Effective Date: July 12, 2023
Grove Collaborative operates an ecommerce service and related services through grove.com, grove.co, mobile applications, and related sites accessible to mobile devices, tablets, and other connected devices (collectively, the “Grove Collaborative Service” or “Service”). As used in this policy, “Grove Collaborative” refers to Grove Collaborative, Inc. and its subsidiaries. We may refer to Grove Collaborative as “we”, “us”, or “our”. We may refer to you as “consumer”, “you”, or “your”.
This Privacy Policy describes the personally identifiable information from or about an individual ("Personal Information") that we gather from you, how we use and disclose that information, and the ways in which you can control how we use and share it. By using our Service or when applying for or accepting a position with us, you acknowledge that you have read, understood and agreed to the terms of this Privacy Policy. If you are unable to review or access this Privacy Policy and require assistance, please contact us at: support@grove.co.
When you use the Service, this Privacy Policy is incorporated into and is subject to the Grove Collaborative Terms of Use. Please make sure that you have carefully read and understand the Grove Collaborative Terms of Use before you use our Service. Capitalized terms that are not defined in the privacy policy have the meaning given to them in the Grove Collaborative Terms of Use.
Residents of California, Colorado, Connecticut, Nevada, Utah, and Virginia may have additional rights. Please see our Supplemental Privacy Notices for each of these states.
How Information is Collected. Grove Collaborative collects your information in two ways:
We receive and store any information you voluntarily give to us when you use the Service, submit a job application or work for us. You may choose not to provide certain information, but then you might not be able to use the Service, take advantage of certain Service features, or complete job related activity with us. You provide most of this information when you interact with the Service or our talent management tools. Some examples of of this type of information are below.
You can search for open positions and apply for a job with Grove Collaborative through our Careers site.
When you use the Service, we collect information automatically to help us operate and improve the Service or process a job or business related interaction, such as the Internet protocol (IP) address used to connect your computer to the Internet; device data, login; email address; password; computer and connection information such as browser type, version, and time zone setting, browser plug-in types and versions, operating system, and platform; the full Uniform Resource Locator (URL); information regarding your interaction with our Service and advertisements; inferences such as recommendations of products based on your purchase or browsing history; clickstream to, through, and from any of our Internet web sites, including date and time; cookie number; products you viewed or searched for; and the phone number you used to call our 800 number. We may also use browser data such as cookies or similar technologies on certain parts of our website for business processes, fraud prevention and other purposes. For details about how we use these technologies, and your opt-out opportunities and other options, please see our Cookie Policy. We receive information from you and third-parties that helps us approximate your location. During some visits we may use software tools such as JavaScript to measure and collect session information, including page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page. We may also collect technical information to help us identify your device for fraud prevention and diagnostic purposes.
We may receive or collect information about you from third parties and combine and store it on our servers with other information we may have already received or collected from you. We may store this information or combine it with information we collect in other ways. Some examples include:
We use your Personal Information in ways that help us operate and improve the Service and complete requested business activities. Some examples include:
We will share categories of your Personal Information for business purposes with certain third parties that help us perform our business operations or that you designate to receive such information, including other websites, social media platforms, other individuals, and other businesses. For example, we may disclose your Personal Information to:
If we engage in a joint promotion with a business partner, we may share your contact information with our business partner to be used in relation to the promotion. We may share aggregated or non-personal information (such as the number of daily visitors to a particular web page or the size of an order placed on a certain date) with third parties such as advertising partners. We can also share your Personal Information as part of a sale, merger or change in control, or in preparation for any of these events. Any other entity which buys Grove Collaborative or part of our business will have the right to continue to use your information, but only in the manner set out in this Privacy Policy unless you agree otherwise.
We anonymize and aggregate certain Personal Information we collect (so that it does not directly identify you). We may use anonymized information for purposes that include testing, research, data analysis, and Service improvements. We may also share such anonymized information with others.
If you provide Personal Information about another person (“Others") in connection with using the Service (such as programs through which refer a friend or family member) or interacting with Grove Collaborative in a business relationship (such as on job applications or to complete employment benefit information), we rely upon you to obtain any consents from Others that may be required by law to allow us to use the Personal Information of such Others. We will use the Personal Information of such Others as set forth in this Privacy Policy.
We retain information from or about you for so long as necessary to fulfill the purposes outlined in this Privacy Policy. When the information is no longer necessary for these purposes, we may delete it or keep it in a form that does not identify you, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations. You may have a right to request deletion of your Personal Information if you are a resident of certain states, and we will use commercially reasonable efforts to honor your request where required by law. However, we may be required to keep certain Personal Information and not delete it or to retain Personal Information for a certain time. In these cases, we will comply with your deletion request only after we have fulfilled applicable requirements. Deleted Personal Information is removed from Grove Collaborative’s active database, but may remain in our archives. We may also retain your Personal Information for fraud prevention or similar purposes.
The Service may also contain features or links to websites and services provided by third parties that we do not operate and are outside of our control. Any Personal Information you provide on these third party sites or services is provided directly to that third party and is subject to that third party's policies, if any, governing privacy and security, even if accessed through the Service. Please exercise caution and review their applicable privacy and security policies before providing them with Personal Information. We are also not responsible for any products or services you may purchase from these third-party sites. We do not and will not provide any representations or recommendations in relation to any of the information and suggestions comprised within the services. We do not guarantee or endorse the products or services offered by the third party. You are deemed to be responsible for and shall use your own skill and judgment as to, the quality, value and suitability of such information and suggestions and in deciding whether to enter into any contract with any third party for the supply of services or sale of goods.
We do not knowingly allow children under 16 years of age to use the Service or knowingly collect or maintain Personal Information from persons under 13 years of age. If you are under 16 years of age, then please do not use or access the Service at any time or in any manner. If a child under 13 submits Personal Information to Grove Collaborative and we learn that the Personal Information is the information of a child under 16, we will attempt to delete the information as soon as possible. If you believe that we might have any Personal Information from a child under 16, please contact us at legal@grove.co.
We use certain physical, managerial, and technical controls that are
designed to improve the integrity and security of your Personal
Information. We cannot, however, ensure or warrant the security of any
information you transmit to us over the internet or store on the Service
and you do so at your own risk. We also cannot guarantee that such
information will not be accessed, disclosed, altered, or destroyed by
breach of any of our physical, technical, or managerial controls.
If we learn of a security systems breach, then we may attempt to notify
you electronically so that you can take appropriate protective steps. We
may post a notice through the Service if a security breach occurs.
Depending on where you live, you may have a legal right to receive notice
of a security breach in writing. To receive a free written notice of any
security breaches, you should notify us at
support@grove.co.
The Service is hosted in the United States and is intended solely for consumers located within the United States. If you choose to use the Service from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personally identifiable information outside of those regions to the United States for storage and processing, and by providing your personally identifiable information on the Service you consent to that transfer, storage, and processing. Please note that the United States does not have the same data protection laws as the European Union and other regions.
Please revisit this page periodically to stay aware of any changes to this Privacy Policy. If we modify this Privacy Policy, we will make the modified version available through the Service and update the last updated data above. In the event that the modifications materially alter your rights or obligations hereunder, we will make reasonable efforts to notify you of the change. Our amended Privacy Policy will automatically take effect 30 days after it is made available through the Service, and if you do not agree with any changes to the Privacy Policy, you may terminate your account and stop using the Service. Your continued use of the Service after the revised Privacy Policy has become effective indicates that you have read, understood and agreed to the then-current version of the Privacy Policy.
Please contact us with any questions or comments about this Privacy Policy, your Personal Information, our use and disclosure practices, or your consent choices by e-mail at dataprivacy@grove.co. You may also contact us at the following address:
This Supplemental State Specific Privacy Notice (“Supplemental State Notice”) applies only to Personal Information collected about consumers residing in California, Colorado, Connecticut, Nevada, Utah, and Virginia and supplements the information contained in the Privacy Policy. It provides information required under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), the Colorado Privacy Act of 2021 (the “CPA”), the Connecticut Data Privacy Act of 2022 (“CDPA”) the Nevada Privacy Act (the “NPA”), the Utah Consumer Privacy Act of 2022 (the “UCPA”) and the Virginia Consumer Data Protection Act of 2021 (the “VCDPA”) (all of which are collectively referred to as the “State Privacy Laws”) and their related regulations.
This Supplemental State Notice describes our practices regarding the collection, use, and disclosure of Personal Information and instructions for submitting data subject requests for consumers residing in states covered by the State Privacy Laws. If you are unable to review or access this Supplemental State Notice and require assistance, please contact us at: support@grove.co.
“consumer” means a natural person who resides in California, Colorado, Connecticut, Nevada, Utah and Virginia and to whom we offer the Services. For purposes of this Supplemental Policy, this term includes natural persons who reside in California and engage with us as part of business-to-business transactions, submit a job application to Grove Collaborative or work for Grove Collaborative.
“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information includes “personal data” as that term is defined in the CPA, VCDPA, UCPA, NPA and CDPA. Personal Information also includes “Sensitive Personal Information,” as defined below.
“Sensitive Personal Information” means personal information that reveals a consumer’s: 1) social security, driver’s license, state identification card, or passport number; 2) account log-in, financial account number, debit card number, or credit card number in combination with any required security or access code, password, or credentials allowing access to the individual’s account; 3) precise geolocation; 4) racial or ethnic origin; 5) religious beliefs; 5) union membership; 6) contents of email or text messages, unless we are the intended recipient; 7) genetic data; 8) biometric information used to uniquely identify the consumer, and 9) health information, sex life, or sexual orientation. Sensitive Personal Information also includes “sensitive data” as that term is defined in the CCPA, CPA, CDPA, UCPA, and VCDPA.
“third party” means a person or organization which is not a consumer, service provider, or an entity owned or controlled by us and as defined by the CCPA, CPA, CDPA, UCPA, and VCDPA.
“service provider” means a “vendor,” “contractor,” or “processor” which collects, stores, or otherwise handles data for us, as those terms are defined in the CCPA, CPA, CDPA, NPA, UCPA, and VCDPA.
Other terms used in this Supplemental State Notice are as defined under the CPA, CPA, CDPA, NPA, UCPA, and/or VCDPA. If a definition varies under the different laws, the definition that applies in your state will apply. For example, if you are a California consumer, terms used in this Supplemental State Notice will have the definition used in the CCPA.
Below is a summary of the Personal Information we may collect (including the information collected from consumers over the past 12 months), the reason we collect the Personal Information, the types of sources from which each category of Personal Information is collected, and the type of third parties with whom we may share consumer Personal Information. As the summary shows, we may share or sell Personal Information to third parties or disclose certain Personal Information to service providers for business purposes.The section references relate to the sections above in the Privacy Policy.
As required by the State Privacy Laws, we provide detailed information below regarding the data subject rights available to California, Colorado, Utah, Nevada, Connecticut and Virginia consumers. Generally, the rights which you have can be categorized as follows:
Processing of Sensitive Information: We must obtain your express consent prior to collecting and processing certain categories of Sensitive Personal Information such as health data, data about protected characteristics and genetic or biometric data.
Non-Discrimination: Grove Collaborative will not discriminate against customers who exercise their rights under the State Privacy Laws.
The Service is not intended for children or minors under the age of 16. Accordingly, we do not knowingly store information from minors under the age of 16 except as required pursuant to applicable law. If you believe that a child has submitted Personal Information to us, please contact us at dataprivacy@grove.co, and we will delete the information.
Grove Collaborative does not have programs that provide financial incentive to consumers who allow us to retain and share their Personal Information.
If you are a California resident, the CCPA and CPRA grant you certain rights related to your Personal Information as summarized below.
If any of the rights described in the sections above apply to you, you may make a request by visiting the Password & Privacy section of your Account Settings, or contacting us at dataprivacy@grove.co, and we will consider your request in accordance with applicable laws. In order to complete your request, you must confirm your identity. If you request to opt-out of sales/sharing of your Personal Information under the CCPA, you will be directed to verify your identity before completing your request. If you choose to exercise another right under the CCPA, you will directed to verify your identity by logging into your account.
The California “Shine the Light” law gives residents of California the right under certain circumstances to opt out of the sharing of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes, or in the alternative, that we provide a cost-free means for consumers to opt out of any such sharing. We do not currently share your Personal Information with third parties for their own direct marketing purposes.
Nevada residents may have the right to request opt-out of the sale of Personal Information that we may collect through our websites or online applications. Grove Collaborative does not use your Personal Information in a way that constitutes a “sale” under the NPA (sell your personal information in exchange for monetary compensation). If you are a Nevada resident and wish to submit a request, contact support@grove.co.
If you are a Virginia resident, you have the right to request, subject to our verification:
Right to Non-Discrimination: Grove Collaborative will not discriminate against consumers who exercise their rights. Specifically, if you exercise your rights, we will not deny you access to the site or Services, charge you different prices or rates for products or Services or provide you a different level or quality of products or Services. However, as permitted by VCDPA, we may offer you certain financial incentives that can result in different prices, rates, or quality levels. Any permitted financial incentive we offer will reasonably relate to the value of your Personal Information, for instance, if you sign up for a newsletter with us, we may provide you with discounts for future services. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.
Sensitive Information Opt-In: We must also obtain your express consent prior to collecting and processing certain categories of Sensitive Personal Information such as precise geolocation data, data about protected characteristics and genetic biometric data. We do not generally collect this type of information from consumers, except when you choose to provide specific health diagnosis (such as pregnancy) in your responses to the Grove Wellness quiz. submitting your information to the Grove Wellness quiz-you agree that we may use this information to display, email and offer Grove product information.
If you are a resident of Virginia and wish to exercise any of your rights under the VCDPA, you or your authorized agent may make a request to confirm, access, correct, delete, obtain a copy, or opt-out of the processing of your Personal Information for targeting advertising, sale, or profiling by submitting a Privacy Request Form here, or by emailing support@grove.co.
If you use an authorized agent to submit your request, we may require proof of the written authorization you have given. We also may require you to confirm your identity and your residency in order to obtain the information, and you are only entitled to make this request up to twice annually. For emails, please include “Virginia Privacy Rights” as the subject line. You must include your full name, email address, and attest to the fact that you are a Virginia resident. We will process your request within 45 days or let you know if we need additional time or cannot process your request. If you make this request by telephone, we may also ask you to provide the request in writing so that we may verify your identity. If we are unable to honor your request for any reason, we will notify you of the reason within the request time period.
If we decline to take action on your request, you can appeal our decision by submitting an email to support@grove.co entitled “Virginia Privacy Rights Appeal” and we will review your request and respond within 60 days of the receipt of your appeal with a written explanation of the reasons for our decision. If your appeal is denied, you may contact the Virginia Attorney General to submit a complaint.
If you are a Colorado resident, you are provided with the following notification:
Sales and Targeted Advertising: Grove Collaborative does not sell your personal information in exchange for monetary compensation. We do share your Personal Information for targeted advertising purposes as we describe in the Privacy Policy to make the Service available to you. For example, we may disclose information to advertising partners, advertising technology companies, and companies that perform advertising-related services in order to improve the relevance of our advertising and marketing. To the extent possible, Grove Collaborative excludes Personal Information from Colorado residents from these activities.
Profiling: To the extent we engage in automated processing or profiling to prevent, detect, protect against or respond to fraudulent or unlawful activity, we are not required to offer the right to opt out. We otherwise do not engage in profiling that requires an opt-out as defined under the CPA.
If you are a resident of Colorado and wish to exercise any of your rights under the CPA, you or your authorized agent may make a request to confirm, access, correct, delete, obtain a copy, or opt-out of the processing of your Personal Information for targeting advertising by submitting a Privacy Request Form here, or by emailing support@grove.co. Please indicate that you are making a request pursuant to your “Colorado Privacy Rights” and provide us with the requested information to verify your request. We will take steps to verify your request by matching the information provided by you with the information we have in our records.
If you are a Connecticut resident, you have the following rights:
Right to Access: You may have the right to confirm whether or not we are processing your Personal Information and to access such Personal Information.
Right to Correction: You may have the right to correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing of your Personal Information.
Right to Deletion: You may have the right to delete the Personal Information provided to us by you.
Right to Data Portability: You may have the right to obtain a copy of the Personal Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit your Personal Information to another controller without hindrance, where the processing is carried out by automated means.
Right to Opt-Out of Sale, Targeted Advertising, and Profiling: For purposes of the CTDPA, a “sale” includes disclosing Personal Information to a third party in exchange for monetary compensation or other valuable consideration. Grove Collaborative does not “sell” Personal Information under this definition. We do share your Personal Information for targeted advertising purposes as we describe in the Privacy Policy to make the Service available to you. For example, we may disclose information to advertising partners, advertising technology companies, and companies that perform advertising-related services in order to improve the relevance of our advertising and marketing. To the extent possible, Grove Collaborative excludes Personal Information from Connecticut residents from these activities. Connecticut residents have the right to opt out of the processing of your Personal Information by us for decisions that produce legal or similarly significant effects concerning you. We do not process Personal Information for such profiling.
Right to Appeal: If you are a resident of Connecticut and wish to exercise any of your rights under the CTDPA, you or your authorized agent may make a request to confirm, access, correct, delete, obtain a copy, or opt-out of the processing of your Personal Information for targeting advertising by submitting a Privacy Request Form here, or by emailing support@grove.co. Please indicate that you are making a request pursuant to your “Connecticut Privacy Rights” and provide us with the requested information to verify your request. We will take steps to verify your request by matching the information provided by you with the information we have in our records.
If you are a Utah resident, you have the following rights as of December 31, 2023:
Right to Access: You may have the right to confirm whether or not we are processing your Personal Information and to access such Personal Information.
Right to Correction: You may have the right to correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing of your Personal Information.
Right to Deletion: You may have the right to delete the Personal Information provided to us by you.
Right to Data Portability: You may have the right to obtain a copy of the Personal Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit your Personal Information to another controller without hindrance, where the processing is carried out by automated means.
Right to Opt-Out of Sale, Targeted Advertising, and Profiling: For purposes of UCPA, a “sale” includes disclosing Personal Information to a third party in exchange for monetary compensation. We do not “sell” Personal Information under this definition. Utah residents have the right to opt out of the processing of your Personal Information by us for decisions that produce legal or similarly significant effects concerning you. We do not process Personal Information for such profiling. We do share your Personal Information for targeted advertising purposes as we describe in the Privacy Policy to make the Service available to you. For example, we may disclose information to advertising partners, advertising technology companies, and companies that perform advertising-related services in order to improve the relevance of our advertising and marketing. To the extent possible, Grove Collaborative excludes Personal Information from Utah residents from these activities.
If you are a resident of Utah and wish to exercise any of your rights under the UCPA, you or your authorized agent may make a request to confirm, access, correct, delete, obtain a copy, or opt-out of the processing of your Personal Information for targeting advertising by submitting a Privacy Request Form here, or by emailing support@grove.co. Please indicate that you are making a request pursuant to your “Utah Privacy Rights” and provide us with the requested information to verify your request. We will take steps to verify your request by matching the information provided by you with the information we have in our records.
Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We are committed to providing you with meaningful choices about the information collected on our websites for third-party purposes, and that is why we provide the variety of opt-out mechanisms listed above, and in our Cookies Notice. Some web browsers offer users a “Do Not Track” privacy preference setting in the web browser. We do not currently recognize or respond to browser-initiated Do Not Track signals. Learn more about Do Not Track at allaboutdnt.com.