Introduction

Welcome. This is the Privacy Policy and Personal Data Notice applicable to our website www.group.app, encompassing its sub-domains and mobile-optimized versions (“Site”), our mobile application (“App”), and our related services (together, the “Platform”). We recommend you also read our Terms and Conditions of Service (“Terms”), along with any rules, guidelines, and ancillary policies referenced herein.

This Policy applies to the Platform, any website that references this Policy, and any data we collect across partnered and unaffiliated websites in connection with the Platform. This Policy also applies to Personally Identifiable Information (“PI”) collected through the mobile version of the Site or the App, regardless of operating system, device, or browser.

Capitalized terms not defined in this Policy have the meaning given to them in our Terms. By accessing or using the Platform, you affirm that you have read, understood, and agreed to this Policy and our Terms.

Definitions

• “App” — our mobile application software.
• “Policy” — this Privacy Policy.
• “Group.app,” “our,” “us,” or “we” — GroupApp Inc. and its subsidiary, GroupApp LLC, collectively, which together own and operate the Platform.
• “Site” — www.group.app.
• “You,” “your(s),” or “yourself” — a visitor or end user of the Site and/or App.
• “Creator” — the individual or entity that owns a community, course, or membership on the Platform (the “Owner”), together with any Community Admins, Group Admins, or other team members the Owner authorizes to help manage it. The Owner remains responsible for that community’s compliance with this Policy regardless of any access the Owner delegates.
• “PI” — Personally Identifiable Information: information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context.
• “Sensitive Personal Information” or “SPI” — categories of PI subject to heightened protection under applicable law.
• “Sell” and “Share” — have the meanings given under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, “CCPA”), and analogous terms under other applicable state privacy laws.
• “Terms” — our Terms and Conditions of Service.

The terms “collect,” “process,” “treat,” “use,” “share,” “disclose,” and “divulge” refer to your PI and other data collected from our visitors and end users.

User Agreement & Registration

As a user of the Site and/or App, you will be asked to agree to this Policy by clicking “I Agree” on the registration form, pop-up box, or other analogous means. That action constitutes a legal, binding agreement between you and Group.app.

This Policy is freely available for your review prior to registration. If you do not agree to its terms, your remedy is to not register an account and to discontinue use of the Site and App.

The Site is the initial point of contact between you and Group.app and serves as the point of collection of any personal data you provide. By registering with us and/or otherwise using our products and services, you consent to the collection, transfer, processing, storage, and disclosure of your PI as described in this Policy, except where applicable law requires a different legal basis, in which case that legal basis governs.

Services Rendered

Group.app offers a platform for community creators and community members to share and expand their experiences by engaging and collaborating, where members receive benefits from Creators in exchange for a paid membership subscription.

Group.app provides an interactive platform where Creators may post and promote experiences and benefits on different subjects and courses. Users share knowledge with other community members through online courses and exclusive community content. Group.app is designed to engage and retain customers through online courses, forum boards, and community-based engagement features.

Group.app furnishes its online services (the “Services”) to: (i) visitors that browse the Site or App; (ii) registered users (both community Members and Creators); and (iii) any other users who have opened an account, all subject to the Terms.

Our Role in Processing Personal Data

Group.app acts as a data controller, or “business” under certain U.S. privacy laws, when we determine why and how personal information is processed — for example, information used to create and administer Group.app accounts, manage subscriptions and billing, operate our Site and App, provide customer support, secure the Services, and communicate with and market to Creators and prospective business customers.

When a Creator uses the Services to build and operate their own community, that Creator generally determines the purposes and means of processing their community members’ personal information — for example, deciding who to admit, what content to share with them, and how to communicate with them. In those circumstances, the Creator acts as the controller or business for that member data, and Group.app acts as the Creator’s processor, service provider, or contractor, processing that data only as instructed by the Creator and as described in our agreement with them.

If you are a community member and want to exercise a privacy right regarding information held within a specific community, we recommend contacting that community’s Creator directly, as they generally control that data. We will provide reasonable assistance to Creators with such requests, consistent with our agreement with them and applicable law. We are prepared to enter into a data processing agreement with Creators upon request.

Children’s Privacy and User Eligibility

Group.app does not knowingly provide its Services to, or collect personal information from, children under the age of thirteen (13), consistent with the Children’s Online Privacy Protection Act (“COPPA”). If you are under thirteen (13), you may not use the Platform. If you are between the ages of thirteen (13) and the age of majority in your jurisdiction, you may only access Group.app and our Services under the direct supervision of a parent or legal guardian, who must create and hold the account on your behalf and agrees to be bound by this Policy and our Terms.

Users are prohibited from providing Group.app with the personal information of any person under thirteen (13) without verifiable parental or guardian consent. If we learn that we have collected personal information from a child under thirteen (13) without such consent, we will delete that information as soon as reasonably practicable, and will not use or disclose it beyond what is necessary to respond to the collection.

Parents or guardians who believe we may have collected information from their child without consent may contact us at the address in the “Contact” section to request review, correction, or deletion of that information.

We reserve the right to request proof of age or parental consent at any time, at our sole discretion. Failure to provide such proof may result in the immediate freezing, blocking, or cancellation of the account, with no liability to Group.app.

How Do We Collect Information?

When registering on the Site and/or App, implementing any API, plug-in, or computer code component, making an in-app purchase, purchasing a recurring subscription, providing user-generated content, using third-party advertising networks, or through other applicable means, our platform collects certain PI.

We may also collect information when you subscribe to a newsletter, respond to a survey, fill out a form, use live chat, or otherwise enter information on the Site and App. If you choose not to provide certain personal data, we may not be able to provide the requested service.

Through the Services, Group.app may collect the following types of PI:

Internet Protocol (IP) Addresses, Internet Tags, and Navigational Data

An IP address is a number assigned to your device by your internet service provider so you can access the internet. Depending on the jurisdiction, an IP address may itself constitute personal data or personal information — for example, EU courts have held that IP addresses can be personal data under the GDPR — even where it is dynamically assigned rather than static to a specific device. We treat IP addresses as PI where required by applicable law, and use them to diagnose problems with our servers, report aggregate information, determine efficient routing, and administer and improve our Services.

Internet tags (also known as single-pixel or clear GIFs) are smaller than cookies and communicate information such as IP address and browser type to our servers. The Site uses internet tags.

Navigational data (also known as “log files,” “server logs,” or “clickstream” data) is used for system management, improving Site content, market research, and communicating with visitors.

Why Do We Collect Personal Information?

We store PI to manage collaboration among users, improve your experience, send newsletters, and respond to inquiries about our Services. We use collected PI to:

• Provide our Services: personalize your experience, manage customer profiles and registrations, send invoices and receipts, respond to service requests, process payments and affiliate referrals, and provide user support.
• Configure your account: tailor content, suggest followers and content, offer location customization, and personalize help and instructions.
• Enable communications: facilitate user-to-user and user-to-business communications.
• Protect our Services: support fraud monitoring and prevention, general platform security, and the review of reports about Creator or Member conduct submitted under our Terms.
• Respond to inquiries: address your questions and resolve issues with our Services.
• Send marketing communications: where consistent with your marketing preferences. You can opt out of marketing emails at any time.
• Deliver targeted advertising: develop and display personalized content and advertising tailored to your interests and/or location, measure ad effectiveness, and measure reach. See “Automated Decision-Making and Profiling” below for your rights regarding this use.

If you decline to disclose PI to us, you may still be able to use some Platform functionality, though we cannot guarantee full functionality without it.

Legal Bases for Processing (GDPR)

Where the GDPR applies, we rely on the following legal bases, depending on the purpose:

• Performance of a contract: to create and administer accounts, provide the Services, process subscriptions, and respond to your requests.
• Legitimate interests: to secure and improve the Services, prevent fraud, analyze product performance, provide support, and communicate with existing or prospective Creators and business customers, where those interests are not overridden by your rights.
• Consent: for optional marketing communications, non-essential cookies, and other processing where consent is legally required. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legal obligations: to maintain tax, accounting, and compliance records and respond to lawful requests.
• Establishment or defense of legal claims: where necessary to protect Group.app, our Creators, or users.

Accepting this Policy or our Terms does not, by itself, constitute your consent to every category of processing described in this Policy. Where consent is the applicable legal basis for a specific purpose, we will seek it separately for that purpose.

Disclosure of Personal Information

• Disclosure to Affiliates and Partners. We share data with third-party vendors, service providers, contractors, or agents who perform services for or on our behalf. We may allow selected third parties to use tracking technology on the Site/App to collect data on our behalf about how you interact with the Site over time.
• Public Domain. Publicly configured user-generated content may be indexed by search engines.
• Disclosure to Business Successors. If our business is sold, merges, or files for bankruptcy such that another business becomes responsible for providing the Services, we may transfer your PI to that business, which would be bound by the terms of this Policy or a successor policy disclosed to you.
• Lawful Disclosure. We may disclose PI when we believe it reasonably necessary, or when you violate this Policy, including: (i) as required by applicable law; (ii) in response to a legal demand, warrant, or subpoena; (iii) to protect ourselves and our affiliates from third-party legal claims (including takedown notices); and/or (iv) to prevent or address conduct we reasonably believe poses a hazard to us or others.
• Vital Interests. We may disclose information where necessary to investigate or address potential policy violations, suspected fraud, threats to safety, illegal activity, or as evidence in litigation involving us.
• Data Broker Registration. If we meet the applicable statutory definition of a “data broker” under California law, we will register with the California Privacy Protection Agency as required.

Disclosure of PI to Third-Party PI Processors

To provide our Services, we use third-party platforms and tools — for example, cloud hosting, payment processing, analytics, and customer support tools — under contracts that require those providers to protect your information. These platforms are also governed by their own terms and data practices. In the event of a conflict between this Policy and such third-party terms, the third-party terms govern that party’s own independent processing of your information; this does not limit or override Group.app’s own obligations to you under this Policy and applicable law.

Payment Processing. Group.app uses reputable third-party payment processors, such as Stripe, to process subscription and membership payments. We do not store full payment card numbers on our own servers; payment data is transmitted directly to, and stored by, our payment processor in compliance with the Payment Card Industry Data Security Standard (PCI DSS).

Our Site may present hyperlinks to commercial partners and other third parties. Once you leave our Site or App through these links, we have no control over those websites and are not responsible for their privacy or data practices. Review the privacy statement applicable to any third-party website before providing information.

Commercial Message Communications Authorization

We will occasionally ask for your express permission to receive commercial electronic messages, such as newsletters, product offers, or survey invitations.

We will send service-related announcements when necessary (e.g., planned maintenance or an enhancement affecting your use of the Services). You generally may not opt out of these non-commercial, non-promotional communications.

You have the right to object to processing of your personal data for direct marketing purposes, and to opt out of promotional communications at any time by contacting us or updating your marketing preferences.

Cookie Policy

We may place “cookies” on your device to track and collect data regarding your use of the Site, App, and Services. By agreeing to our use of cookies, you permit us and our partners to place, store, and access the cookies described below, subject to your right to opt out of non-essential cookies and to the Opt-Out Preference Signals described below.

• Necessary Cookies: required for proper functioning of our Services, such as displaying content, logging in, validating sessions, and responding to service requests. Disabling these may prevent proper use of the Site.
• Functional Cookies: remember a user’s choices — such as language and username — while using our Services.
• Efficiency Cookies: collect information about how you use Group.app to help us improve the Services and measure advertising effectiveness. Some are managed by third parties and do not collect identifying information.
• Demographics and Interests Reporting Cookies: link a user’s actions during a browsing session; these typically expire at the end of the session.
• Persistent Cookies: stored between browser sessions to remember preferences or actions across visits, including for ad targeting.

We may also collect and use data in log files, including your IP address, ISP, browser, visit time, and sections visited. When you access the Platform via the App, we may use your mobile device ID or Advertising ID instead of cookies. Recent versions of Apple iOS require your express consent for advertising tracking.

You can instruct your browser to refuse cookies or notify you when a cookie is sent. Guides for disabling cookies are available at www.allaboutcookies.org and www.youronlinechoices.com.

Advertising

We and third-party vendors (such as Google) use first-party cookies (e.g., Google Analytics) and third-party cookies and tracking technologies to measure ad effectiveness and personalize advertising content.

We may report aggregated or de-identified information about ad or content performance and audience engagement to users of our Services and content publishers. We use information from advertisers only to facilitate their own campaigns and do not disclose it to third parties, other than our service providers, except as required by law.

Device IDs cannot be deleted, but you can reset your Advertising ID in your mobile device’s Settings. Learn more about opting out at Google’s advertising and privacy pages (www.google.com) or the Network Advertising Initiative (www.networkadvertising.org).

Opt-Out Choices About Third-Party Ad Networks

• U.S.: Digital Advertising Alliance’s Consumer Choice page and the Network Advertising Initiative Opt-Out page.
• Canada: Digital Advertising Alliance of Canada’s Opt-Out Tool.
• European Union: European Interactive Digital Advertising Alliance page.

Opt-Out Preference Signals (Global Privacy Control)

Unlike Do-Not-Track browser signals (discussed below), the Global Privacy Control (“GPC”) is a recognized opt-out preference signal under the CCPA and several other state privacy laws. We honor a GPC signal from your browser or device as a valid request to opt out of the sale and sharing of your personal information for cross-context behavioral advertising, and we display a confirmation on the Site so you can verify that your opt-out request has been received and applied.

You may also exercise this opt-out directly through your account privacy settings or by contacting us as described in the “Contact” section below.

Do-Not-Track Disclosure

Most web browsers include a Do-Not-Track (“DNT”) feature you can activate to signal a preference against tracking. No uniform technology standard for recognizing DNT signals has been finalized industry-wide, and we do not currently respond to DNT signals. This is separate from our treatment of Global Privacy Control signals, described above, which we do honor.

Your User Choices

You can decline to submit information to Group.app, though we may then be unable to provide certain Services. You can control notification and communication types, limit information shared on the Platform, and modify certain privacy settings, including by:

• Updating or modifying your account information at any time by logging in.
• Understanding that we will make reasonable efforts to remove deleted content from third-party platforms integrated with our standard sharing features, but cannot guarantee removal, and have no control over content shared manually by others. When you edit content, other users can see the edit history in your profile activity and content edit logs.

Data Retention

We retain PI for as long as reasonably necessary to fulfill the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements, and no longer than permitted by applicable law. When PI is no longer needed for these purposes, we delete it, anonymize it, or securely archive it, as appropriate. For example, account and profile information is generally retained for as long as your account remains active and for a limited period afterward for recovery and legal-compliance purposes; financial and transaction records are retained as required by applicable tax and accounting laws; and marketing preference records are retained to demonstrate compliance with your opt-in/opt-out choices.

Security of Collected Information

The security of your PI is important to us, but no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security. We protect information you provide through reasonable technical and administrative security measures designed to limit the risk of loss, misuse, unauthorized access, disclosure, and alteration.

Security Incident Notification. If we become aware of a security incident involving unauthorized access to your PI that triggers a notification obligation under applicable law, we will notify you and/or the relevant regulator as required by the applicable breach notification law(s) in your jurisdiction.

International Data Transfers

Group.app is based in the United States, and PI we collect may be transferred to, stored, and processed in the United States and other countries whose data protection laws may differ from those of your home jurisdiction. Where we transfer PI out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards recognized under applicable data protection laws, such as the European Commission’s Standard Contractual Clauses, where required, to provide an adequate level of protection for that data.

GDPR Notice and Your Rights as Data Subject

For purposes of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR, Group.app is a “data controller” of the PI you provide for the primary purpose of providing our Services, except where we act as a processor for a Creator as described in “Our Role in Processing Personal Data” above.

If required by applicable law based on the scale of our processing of personal data from individuals in the EU or UK, we will appoint an EU and/or UK representative and update this Policy with their contact details. If you are a resident of Switzerland, contact details for the data protection authority are available at edoeb.admin.ch.

You should review the full list of data subject rights at gdpr-info.eu/chapter-3. You may access, amend, correct, or delete your PI where inaccurate, by contacting us as described in “Contact.” We may charge a reasonable administrative fee, or decline to act, on requests that are manifestly unfounded or excessive, particularly if repetitive, as permitted under Article 12(5) GDPR.

• Right to be Forgotten (Art. 17): Request deletion of your PI. This right is not absolute; we may retain PI where necessary to comply with a legal obligation, or to establish, exercise, or defend legal claims.
• Right to Data Portability (Art. 20): Request, in a commonly used, machine-readable format, the PI you provided to us that we process by automated means on the basis of your consent or a contract with you.
• Right to Data Access (Art. 15): Confirm how and where your PI is stored and processed, and how it is shared with third parties.
• Right to Data Rectification (Art. 16): Obtain correction of inaccurate PI without undue delay.
• Right to be Informed: Be informed about the PI we collect and how we process it.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Right to Restriction of Processing (Art. 18): Request that we limit the processing of your PI in certain circumstances.
• Right to Object (Art. 21): Object to processing based on legitimate interests, direct marketing (including profiling), or research/statistics purposes.
• Rights Regarding Automated Decision-Making and Profiling: See the dedicated section below.
• Right to Complain (Art. 77): File a complaint with a supervisory authority in the EU/UK member state where you live, work, or where the alleged infringement occurred.

Your privacy request must include your name and contact details, information sufficient to verify your identity, and a clear description of the right you seek to exercise. We will respond within one month of receipt, extendable by a further two months where necessary given the complexity or number of requests; if extended, we will inform you within one month of your request.

Automated Decision-Making and Profiling

We use automated tools, including profiling, to personalize content recommendations and to target advertising to you. Depending on your jurisdiction, you have rights regarding this processing, including:

• EU/UK users: the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you (GDPR Art. 22).
• California users: where our use of automated tools meets the legal definition of a “significant decision” under California’s automated decision-making technology regulations, the right to receive notice before that use and, where applicable, to opt out of and access information about it.
• Other state law users: several states listed in “Other US State Privacy Rights” below grant a right to opt out of profiling used for decisions producing legal or similarly significant effects.

To exercise these rights, contact us as described in the “Contact” section.

Notice to California Residents (CCPA/CPRA)

To the extent the CCPA applies to Group.app, California residents (excluding employees, contractors, owners, directors, officers, job applicants, and related parties) have the following rights with respect to PI we have collected or disclosed within the preceding twelve (12) months.

This Policy is intended to serve as our comprehensive privacy notice. We may also provide a shorter notice at the point personal information is collected, summarizing key categories and purposes.

• Right to Know: request a copy of your PI and how we have collected, used, and shared it over the past 12 months.
• Right to Correct: request correction of inaccurate PI we maintain about you.
• Right to Delete: request deletion of your PI, subject to statutory exceptions such as completing a transaction, verifying fraud, or complying with legal obligations.
• Right to Opt Out of Sale/Sharing: opt out of the sale or sharing of your PI, including via a Global Privacy Control signal — see “Opt-Out Preference Signals” above.
• Right to Limit Use of Sensitive Personal Information: we do not use Sensitive Personal Information for any purpose requiring your opt-in consent beyond what is reasonably necessary to operate the Services.
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights.
• Right to Notification: we will not collect new categories of PI or use PI for materially different purposes without first notifying you.
• Right Regarding Automated Decision-Making Technology: see “Automated Decision-Making and Profiling” above.
• Rights Regarding Minors’ Data: we do not knowingly sell or share the personal information of consumers we know to be under 16 years of age without opt-in consent — from the minor if 13–15 years old, or from a parent/guardian if under 13.
• Appeal Rights: if we deny your request, you may appeal by contacting us, and if the appeal is denied, you may submit a complaint to the California Privacy Protection Agency.

We may charge a reasonable fee to cover the administrative cost of complying with a request that is manifestly unfounded, excessive, or repetitive, or decline to complete such a request, as permitted by the CCPA. We do not currently offer a financial incentive or price or service difference in exchange for the collection, retention, or sale/sharing of personal information; if this changes, we will update this Policy.

We collect the following categories of PI from California residents, as necessary for our operational and legal purposes: identifiers (e.g., name, email, IP address); California customer records category information (e.g., contact information); internet or network activity (e.g., browsing history and platform interactions); and inferences drawn from the above to create a profile reflecting preferences and characteristics.

To exercise any CCPA right, contact us as described in “Contact,” or have an authorized agent submit the request on your behalf with proof of authorization.

Other US State Privacy Rights

In addition to California, comprehensive consumer privacy laws are in effect in a growing number of other states. Where a given state’s law applies to Group.app, residents of that state generally have the right to: confirm whether we process their personal data and access it; correct inaccuracies; delete personal data; obtain a portable copy of it; opt out of targeted advertising, the sale of personal data, or certain profiling; and appeal a denied request.

Some of these laws require opt-in consent before processing “sensitive data” and require that we honor recognized universal opt-out mechanisms, such as the Global Privacy Control — see “Opt-Out Preference Signals” above. As with our CCPA practices, we may decline or charge a reasonable fee for requests that are manifestly unfounded, excessive, or repetitive, to the extent permitted by the applicable law.

To exercise any of these rights, contact us as described in the “Contact” section, specifying your state of residence and the right you wish to exercise. We will verify your identity before fulfilling your request and will respond within the time period required by the applicable law.

Amendments to this Policy

We may update, change, suspend, or modify the Platform, our Services, this Policy, and/or our Terms, in whole or in part, at our discretion. Your continued use after any changes indicates your acceptance of those changes. We will post a notice of material changes on the Site and, where required by law, will provide prompt notice through the Platform or to your email address of record.

Governing Language

This Policy may be translated into other languages for your convenience. The English-language version governs your use of the Site and our products and services. In the event of any conflict between the English version and a translated version, the English version prevails.

Contact

If you have questions or comments about us, our Site, our Terms, this Policy, or wish to exercise any privacy right described above, contact us at [email protected] with the subject line “Privacy Request,” describing the request you are making.

You may also contact us by mail at: GroupApp Inc., 440 N. Barranca Ave. #3601, Covina, CA 91723, United States.