Effective Date: March 11, 2023
Grove Collaborative operates an ecommerce service and related services through grove.com, grove.co, mobile applications, and related sites accessible to mobile devices, tablets, and other connected devices (collectively, the “Grove Collaborative Service” or “Service”). As used in this policy, “Grove Collaborative” refers to Grove Collaborative, Inc. and its subsidiaries. We may refer to Grove Collaborative as “we”, “us”, or “our”. We may refer to you as “customer”, “you”, or “your”.
This privacy policy describes the personally identifiable information from or about an individual ("Personal Information") that we gather from you, how we use and disclose that information, and the ways in which you can control how we use and share it. By using our Service, you acknowledge that you have read, understood and agreed to the terms of this privacy policy.
This privacy policy is incorporated into and is subject to the Grove Collaborative Terms of Use. Please make sure that you have carefully read and understand the Grove Collaborative Terms of Use before you use our Service. Capitalized terms that are not defined in the privacy policy have the meaning given to them in the Grove Collaborative Terms of Use.
Residents of California, Virginia and Nevada may have additional rights. Please see our Privacy Notice for each of these states following the main Privacy Policy.
We receive and store any information you enter into the Service. You may choose not to provide certain information, but then you might not be able to use the Service or take advantage of many of our features. You provide most of this information when you interact with the Service. Some examples of this type of information are below.
When you use the Service, we collect information automatically to help us operate and improve the Service, such as the Internet protocol (IP) address used to connect your computer to the Internet; device data, login; email address; password; computer and connection information such as browser type, version, and time zone setting, browser plug-in types and versions, operating system, and platform; the full Uniform Resource Locator (URL); clickstream to, through, and from any of our Internet web sites, including date and time; cookie number; products you viewed or searched for; and the phone number you used to call our 800 number. We may also use browser data such as cookies or similar technologies on certain parts of our website for business processes, fraud prevention and other purposes. For details about how we use these technologies, and your opt-out opportunities and other options, please see our Cookie Policy. We receive information from you and third-parties that helps us approximate your location. During some visits we may use software tools such as JavaScript to measure and collect session information, including page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page. We may also collect technical information to help us identify your device for fraud prevention and diagnostic purposes.
We may receive or collect information about you from third parties and combine and store it on our servers with other information we may have already received or collected from you. We may store this information or combine it with information we collect in other ways. Some examples include:
We use your Personal Information in ways that help us operate and improve the Service. Some examples include:
We disclose your Personal Information for business purposes, which may include disclosure to third parties that help us perform the Service, are necessary to our business operations or that you designate to receive such information, including other websites, social media platforms, other individuals, and other businesses. For example, we may disclose your Personal Information to:
We can also share your personal data as part of a sale, merger or change in control, or in preparation for any of these events. Any other entity which buys Grove Collaborative or part of our business will have the right to continue to use your information, but only in the manner set out in this privacy policy unless you agree otherwise.
We retain information from or about you for so long as necessary to fulfill the purposes outlined in this Privacy Policy. When the information is no longer necessary for these purposes, we may delete it or keep it in a form that does not identify you, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.
The Service may also contain features or links to websites and services provided by third parties that we do not operate and are outside of our control. Any Personal Information you provide on these third party sites or services is provided directly to that third party and is subject to that third party's policies, if any, governing privacy and security, even if accessed through the Service. Please exercise caution and review their applicable privacy and security policies before providing them with Personal Information. We are also not responsible for any products or services you may purchase from these third-party sites. We do not and will not provide any representations or recommendations in relation to any of the information and suggestions comprised within the services. We do not guarantee or endorse the products or services offered by the third party. You are deemed to be responsible for and shall use your own skill and judgment as to, the quality, value and suitability of such information and suggestions and in deciding whether to enter into any contract with any third party for the supply of services or sale of goods.
We do not knowingly allow children under 13 years of age to use the Service or knowingly collect or maintain Personal Information from persons under 13 years of age. If you are under 13 years of age, then please do not use or access the Service at any time or in any manner. If a child under 13 submits Personal Information to Grove Collaborative and we learn that the Personal Information is the information of a child under 13, we will attempt to delete the information as soon as possible. If you believe that we might have any Personal Information from a child under 13, please contact us at legal@grove.co.
We use certain physical, managerial, and technical controls that are
designed to improve the integrity and security of your Personal
Information. We cannot, however, ensure or warrant the security of any
information you transmit to us over the internet or store on the Service
and you do so at your own risk. We also cannot guarantee that such
information will not be accessed, disclosed, altered, or destroyed by
breach of any of our physical, technical, or managerial controls.
If we learn of a security systems breach, then we may attempt to notify
you electronically so that you can take appropriate protective steps. We
may post a notice through the Service if a security breach occurs.
Depending on where you live, you may have a legal right to receive notice
of a security breach in writing. To receive a free written notice of any
security breaches, you should notify us at
support@grove.co.
The Service is hosted in the United States and is intended solely for consumers located within the United States. If you choose to use the Service from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personally identifiable information outside of those regions to the United States for storage and processing, and by providing your personally identifiable information on the Service you consent to that transfer, storage, and processing. Please note that the United States does not have the same data protection laws as the European Union and other regions.
Please revisit this page periodically to stay aware of any changes to this Privacy Policy. If we modify this Privacy Policy, we will make the modified version available through the Service and update the last updated data above. In the event that the modifications materially alter your rights or obligations hereunder, we will make reasonable efforts to notify you of the change. Our amended Privacy Policy will automatically take effect 30 days after it is made available through the Service, and if you do not agree with any changes to the Privacy Policy, you may terminate your account and stop using the Service. Your continued use of the Service after the revised Privacy Policy has become effective indicates that you have read, understood and agreed to the then-current version of the Privacy Policy.
Please contact us with any questions or comments about this Privacy Policy, your Personal Information, our use and disclosure practices, or your consent choices by e-mail at dataprivacy@grove.co. You may also contact us at the following address:
If you are a California resident, the California Consumer Privacy Act (“CCPA”) as amended and updated by the California Privacy Rights Act (“CPRA”) grants you certain rights related to your information. The CCPA and CPRA may be referred to collectively, as “California Privacy Law”. The applicable rights under California Privacy Law are summarized below.
You can learn more about how to make these requests by visiting the Password & Privacy section of your Account Settings, or contacting us at dataprivacy@grove.co, and we will consider your request in accordance with applicable laws. In order to complete your request, you must confirm your identity. If you request to opt-out of sales of your Personal Information under California Privacy Law, you will be directed to verify your identity before completing your request. If you choose to exercise another right under California Privacy Law, you will be directed to verify your identity by logging into your account.
Below is a summary of the Personal Information we collected from consumers over the past 12 months, the reason we collected the Personal Information, where we obtained the Personal Information we collected, and the third parties with whom we may share consumer Personal Information. The section references relate to the sections above in this Policy.
The California “Shine the Light” law gives residents of California the right under certain circumstances to opt out of the sharing of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes, or in the alternative, that we provide a cost-free means for consumers to opt out of any such sharing. We do not currently share your Personal Information with third parties for their own direct marketing purposes.
Nevada residents may have the right to request opt-out of the sale of Personal Information that we may collect through our websites or online applications. If you are a Nevada resident and wish to make this request, contact support@grove.co.
If you are a Virginia resident, you have the right under the Virginia Consumer Data Protection Act (‘VCDPA”), upon a verified request, to:
Right to Non-Discrimination: Grove Collaborative will not discriminate against customers who exercise their rights. Specifically, if you exercise your rights, we will not deny you access to the site or Services, charge you different prices or rates for products or Services or provide you a different level or quality of products or Services. However, as permitted by VCDPA, we may offer you certain financial incentives that can result in different prices, rates, or quality levels. Any permitted financial incentive we offer will reasonably relate to the value of your Personal Information, for instance, if you sign up for a newsletter with us, we may provide you with discounts for future Services. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.
Sensitive Information Opt-In: We must also obtain your express consent prior to collecting and processing certain categories of sensitive personal data such as precise geolocation data, data about protected characteristics and genetic or biometric data. We do not generally collect this type of information from consumers, except when you choose to provide specific health diagnosis (such as pregnancy) in your responses to the Grove Wellness quiz. submitting your information to the Grove Wellness quiz-you agree that we may use this information to display, email and offer Grove product information.
If you are a resident of Virginia and wish to exercise any of your rights under the VCDPA, you or your authorized agent may make a request to confirm, access, correct, delete, obtain a copy, or opt-out of the processing of your personal data for targeting advertising, sale, or profiling by submitting a Privacy Request Form here, or by emailing support@grove.co.
If you use an authorized agent to submit your request, we may require proof of the written authorization you have given. We also may require you to confirm your identity and your residency in order to obtain the information, and you are only entitled to make this request up to twice annually. For emails, please include “Virginia Privacy Rights” as the subject line. You must include your full name, email address, and attest to the fact that you are a Virginia resident. We will process your request within 45 days or let you know if we need additional time or cannot process your request. If you make this request by telephone, we may also ask you to provide the request in writing so that we may verify your identity. If we are unable to honor your request for any reason, we will notify you of the reason within the request time period.
If we decline to take action on your request, you can appeal our decision by submitting an email to support@grove.co entitled “Virginia Privacy Rights Appeal” and we will review your request and respond within 60 days of the receipt of your appeal with a written explanation of the reasons for our decision. If your appeal is denied, you may contact the Virginia Attorney General to submit a complaint.
Below is a summary of the Personal Information we collected from Virginia consumers over the past 12 months, the reason we collected the Personal Information, where we obtained the Personal Information we collected, and the third parties with whom we may share consumer Personal Information. The section references relate to the sections above in this Policy.
Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We are committed to providing you with meaningful choices about the information collected on our websites for third-party purposes, and that is why we provide the variety of opt-out mechanisms listed above, and in our Cookies Notice. Some web browsers offer users a “Do Not Track” privacy preference setting in the web browser. We do not currently recognize or respond to browser-initiated Do Not Track signals. Learn more about Do Not Track at allaboutdnt.com.