Privacy policy

Who we are

For this demo, “Grovia” means the sample fresh-market operated from Unit 4, Feeder Road, Bristol BS2 0SB. Questions about this policy can be sent to hello@grovia.market.

What we collect

When you create an account we store your name, email, password hash, optional phone number and any delivery addresses you save.

When you place an order we keep the basket, the delivery slot, the payment method chosen and the resulting order history so you can track and reorder.

When you contact us or subscribe to the Saturday list we store the message or email address you submitted, plus a coarse timestamp.

Technical logs (IP address, user agent, pages requested) are kept only as long as they are useful for security and debugging.

How we use it

To run the account you asked for: sign-in, checkout, order tracking, refunds and saved addresses.

To send transactional mail such as a password-reset code. Marketing mail is sent only if you subscribe, and every message has an unsubscribe path.

To keep the platform secure — rate limiting, fraud checks and investigating abuse.

We do not sell personal data. We do not use it to train unrelated models. We do not share it with advertisers.

Cookies and the session

The signed-in session lives in an httpOnly cookie (`grovia_session`). JavaScript on the page cannot read it. That is how we keep the JWT out of localStorage and Zustand.

A separate `grovia_cookie_consent` key in localStorage remembers whether you accepted or limited cookies on this demo. See the Cookie policy for the full list.

Your rights

You can read and update your profile and addresses from the account page. You can close the account from Account settings; we remove personal data within 30 days, keeping only the order records tax law requires (typically seven years).

To export a copy of what we hold, or to object to a particular use, email hello@grovia.market from the address on the account.