Privacy Policy

Effective date: 2026-05-14

1. Who we are

Grove is a service of Infruition LLC, a Tennessee limited liability company. Infruition LLC ("Infruition", "we", "us") operates Grove, a software service for Amazon advertising strategists. This Privacy Policy explains what data we collect, why we collect it, how we store it, who we share it with, and the rights you have over it.

2. Data we collect

We collect three categories of data, each with a clear purpose.

Account data. Email address, full name, organization name, and authentication identifiers issued by our identity provider (Google or Amazon LWA). We use this to authenticate you, provision a workspace, and contact you about service issues.

Customer-of-customer advertising data. When you connect an Amazon Advertising account, we retrieve campaign metadata, performance metrics, search-term performance, keyword lists, and other reporting artifacts that you authorize us to access via the Amazon Ads API. We use this data to render dashboards, generate recommendations, and produce reports for you.

Operational telemetry. Anonymized error logs, request timing, and usage events. We use this to keep the service reliable and to plan improvements.

We do not knowingly collect data from children under 13 and the service is not directed at them.

3. How we use data

We use the data described above only to operate, maintain, and improve Grove for you. Specifically: to authenticate your sessions, to call the Amazon Ads API on your behalf with the scopes you grant, to compute recommendations from your account's performance, to generate audits and weekly recaps, and to send transactional notifications. We do not sell personal data, advertising data, or operational telemetry.

4. Where data is stored

Grove data is stored in Postgres on Supabase, hosted on AWS infrastructure. All data at rest is encrypted with AES-256 by the storage layer. All data in transit is encrypted with TLS 1.2 or higher. Refresh tokens for the Amazon Ads API and the Amazon Selling Partner API are stored in a server-side table accessible only to a service-role credential held by our application servers; they are never returned to a browser or third-party client.

5. Who we share data with

We do not share customer data with third parties for their own purposes. We use the following infrastructure providers, each contractually bound to handle data only on our instructions: Supabase (database and authentication), Vercel (hosting and edge delivery), OpenAI and Anthropic (large language model inference, when AI features are invoked), Google (sign-in identity provider), and Amazon (advertising data source). When AI features are used, we send only the minimum subset of campaign and search-term performance data required to compute the requested output. We never send buyer personally identifiable information to AI providers, and we do not permit those providers to use our data to train or fine-tune their models.

We disclose data when legally compelled, such as in response to a valid subpoena, but we will challenge requests we believe are overly broad, and we will notify you when we are not legally prohibited from doing so.

6. Data retention

Account records are retained while your account is active and for 30 days after closure to allow recovery. Raw campaign and search-term performance data is retained for 90 days by default; you may request a longer retention by emailing us. Aggregate, derived analytics that no longer reference an individual customer or end user may be retained longer for historical comparison. Refresh tokens are revoked and deleted within 24 hours of disconnection.

7. Your rights

You may request access to, correction of, or deletion of your data at any time by emailing hello@infruitionmarketing.com. We will respond within 30 days. If you are in the European Economic Area, the United Kingdom, or California, you have additional rights under the GDPR, UK GDPR, and CCPA respectively, including the right to data portability, the right to object to certain processing, and the right not to be subject to solely automated decisions that produce legal effects.

7a. AI-assisted features and automated decisions

Grove uses AI models from OpenAI and Anthropic to draft listing copy, classify search terms by intent, summarize account activity, and (with your authorization) recommend or execute optimization actions on connected Amazon accounts. We classify every AI action by impact: read-only and low-impact analytical actions run automatically; routine writes such as a single bid change within prudent limits run automatically with full audit logging; and high-impact actions — including any price change greater than 20%, bulk listing operations affecting more than 500 products, account-level configuration changes, and brand registry actions — require explicit human approval through an in-app queue before they are executed. Every AI-assisted change is logged for 12 months with the model used, the reasoning provided, and (where applicable) the human who approved it. A kill switch allows us to halt all AI activity immediately if anomalies are detected. You can request to disable AI features on your account at any time.

8. International transfers

Our infrastructure is currently hosted in the United States. If you access Grove from outside the United States, you consent to your data being processed there.

9. Security incident notification

If we determine that a security incident has materially affected your data, we will notify you within 24 hours of confirmation, with the facts known at that time, the steps we have taken, and the remediation we recommend. See our Security overview for the full incident response policy.

10. Changes to this policy

We may update this policy. Material changes will be announced by email to active accounts and posted at this URL with a new effective date. Continued use after the effective date constitutes acceptance.

11. Contact

Email hello@infruitionmarketing.com for any privacy question, data access request, or correction. You may also reach us by mail at: