Privacy Policy

1. Who we are and what this notice covers

Grosa is a software project developed by Mars AI Technology Solutions Limited, registered in England and Wales under company number 14863498. Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are the controller of personal information used for our own website and business-enquiry purposes.

This notice covers www.grosa.io and enquiries made to the Grosa team. It does not replace the service-specific arrangements for a customer's Grosa workspace. A business using Grosa may be the controller of its staff or customer records; the relevant service agreement and data-processing arrangements must define our role for that processing.

2. Information you provide

Our enquiry form asks for your name, work email, business name, industry and the kind of enquiry. You may choose modules and add a message. If you arrive through a plan enquiry, the selected plan and billing preference may also be included. We keep a request reference, the submission time, your contact permission and the team's review status.

The required fields allow us to understand and reply to your request. Without them, the form cannot save a complete enquiry; you can contact us directly by email instead. Optional fields can be left blank. Emails and subsequent conversations may contain contact details and information you choose to share about your business.

Please do not send passwords, payment-card details, sensitive personal information, customer databases or staff records in an initial enquiry. If a project requires data exchange, the scope and appropriate sharing method should be agreed separately.

3. Technical information when you visit

Website delivery and security infrastructure handle technical information such as your IP address, requested URL, browser details and request time. This supports delivery, troubleshooting and protection against abuse. Our form also uses a hidden anti-spam field and short-lived server-side request counters. The email-specific counter uses a keyed hash of the submitted address, rather than placing an email address in the counter's name.

Public pages load fonts from Google Fonts. Your browser connects to Google to request those files, which exposes connection information such as an IP address and browser request details to that provider. The optional WordPress emoji-support storage probe is disabled on our public marketing pages. See our Cookie Policy for the current browser-storage and third-party resource information.

The Industries page also references a background-video resource on the TheGem demo-content host, democontent.codex-themes.com. A browser that requests this resource shares technical connection information with that host, even if the resource does not load.

4. Why we use information and our lawful bases

We use enquiry information to understand your requirements, arrange or discuss a demonstration and respond to your questions. Where you personally request steps towards a contract, processing may be necessary for those pre-contractual steps. When you act for a business, our basis is our legitimate interest in handling relevant business enquiries and communicating with its representatives.

We also rely on legitimate interests for proportionate website operation, security, abuse prevention and relevant business record-keeping, balancing those purposes against your rights and reasonable expectations. Where a legal requirement applies, the basis is compliance with that obligation. Where processing requires consent, we will seek it for that specific purpose.

The form's contact permission concerns your enquiry. It does not enrol you in unrelated advertising or a newsletter. You can ask us to stop optional follow-up contact. We do not use the website enquiry workflow to make decisions with legal or similarly significant effects solely through automated processing.

5. Who may receive information

Access to saved enquiries is restricted to authorised administrators. Information may also be handled by technical providers involved in hosting, website delivery, security and backups, or by professional advisers where necessary for a relevant matter. The categories of recipient depend on the activity; they are not permission to share a request with every provider discussed on our Integrations page.

Google and the TheGem demo-content host receive the technical resource requests described above when those requests are made. If you email us, email-service infrastructure handles that correspondence. Submitting the website form currently stores a private request record; automatic email notifications from the form are not configured.

Information may be disclosed where required by law or where necessary to address a legal claim. We do not sell website enquiry records.

6. Location of processing and international transfers

Our company is based in the United Kingdom. Technical infrastructure and provider operations can be located in other countries, so this notice does not promise that all processing takes place only in the UK. The Google Fonts connection is a separate third-party request.

International transfers subject to data-protection restrictions require an applicable legal mechanism, such as an adequacy decision or appropriate contractual safeguards. You can contact us to ask which providers, processing locations and transfer arrangements are relevant to your information, or request information about applicable safeguards. A proposed customer-service setup should confirm these matters in its own data-processing arrangements before personal data is transferred for that service.

7. How retention is determined

Enquiry records are retained according to the purpose of the enquiry, whether it remains active, any resulting business relationship, the information needed to resolve questions or disputes, and applicable legal requirements. A website request does not create a promise to retain every detail indefinitely or to remove it automatically after a fixed number of days.

The current request system has no automatic expiry for saved enquiries; removal requires an authorised review. If an enquiry is closed or you no longer want us to retain its optional details, contact us so we can assess what can be removed and what, if anything, must be kept for a legitimate or legal reason.

Short-lived anti-abuse counters expire separately from enquiry records: the email-specific counter has a 15-minute expiry and the overall request counter has a one-hour expiry. Browser session storage is separate again. Restricted backup copies may remain until their backup lifecycle ends; deletion from the active enquiry record is not a promise of immediate removal from every backup.

8. Security and your responsibilities

The website uses HTTPS, and saved enquiries are held as private records with administrator access controls. These measures reduce risk; no website or communication method can be guaranteed completely secure.

Keep your own account credentials private. Use the enquiry form for a short business overview, and contact us to agree an appropriate channel before sharing confidential project data. If you believe you have sent information in error, tell us promptly and identify the relevant request reference if available.

9. Your choices, rights and complaints

Depending on the circumstances and applicable law, you may request access to your information, correction, erasure, restriction or portability. You may object to processing based on legitimate interests and withdraw consent where consent is the basis. These rights have conditions and exemptions; a request to erase information does not override every legal retention obligation.

Send requests to [email protected]. Explain the request and provide enough information to locate your record. We may need proportionate identity information to protect your data from disclosure to someone else. We will handle requests within applicable statutory time limits, ordinarily one month for an access request, subject to permitted clarification or extensions.

You can raise a concern with us or complain to the UK Information Commissioner's Office. Where applicable, you can also contact the relevant supervisory authority in your country. You do not have to contact us first to exercise a right to complain.

10. Links, changes and contact

Other websites and service providers have their own privacy information. Following a link from Grosa does not place their processing under this notice. This website is directed at business users and is not designed to collect enquiries from children.

We will update this notice when relevant website practices change and show the review date at the top. Significant changes affecting how existing information is used may require an additional notice. Contact Mars AI Technology Solutions Limited at our registered office or [email protected] for Grosa privacy questions.