Data & privacy

Honest about how we handle data

No fabricated certifications. No SOC 2, no ISO 27001 claims — we are an early-stage platform and we will not pretend otherwise. Here is what we actually do.

Consent-first capture
Every lead record requires an explicit consent tick before it is stored. We do not capture contact details silently or by implication. Consent is a required field, not a checkbox buried in small print.
Server-side validation, no client secrets
All input is validated on the server before storage. No API keys or credentials are exposed to the browser. The public-facing form talks to our own backend; the backend talks to vendors.
No third-party trackers
groit.global loads no Google Analytics, Meta Pixel, Hotjar, or equivalent. The only telemetry is a single privacy-clean event counter we run ourselves: page views and form submits, no PII, no cookies.
No mailing lists
Submitting your details to groit.global does not add you to any marketing list. We will contact you about your walkthrough request and nothing else. You can ask us to delete your record at any time.
Per-tenant isolation
Each customer gets a dedicated subdomain (yourbrand.groit.global) and a dedicated database. There are no shared tenant tables. One customer's data cannot be queried or accessed by another.
UK / EU hosting
The groit platform runs on Fly.io in the London region (lhr). Data does not leave UK/EU jurisdiction in normal operation.
GDPR retention — Phase 2 roadmap
Automated data retention and right-to-erasure tooling is on the Phase 2 roadmap. In Phase 1, retention is managed manually on request. If you need a DPA or data-deletion confirmation, contact us directly.

Questions about your data, a deletion request, or a DPA? Talk to us directly — we will respond within one working day.