd.app or through the privacy controls in your account.

Authorized agents

You may designate an authorized agent to make a request on your behalf. We may require verification of the agent's authority and your identity before processing the request.

International data transfers

Grxd is based in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate. We use appropriate safeguards for international transfers, including Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office where applicable.

Children's privacy

The Services are not directed to individuals under the age of 16, and we do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us and we will take steps to delete it.

Security

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, and destruction. These include encryption in transit and at rest, access controls, regular security reviews, and employee training. No system is perfectly secure, and we cannot guarantee absolute security.

If we become aware of a security incident affecting your personal information, we will notify you and any relevant authorities as required by applicable law.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on this page, updating the "Last updated" date, and where appropriate by email or in-product notification. Your continued use of the Services after the updated policy takes effect constitutes acceptance of the changes.

Contact us

If you have questions, comments, or concerns about this Privacy Policy or our privacy practices, you can contact us at:

Grxd Inc. Attn: Privacy privacy@grxd.app

For data protection inquiries from the European Economic Area, United Kingdom, or Switzerland, you can contact our privacy team using the address above.