Your data, bounded — and on a record you can audit.

What this policy covers

This policy covers platform data and this public site. Where the data is about your customers — a lead, a commenter, a newsletter subscriber — you are the controller and we process it on your instructions and within the contract; your own policy governs your relationship with them.

Purpose and basis

We process data for three purposes only: performing the contract with you, meeting a legal obligation, and a narrow legitimate interest in securing the platform and preventing abuse.

We do not sell or rent data, and we do not use one client’s data to improve another client’s work.

Isolation between clients

Isolation is enforced in the database rather than in the interface: every row has an owner, and the policies refuse reads from outside the organisation the session names. When no organisation is set, they deny everything rather than allow everything — the difference that turns a forgotten filter into nothing instead of into a leak.

Internal access is least-privilege and bound to a declared role. Sensitive actions require a fresh proof of identity before they run, and a second factor is available and recommended rather than mandatory on every role.

Technical controls

• Encryption in transit, and integration secrets sealed each under its own key beneath a wrapped key-encryption key.
• Files are scanned before they are written, so an infected upload never reaches storage at all.
• Storage keys carry no client-supplied component, rate limits on public endpoints, and upload size bounded at the socket rather than after the whole file arrives.
• An audit log of privileged actions that cannot be edited or deleted once written.

Service providers

We rely on providers for things we should not build ourselves: hosting and the database, the gateway that publishes to social platforms, AI model providers, and the payment processor. Each has a processing agreement, and the register of processors and sub-processors is available to you on request.

Cross-border transfer

Some providers process outside your country, and the database is currently hosted in the European Union — which is itself a cross-border transfer for a Saudi client. Saudi Arabia’s Personal Data Protection Law and its rules on transfer outside the Kingdom are a live consideration, not a closed one.

So in-Kingdom hosting, a data-processing agreement and a transfer assessment are settled in your contract before signature, and none of the three is described here as settled.

Retention

Retention is set per client rather than by one rule for everyone, and the period that applies to you is the one in your contract or in the processing agreement attached to it.

On deletion, content is erased according to that period. What remains in the audit log is non-sensitive metadata — that something happened, who did it, and when — because a record that can be emptied is not a record. We say so here rather than promising total erasure and quietly keeping the log.

Your rights

• Request a copy of your data in a machine-readable format.
• Request correction of inaccurate data.
• Request deletion, within what applicable law and the contract allow.
• Object to processing that rests on legitimate interest.

Requests go to your named account owner inside the platform, or to the address stated in your contract, and we respond within the period the law applicable to your case requires.

Facebook and Instagram

When you connect Facebook and Instagram, Meta sends us what you approve on its own screen, and nothing else:

• An access token for the Pages, Instagram accounts and ad accounts you chose, stored encrypted and decrypted only for the request that needs it.
• The names and identifiers of those Pages and accounts.
• The posts published on them: text, link, picture address and time, and the number of reactions, comments and shares on each.
• The figures Meta reports for them, such as reach, impressions, clicks, spend and results.
• Meta’s notices about activity on your Pages, which can carry the name and words of someone who commented. We act only on a post being removed, and delete each notice 30 days after handling it.

We use it to publish what you approved, to measure it on your dashboards and in your reports, to check that what was published is still live, and to learn your brand’s voice from what it has already published, for that brand alone. We do not sell it, we do not build a profile of any person from it, and no other client sees it. When a task sends the text of a post to an AI provider, the AI use disclosure applies.

To stop us reading anything further, disconnect Meta under Connections in Grokerz, and the access token is deleted at once. You can also remove Grokerz on Facebook, under Settings and privacy, Settings, Business integrations, which withdraws our access on Meta’s side.

To have what we received from Meta deleted as well, write to hello@grokerz.com from the address on your account, or ask your account owner inside the platform. We delete it within 30 days and confirm in writing. The posts you approved and published through Grokerz stay in your workspace, because they are your own work rather than something Meta sent us.

Data and artificial intelligence

Only what a task needs reaches a model provider, and one client’s data is never sent inside another client’s context. Automatic classification before a call, and a per-client policy over which providers may be used at all, are not built yet: today that restriction is platform configuration rather than a clause in your contract. The full detail is in the AI use disclosure, which is part of this policy rather than a marketing appendix to it.

Changes

We may update this policy. Any material change to the data categories or to the list of providers is communicated to subscribed clients before it takes effect, not after.