Groovian Ltd ("Groovian", "we", "us", "our") operates the Groovian fraud intelligence platform and the groovian.com website. This privacy policy explains how we collect, use, and protect information when you use our services.
Information We Collect
Account Information
When you create an account or contact us, we collect your name, email address, company name, and role. This information is used to manage your account and communicate with you about our services.
Fraud Signal Data
Personally identifiable information (PII) submitted to Groovian, whether through the platform UI, the v1 API, or our official SDKs, is cryptographically blinded on the client before it is transmitted. Groovian uses an Oblivious Pseudorandom Function (OPRF, RFC 9497, P256_SHA256): identity values are normalised, hashed to an elliptic-curve point, and blinded with a per-request secret in your own environment. Only the blinded group elements ever leave your environment. Our OPRF service evaluates them without learning the underlying input; the resulting tokens are sent to the v1 API.
The result is a stronger guarantee than standard hashing: Groovian does not store, access, transmit, or process raw PII at any point in the pipeline, and even our OPRF service is mathematically prevented from recovering the original values. Tokens are deterministic for a given input, which is what makes cross-organisation matching possible, but they are not reversible.
Payment Information
Payment processing is handled by Stripe. Groovian does not store credit card numbers or payment credentials. Stripe collects and processes payment information in accordance with their own privacy policy and PCI DSS compliance standards.
Usage Data
We collect anonymised usage data including pages visited, features used, and API call volumes. This data helps us improve the platform and is never tied to individual users or organisations.
Website Analytics
We use Fathom Analytics for website analytics, a privacy-focused provider that does not use cookies and does not track individual visitors. We also use PostHog for product analytics within the platform to understand how features are used and improve the experience. PostHog data is used solely for product improvement and is not shared with third parties.
How We Use Your Information
- To provide and maintain the Groovian platform
- To manage your account and organisation membership
- To communicate with you about your account, updates, and support
- To process form submissions (sales inquiries, investor interest)
- To improve the platform based on anonymised usage patterns
Data Encryption and Security
All data transmitted to and from Groovian is encrypted in transit using TLS. All data stored on our systems is encrypted at rest. Identity values inside fraud signals are OPRF-blinded inside the SDK or client before any network call, so Groovian never receives or stores the original data, and our OPRF service never sees the unblinded inputs either.
We implement industry-standard security measures to protect your information, including access controls, audit logging, and regular security reviews.
Data Sharing
Groovian does not sell, rent, or share personally identifiable information with third parties. Specifically:
- PII submitted as part of fraud signals is never shared. All identity data is OPRF-blinded client-side and cannot be reversed.
- Fraud signal metadata (fraud type, severity, timestamps) may be shared across participating organisations in anonymised, aggregated form as part of the core intelligence network functionality.
- Account information is never shared with other organisations on the platform.
- We may share information with service providers who help us operate the platform (hosting, email, analytics, payment processing), subject to strict confidentiality agreements. These include Stripe for payment processing, PostHog for product analytics, and Fathom for website analytics.
- We may disclose information if required by law, regulation, or legal process.
Data Retention
We retain account information for as long as your account is active. If you close your account, we will delete your personal information within 30 days, except where retention is required by law. Anonymised fraud signal data (OPRF tokens and metadata) may be retained to maintain the integrity of the intelligence network.
Your Rights
Depending on your location, you may have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Object to or restrict processing of your information
- Request a portable copy of your data
To exercise any of these rights, contact us at the address below.
Cookies
The Groovian website does not use advertising cookies. We use Cloudflare Turnstile for bot protection on our forms, which may set a functional cookie required for security verification. Stripe may set cookies necessary for payment processing. PostHog may set cookies within the platform for product analytics. Fathom Analytics does not use cookies.
Children's Privacy
Groovian is not directed at individuals under 18. We do not knowingly collect information from children.
Changes to This Policy
We may update this privacy policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "last updated" date.
Contact
If you have questions about this privacy policy or our data practices, contact us at groovian.com/contact.