Privacy Policy
Effective October 18, 2026
Who we are
Groundwork is operated by Groundwork Web Services LLC. This policy explains what we collect, how we use it, and your choices.
What we collect
- Account data - your email and, if you sign in with Google, your basic profile, via our authentication provider.
- What you send us - your business name and location, your email, anything you tell us to put on the site, and the photos, text and details you send for it.
- Your setup answers - after you sign up, the answers you give on your setup page: your hours, who we should contact and how, and whether you agree to us managing your Google Business Profile and replying to its reviews, with the version of the notice you saw and when you answered.
- Your Google Business Profile - if you add us as a manager, we can see and change what is on your profile. We change it only as the notice on your setup page describes, and you can remove us at any time.
- Callback requests - if you use “Call me back” on a preview we built for your business, the name, phone number, best time and note you type, and which preview you were on. We use them only to call you back: we never text the number or add it to a list unless you agree to that on the call. We delete each request after 90 days.
- Payment data - handled by Stripe. We store your subscription status and a customer identifier, not your card details.
- Visits to your site - once your site is live it reports first-party events back to us: a page view, and taps of your phone number, directions link, booking button and contact form. We store the page, where the visit came from and the browser's user agent. We do not store your visitors' IP addresses against those events, and we do not set advertising or tracking cookies on your site. These counts are what your monthly email is made of.
- Email signups on your site - if a visitor signs up on your site for your news and offers, we keep their email address as your list, with when they signed up, the sign-up line they saw and their browser's user agent (not their IP address). We keep it for you, and we do not use it for our own marketing or sell it.
- Connected accounts - where we operate a mailbox to correspond with businesses, we store the connected address and the OAuth tokens needed to send and to match replies. If an operator connects Telegram for notifications, we store that Telegram chat ID.
- Technical data - your IP address, recorded against short-lived rate-limit counters so our endpoints cannot be scripted for abuse.
- Business data - information about local businesses (names, addresses, ratings, public contact details) sourced from Google and other providers. See Business contacts below for how we treat contact details that identify a person.
How we use it
To build and run your website, to correspond with you about it, to produce your monthly report, to process payments, and to provide support. Some of this work, such as drafting the text of your site and our emails to you, is done with the help of AI systems (Anthropic), as our Terms of Service describe. We do not sell your personal information, and we do not use it for advertising.
Service providers we share with
We share data with providers that help us run the Service: Vercel (application hosting), Supabase (database and authentication), Inngest (background job processing), Stripe (payments), Anthropic (AI features), Google (business data via Places, page scoring via PageSpeed, and the Gmail API when you connect an account), Hunter.io and Outscraper (business contact lookups we run), Pexels (stock photography for generated site previews), and Telegram (notifications, only if you connect it). Each processes data under its own terms.
The Service, including the sites and previews we build, includes Google Maps features and content. Their use is subject to the Google Privacy Policy (https://policies.google.com/privacy).
The Service, including the sites and previews we build, includes Google Maps features and content. Their use is subject to the Google Privacy Policy (https://policies.google.com/privacy).
Cookies
We use cookies strictly to keep you signed in and to operate the Service. We do not use third-party advertising cookies.
Google API Services Limited Use
Groundwork's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Gmail data we access is used only to send and receive our own correspondence with businesses and clients, and to match replies to the right one. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.
Business contacts
So we know which local businesses to offer a website to, we hold public business records from Google and Outscraper, and work contact details from Hunter.io and Outscraper. Some of those details identify a person rather than a company. When we build a preview or offer page for a business, we also record when that page is opened, so we know it was seen. When a preview is opened with the code printed on one of our cards, we keep the code, the time and the browser's user agent (not the IP address), and we are notified that it was opened. We do not use any of it for advertising, and we do not sell it.
If you own or work at a business that appears in Groundwork and you want it removed, use our removal page. No account is needed, and we do not ask you to prove ownership. A matching preview comes down within a minute, and we stop contacting you. Two kinds of request wait for us to confirm them with the business first, which we do within two business days: one about a business that pays us for its site, and any request beyond the third we receive in 24 hours. The removal page tells you when yours is one of them. You can also write to david@groundworkscan.com.
If you own or work at a business that appears in Groundwork and you want it removed, use our removal page. No account is needed, and we do not ask you to prove ownership. A matching preview comes down within a minute, and we stop contacting you. Two kinds of request wait for us to confirm them with the business first, which we do within two business days: one about a business that pays us for its site, and any request beyond the third we receive in 24 hours. The removal page tells you when yours is one of them. You can also write to david@groundworkscan.com.
Retention
We keep account and usage data while your account is active. We do not store Google reviews or Google photos: sites show them live from Google, credited to the people who wrote or took them. Rate-limit counters expire on their own short window. Callback requests are deleted 90 days after they are made. If you are a client, tell us and we will delete the business and contact details we hold for you, except the record of what you agreed to about your Google Business Profile (your setup answers and the emails about them), which we keep so we can show Google what you agreed to if it asks; if you cancel, we stop hosting your site at the end of the period you paid for and your domain stays registered in your name. Anyone with an account can delete it from account settings.
Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal data. Write to us at david@groundworkscan.com and we will action it. If you have an account you can also delete it from account settings.
Children
The Service is not directed to anyone under 18, and we do not knowingly collect their data.
Changes
We may update this policy and will provide reasonable notice of material changes.
Contact
Questions or requests: david@groundworkscan.com.