Privacy notice

Who we are

Groundforth Inc operates Groundforth from Elephant Hill Estate, Karu, Abuja, Nigeria. Contact us at hello@groundforth.com.

We act as a data controller for website inquiries, account administration, and service operations. We act as a data processor for customer workspace content processed on the customer's instructions. If your organization controls your workspace, contact its administrator about that content; we can help route your request.

Information we use

Contact information includes your name, work email, optional organization, request category, and message. Account and workspace information includes identity, membership, permissions, selected sources, project work, communications, versions, and operational records. We also use technical information needed to deliver and protect the service, such as request and security logs.

If you allow analytics, Google Analytics receives privacy-filtered events about normalized page routes, coarse clicks and form activity, scroll milestones, section views, conversion steps, browser performance, broad client-error types, and allowlisted campaign labels. We do not intentionally send names, email addresses, workspace content, project or organization names, messages, prompts, filenames, payment details, stable account identifiers, or URL query values. Google may process technical information such as your browser, device, approximate location derived from your network connection, and analytics cookie identifiers under its own terms.

Customer content is encrypted in transit and through Azure-managed encryption at rest. Our policy is that team access to your core workspace data is not routine. Encryption at rest protects stored media; it is not end-to-end encryption, so authorized service processing can access content when required to provide features you request.

Why we use it

We use information to respond to inquiries, provide accounts and workspaces, process the project sources and knowledge you select, support collaboration and human review, handle support requests, and protect the service. With your consent, we use analytics to understand which public pages and product actions are used, where acquisition funnels lose momentum, and how the service performs. We do not use customer workspace content to train our AI models. For Google Workspace data, see our Google API Limited Use commitment.

If a support issue cannot be resolved without inspecting your workspace content, our policy is to explain the access required and ask for your explicit permission before a member of our team accesses that content.

Depending on the activity and applicable law, our basis is performing an agreement, complying with legal obligations, our legitimate interests in running and securing the service, or your consent where required. Optional Google Analytics processing relies on your consent. You may withdraw it at any time without affecting earlier lawful processing.

Providers and sharing

We use service providers for infrastructure, identity, communications, AI processing, service monitoring, and—only after you allow it—Google Analytics. They receive information needed for their role. Workspace content is shared with the people authorized by your organization and with providers involved in the requested processing. Google Analytics is not authorized to receive Groundforth workspace content.

We may also disclose information when legally required or necessary to protect rights and safety. Processing locations depend on the services involved; we do not promise that all processing occurs in Nigeria. Contact us for provider, transfer, or data-processing agreement questions.

Groundforth Mail and Drive

If your organization uses Groundforth Mail, we process the business email you send and receive on your custom domain. This includes message content and attachments and message metadata such as sender and recipient addresses, subject lines, timestamps, routing headers, and delivery and security signals. We use this information to transmit, store, display, and secure your mail, to filter spam and abuse, and to provide the features you request. Outbound email is delivered through Microsoft Azure Communication Services, and the mail service is hosted on Microsoft Azure. You are responsible for configuring and maintaining the DNS records for your domain, including authentication records; Groundforth does not modify your DNS on your behalf.

Groundforth Drive stores the files your organization uploads and the folders and sharing settings you create, together with operational records such as upload, access, and link activity. Uploaded files pass through malware-screening controls. When you create a public link, anyone who has that link can open the file until you disable it, so share links only for content you intend to make broadly reachable. Mail and Drive content is treated as customer workspace content under this notice: it is encrypted in transit and through Azure-managed encryption at rest, and we do not use customer workspace content to train our AI models.

Retention and deletion

We retain information while needed to provide the service or respond to your request. Deleted customer content is retained for up to 30 days after deletion for recovery and cleanup, then removed. We may retain records required by law or needed for a security investigation, dispute, or legal hold for that specific purpose.

The essential analytics-choice cookie lasts up to 180 days. If you allow analytics, Groundforth limits its first-party Google Analytics cookies to 180 days. Event-level retention in Google Analytics is controlled in the Groundforth GA4 property; aggregate reports may remain after event-level data expires. Withdrawing consent stops future dispatch and clears accessible Groundforth analytics cookies, but it does not retroactively remove events already received by Google. Contact us about an analytics privacy request.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing. You may also complain to the relevant data protection authority, including the Nigeria Data Protection Commission.

Use Privacy/data requests or email us. We may verify your identity and authority before acting. Please do not send passwords, authentication codes, full financial details, or sensitive project content.

Cookies and analytics choices

Essential session technologies support account access, security, and remembering your analytics choice. Google Analytics does not load until you choose “Allow analytics.” Choosing “Essential only” is equally available and does not affect access to Groundforth. Advertising storage, ad personalization, Google Signals, and cross-site audience features are disabled in our tag configuration.

Use the “Privacy choices” control shown on Groundforth to allow or withdraw analytics at any time. Withdrawing stops future analytics events and removes the accessible analytics cookies and session campaign labels we set. You can also clear cookies in your browser. Google's processing is described in its Privacy Policy.

We will update the effective date when this notice changes and communicate material changes as appropriate.