Privacy Policy

Who is responsible for your data

For the purposes of the DPDP Act, Grosco is the Data Fiduciary for the personal data described here: we decide why and how it is processed. You can reach us at [email protected] or on WhatsApp at +91 90805 25297.

What we collect

We collect only what we need to reply to you and to run the site.

• When you apply. The Apply form asks for your name, WhatsApp number and brand name, and optionally your website or Instagram handle, what you need, where your brand is today, your monthly marketing budget and your main goal.
• How you found us. With an application we record the page you first landed on, the referring site, and any campaign tags in the link you followed (such as utm_source, gclid or fbclid), plus the time you applied and how long the form took.
• When you message us. If you write to us on WhatsApp or by email, we receive your number or address and whatever you choose to send.
• When you browse. Our host, Cloudflare, processes technical data such as your IP address, browser and the pages requested, to deliver the site and protect it from abuse.
• Analytics. If Google Analytics is switched on (see Cookies, below), it records how the site is used: pages viewed, approximate location, device type, and whether an application was sent or a WhatsApp link was clicked.

We do not ask for, and ask you not to send, sensitive personal data or information as defined in the SPDI Rules, such as passwords, bank or card details, health information or biometric data.

Why we use it

• To read your application, reply to you (we aim to within 2 days), and decide together whether there is a fit.
• To arrange a discovery call and prepare a proposal.
• To understand which pages and channels bring people to us, so we can improve the site.
• To keep the site secure and working.
• To meet our legal obligations.

We do not sell your personal data, and we do not use it for advertising profiles.

Your consent

By sending the Apply form or messaging us, you consent to us processing the details you give for the purposes above, as required by section 6 of the DPDP Act. You can withdraw that consent at any time by writing to us; we will then stop processing your data and delete it, unless the law requires us to keep it. Withdrawing consent does not affect processing that happened before.

Who we share it with

We share personal data only with service providers that process it on our behalf, under contract, and only as far as they need to:

• Cloudflare, which hosts and delivers this website.
• n8n, the automation tool that receives an application and passes it on.
• Google, for Google Sheets and email (where applications are stored and we are notified) and, when switched on, Google Analytics.
• Meta (WhatsApp), when you message us on WhatsApp, under WhatsApp’s own privacy policy.
• Specialists we bring in for an engagement, only after you become a client and only what the work requires.

We may also disclose data where the law requires it, for example to a government agency under a lawful order.

Where it is stored

Some of these providers store data on servers outside India. Section 16 of the DPDP Act allows this except to countries the Central Government restricts; we will not transfer data to any such country.

How long we keep it

We keep an application, and the messages around it, for as long as we are in conversation and for up to 24 months after our last contact, then delete it. If you become a client, we keep what our agreement and the law (for example tax and accounting rules) require. Hosting logs are kept by Cloudflare for a short period under its own policy.

How we protect it

We follow reasonable security practices as required by Rule 8 of the SPDI Rules and section 8 of the DPDP Act: access to applications is limited to the people who need it, the accounts that hold them are protected, and the site is served only over HTTPS. If a personal data breach occurs, we will inform the Data Protection Board of India and the people affected, as the DPDP Act requires.

Your rights

Under the DPDP Act you have the right to:

• ask for a summary of the personal data we hold about you and how we use it, and who we have shared it with;
• have inaccurate or incomplete data corrected and updated;
• have your data erased once it is no longer needed for the purpose you gave it, or when you withdraw consent;
• have a grievance about our handling of your data addressed by our Grievance Officer;
• nominate someone to exercise these rights for you if you die or become unable to.

To use any of these rights, write to [email protected]. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Cookies and similar technologies

Analytics cookies. If Google Analytics 4 is switched on, it loads only after you choose Accept in the cookie prompt. It then sets first-party cookies (named _ga and _ga_ followed by an ID) that last up to two years and let it count visits without identifying you by name. If you choose Reject, Google Analytics does not load and sets no cookies. We remember your choice in your browser’s local storage, and you can change it at any time from “Cookie settings” at the foot of every page; withdrawing consent stops Google Analytics and deletes its cookies. You can also block or delete cookies in your browser settings, or install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout. We do not use advertising or cross-site tracking cookies.

Storage for this visit only. The site keeps a few small notes in your browser’s session storage, which is cleared when you close the tab: whether you turned the film’s sound on, the campaign tags you arrived with (so they can go with an application), whether a page transition is under way, and whether the WhatsApp button has already pulsed. None of these are cookies and none leave your browser, except the campaign tags when you send an application.

Fonts and video. Fonts and film clips are served from our own host, so no font or video provider sees your visit.

Children

The site and our services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us their details, write to us and we will delete them.

Grievance Officer

In line with Rule 5(9) of the SPDI Rules and the DPDP Act, our Grievance Officer handles any concern about how we process personal data and will respond within one month of receiving it.

• Grievance Officer: Premnath Mohan
• Email: [email protected]
• Location: Chennai, Tamil Nadu, India

Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top. Significant changes that affect data we already hold will be told to you directly where we can.