Privacy Policy

Groundwork ("Groundwork", "we", "us") is a marketing workspace that helps small businesses plan content, publish posts to their own connected social accounts, draft outreach messages, and track engagement. This policy explains what data we collect, why, and how you can remove it. Questions: support@groundwork-marketing.company.

Account data: your name, email address, and authentication identifiers when you sign up with email, Google, or Microsoft.

Workspace content: brand briefs, audience descriptions, posts, drafts, templates, leads, notes, and outreach logs that you create or paste into Groundwork.

Billing data: if you subscribe, payment is processed by Stripe. We store only a customer identifier and subscription status — we never see or store your full card number.

Connecting an account is always optional and always initiated by you through the platform's own official login screen (OAuth). We never ask for, receive, or store your social media passwords.

When you connect a Facebook Page, Instagram Business/Creator account, or TikTok account, we receive an access token plus basic profile information (such as account name, username, avatar, and account ID) so we can show you which account is connected and publish content you explicitly schedule or submit.

TikTok data specifically: with the user.info.basic scope we retrieve your display name, username, and avatar to confirm the connected account. With the video.publish scope we upload only the video and caption you choose to publish from your Groundwork dashboard. We do not read your TikTok followers, messages, or analytics beyond what you see in the app, and we never post without an explicit action by you.

Access tokens are encrypted at rest using AES-256-GCM and are used only to perform actions you request.

To operate the workspace: store and display your content, leads, and engagement history.

To publish content you have explicitly created and submitted to your own connected accounts.

To generate AI drafts. Prompts you submit (your brief, audience, and pasted context) are sent to our AI provider to produce a draft. They are not used to train third-party models.

To send transactional email, such as sign-in and account notifications, and outreach email you compose and choose to send.

To handle billing, prevent abuse, and provide support.

We do not sell your personal data, and we do not use your social account data for advertising.

Service providers that make the product work: our hosting and database provider, Stripe (payments), our email delivery provider, and our AI provider. Each processes data only to deliver its service to us.

Social platforms, when you publish or connect — limited to the content and permissions required for the action you requested.

Legal authorities, only where required by law.

We keep your workspace data for as long as your account is active.

You can disconnect any social account at any time in Settings. Disconnecting immediately revokes and deletes the stored access token for that account.

You can delete your account by emailing support@groundwork-marketing.company. We delete your workspace content, connections, and tokens within 30 days, except records we must retain for legal or accounting reasons.

Data is encrypted in transit with TLS and at rest. Social access tokens receive an additional layer of AES-256-GCM application-level encryption. Access to workspace records is enforced per-user at the database level so one account cannot read another's data.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. Contact support@groundwork-marketing.company and we will respond within 30 days.

Groundwork is not intended for anyone under 16, and we do not knowingly collect data from children.

If we make material changes to this policy we will update the date below and, where appropriate, notify you by email.