Legal

Privacy Policy &
Terms of Service

Last updated: March 2026 · GRW Project · support@grwproject.app

Jump to section

How We Handle Your Data

GRW Project ("GRW Project", "we", "us", "our") operates the behavioural analysis platform at grwproject.app. This privacy policy explains what information we collect, how we use it, and what rights you have over it.

We are incorporated in Canada and subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). Where users are located in the European Economic Area or United Kingdom, the General Data Protection Regulation (GDPR) applies. Where users are Illinois residents, the Biometric Information Privacy Act (BIPA) applies.

Special Category — Biometric Data

Biometric Data Processing

Our platform extracts facial landmark geometry (468 landmarks per frame) and body language classifications from video you provide. Under PIPEDA, BIPA, and GDPR Article 9, this constitutes biometric data and requires explicit, informed consent before processing. We obtain this consent through our Biometric Data Consent Notice, shown before any analysis begins.

What we do NOT do

✓For standard analysis (up to 20 people), your video is never uploaded — all processing runs locally in your browser. For large group analysis, video is temporarily uploaded for GPU processing and immediately deleted. Only geometric facial landmark coordinates are transmitted — no pixel data is retained.

✓Raw facial geometry coordinates are not retained after your browser session ends. Derived behavioural scores (not raw biometric coordinates) are stored with your report.

✓We do not sell, license, or share raw biometric data with any third party.

✓We do not use raw biometric data (facial landmark coordinates) to train machine learning models. Derived behavioural scores may be aggregated anonymously for platform benchmarks if you opt in during the consent flow.

✓If you opt into personal baseline calibration, statistical summaries (means and standard deviations) of your behavioural signals are stored across sessions. These summaries are derived from — but do not contain — raw facial geometry. You can delete this data at any time. Without opt-in, no cross-session profile data is retained.

Legal basis for processing (GDPR): Explicit consent (Article 6(1)(a) and Article 9(2)(a)). You may withdraw consent at any time by closing your browser session or clearing your browser's local storage.

BIPA compliance: Illinois residents are notified that their facial geometry data is being collected and provide written electronic consent before processing begins via our consent modal. Raw biometric identifiers (facial landmark coordinates) are not stored, sold, or licensed. Derived behavioural scores are not considered biometric identifiers under BIPA.

CCPA/CPRA compliance (California): California residents have the right to: (a) know what personal information is collected, (b) request deletion of personal data, (c) opt out of the sale or sharing of personal information, and (d) non-discrimination for exercising these rights. We do not sell personal information as defined under the CCPA. To exercise any of these rights, contact support@grwproject.app.

What We Collect

Account data

Email address and username when you create an account. Required to associate your subscription and report history.

Analysis configuration

The context settings, focus area, and depth parameters you select before running an analysis. Stored with your session to generate your report.

Report output

The scored analysis results (not the underlying video or raw geometry). Retained so you can access your report after leaving the page.

Subscription data

Payment and billing records are handled by Stripe. We receive a confirmation token and subscriber record only — no raw card data ever touches our servers.

Usage analytics

Anonymous aggregate usage data (pages visited, analysis count) to improve the platform. No personally identifiable information is included.

Data Retention

Raw biometric data (facial landmark coordinates, body pose keypoints) is processed in-browser and never stored on our servers. It ceases to exist when your browser session ends. For server-processed sessions, video frames are ephemeral (never written to disk) and raw landmark data is discarded after report generation.

Derived behavioural scores (the numerical outputs of our analysis, such as composure and engagement scores) are stored with your report. Report data is retained while your account is active or until you delete it. You can delete individual reports at any time from your report history.

Personal baselines (if you opt into longitudinal tracking) store statistical summaries of your signal patterns across sessions. This data is deleted when you delete your account or withdraw consent.

Anonymised aggregate data (if you opt into benchmark contribution) is stripped of all identifying information and contributes to platform-wide percentile benchmarks. Once aggregated, this data cannot be attributed to individual users.

Account data is retained while your account is active. You may delete your account and all associated personal data at any time from your profile settings or by contacting support@grwproject.app. Deletion requests are processed within 30 days.

Your Rights

Right of accessRequest a copy of all personal data we hold about you.

Right to correctionRequest that inaccurate personal data be corrected.

Right to erasureRequest deletion of your account and personal data.

Right to withdraw consentWithdraw biometric processing consent at any time by ending your browser session.

Right to data portabilityRequest your report data in a machine-readable format.

Right to lodge a complaintCanadian residents may contact the Office of the Privacy Commissioner of Canada. EU/UK residents may contact their local data protection authority.

Conditions of Use

1. Eligibility

You must be at least 18 years old to use this platform. By using GRW Project, you represent that you are of legal age and have the authority to enter into these terms. You also represent that any individuals whose video you upload for analysis have given explicit consent and are at least 18 years of age. If you are analyzing video of minors (under 18) in a sports or educational context, you represent that you have obtained verifiable parental or guardian consent in compliance with applicable law (including COPPA for US users and GDPR Article 8 for EU users).

2. Permitted Use

GRW Project is a professional assessment tool for coaches, HR professionals, talent evaluators, and organizational leaders. You may use the platform to analyze video of yourself or of individuals who have given explicit consent to be analyzed.

You may not use this platform for: covert surveillance, analyzing individuals without their consent, any purpose prohibited by law in your jurisdiction, or to discriminate against individuals on the basis of protected characteristics.

3. Subscription and Payment

Subscriptions are billed in Canadian dollars (CAD) on a monthly or annual basis. Your subscription provides unlimited analyses at the tier level purchased. Subscriptions auto-renew unless cancelled before the renewal date. Cancellation takes effect at the end of the current billing period — you retain access through the date you paid for.

4. Accuracy and Limitations

GRW Project scores are based on observed behavioural signals in the video provided. They are analytical tools, not clinical diagnoses. Results are influenced by video quality, lighting, camera angle, and the context of the footage. You are responsible for interpreting scores within appropriate professional context.

We make no warranty that scores are accurate for any specific individual, purpose, or jurisdiction. Do not use these scores as the sole basis for employment, medical, legal, or safety decisions.

5. Intellectual Property

All software, algorithms, report formats, and platform design are the intellectual property of GRW Project. You may not copy, reverse-engineer, or redistribute any part of the platform without written permission.

6. Limitation of Liability

To the maximum extent permitted by law, GRW Project shall not be liable for any indirect, incidental, or consequential damages arising from use of this platform. Our total liability for any claim shall not exceed the amount paid by you in the 12 months preceding the claim.

7. Governing Law

These terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. Any disputes shall be resolved in the courts of Ontario.

8. Changes to These Terms

We may update these terms from time to time. Material changes will be communicated to subscribers by email. Continued use after notice constitutes acceptance.

Sub-Processors

Third-Party Data Processors

We use the following sub-processors to operate the platform. Each is subject to data processing agreements and applicable privacy law.

Supabase

Database & Authentication

📍 United States

Account data (email, username, profile fields), subscription records, report metadata

⚖ Standard Contractual Clauses (SCCs) for EEA/UK transfers

Stripe

Payment Processing

📍 United States

Billing confirmation tokens and subscription records only — no raw card data touches our servers

⚖ Stripe is a PCI DSS Level 1 certified processor

Vercel

Hosting & Edge Network

📍 Global (primary: United States)

Application hosting, CDN delivery, serverless function execution

⚖ Standard Contractual Clauses (SCCs) for EEA/UK transfers

Google Fonts

Web Font Delivery

📍 Global

Font file requests (IP address, user-agent). No personal data associated with analysis.

⚖ Google Fonts API Terms of Service

To request removal of your data from any sub-processor, contact support@grwproject.app and we will coordinate the deletion request on your behalf.

Contact & Requests

For privacy requests, data deletion, or legal inquiries:

support@grwproject.app

Company

GRW Project, Canada

← Run Analysis Why Trust This →

Privacy Policy &Terms of Service