Privacy Policy

Last updated: October 16, 2026

This policy explains what gr0.ai (the "Service"), operated by REXA OS, LLC ("we", "us"), collects, why, who sees it, how long we keep it, and what you can ask us to do. We wrote it in plain English. If something here is unclear, email [email protected].

Who we are and our role

The Service is a customer relationship management (CRM) and business operations system that businesses ("customers") use to manage their own leads, customers, messages, calls, calendars, documents and sales. REXA OS, LLC, 319 Clematis Street, West Palm Beach, FL 33401, runs it.

For the information a customer puts into the Service (its contacts, messages, call recordings, documents and so on), the customer decides why and how it is used. We act as the customer's processor (service provider) and handle it only on the customer's instructions and under our agreement with the customer. If you are a customer's contact and want to see or erase your data, ask that customer first; we will help them answer you.
For account, security and billing information about the people who use the Service (our customers' staff), and for the operation and protection of the Service itself, we are the controller.

What we collect

Account information

Your name, work email address, role and organization, a salted hash of your password (we never store the password itself), and your two-factor settings and one-time codes.

Sign-in and security activity

The IP address, approximate location (city and region), browser and device type, and time of each sign-in attempt, and the devices you chose to remember (a remembered device lasts 30 days). We use this to detect account takeover and to show you where your account was used.

Customer content

What a customer or its staff enters or connects: contacts, companies, leads, deals, notes, tasks, emails, text messages, call recordings and transcripts, calendar events, files and e-signature documents, forms and surveys, and, if a customer uses its funding and underwriting features, bank statements, credit and identity information of its applicants.

Calendar information (Google and Microsoft)

See Google and Microsoft calendar data below.

Usage and diagnostic information

Which features are used, request logs (time, page, status, request id), error reports, email send counts, AI usage (counts of requests and amounts, used for fair-use limits and billing), and similar technical records needed to run, secure and bill for the Service.

Support

What you send us when you ask for help, and the account details needed to help you.

How we use it

To provide, maintain and secure the Service, and to do what a customer's staff ask it to do (send an email, place a call, show an event).
To sign you in, verify it is you, and protect against fraud, abuse and unauthorized access.
To meter usage, bill customers and meet our legal and accounting duties.
To fix problems and improve reliability, using logs and error reports.
To answer you when you contact us.
To meet legal obligations, enforce our terms, and defend legal claims.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use customer content for advertising, and we do not use it to build profiles of anyone for third parties.

Google and Microsoft calendar data

If you connect a Google Calendar or a Microsoft 365 / Outlook calendar, we access the events on your primary calendar (title, time, location, description, attendees and their responses) and the email address of the connected account. We do this only to show your events in the CRM calendar, to add, change and cancel events you create in the CRM, and to avoid double bookings.

The CRM calendar is shared inside your organization: colleagues who have access to the calendar can see the events on yours, including events that came from your Google or Microsoft calendar, and can ask gr0 what is on your calendar (only as far as their own CRM role allows). An event marked private shows to them only as "Busy". Events that came from your Google or Microsoft calendar are not included in your organization's data exports; they stay available from your calendar provider.

The access we request is:

Google: your email address and basic sign-in (openid, email), and https://www.googleapis.com/auth/calendar.events.owned, which lets us see and edit events on calendars you own.
Microsoft: openid, email, offline_access, User.Read and Calendars.ReadWrite, which lets us read your basic profile and read and write events on your calendar.

How we handle it:

We store your access tokens encrypted and use them only for that sync.
We do not sell calendar data, do not use it for advertising, do not use it to train AI or machine-learning models, and do not use it to decide credit-worthiness or for lending or underwriting decisions.
We do not transfer calendar data to others except as needed to provide the features you use (sync, gr0 as described below, your organization's CRM calendar and data exports), to follow the law, or as part of a merger or sale of our business with notice to you.
People at our company do not read your calendar data. gr0 support staff can see it only during audited support access that you or your organization's admin request ("log in as"), or for security reasons (for example, to investigate abuse), or where the law requires it.
If you use gr0 in the CRM and ask something that needs your events, those events are sent only to a paid AI model through OpenRouter, on a request that requires no data collection and zero data retention by the model provider, only to answer you, and only as far as your CRM role allows. They are never sent to a free AI model, and their text is left out of our AI monitoring records. If your organization has no such model, gr0 says so and does not read your calendar. We never use calendar data to train models.

Disconnect any time on the Calendar page or in Settings. Disconnecting deletes the stored tokens and, for Google, withdraws our access at Google. You can also remove the app yourself: for Microsoft at myapps.microsoft.com, for Google at myaccount.google.com/connections. When your organization removes you as a user, your connection ends the same way.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Artificial intelligence

The Service has AI features (drafting, summarizing, gr0, voice agents). Here is how they treat your data.

An AI feature sees only what the person using it is allowed to see in the Service. It follows the same roles and permissions as the person.
We do not train AI models on customer content. Requests on paid models sent through OpenRouter carry a no-data-collection preference, so they are routed only to providers that do not store or train on them. Free model routes are an option for low-sensitivity tasks; their providers set their own terms and may keep prompts, which is why the sensitive features below never use them.
Features that read bank statements, credit or funding terms, or government IDs never run on free model routes, and neither does any AI request with calendar events (those also require zero data retention, see above). If an organization has no paid model, those features are refused and the manual path is offered. The text of these requests is not kept in our AI monitoring records.
A person decides whether to send an AI draft. AI never approves anything on its own: a human decides approvals.

We use a small set of service providers ("sub-processors") to run the Service, listed with purpose and data on the sub-processors page. Some are used only if a customer turns on the related feature (for example text messages, voice AI, payments, bank connection, credit reports or identity checks). We bind them to confidentiality and data-protection terms.

We also disclose information when the law requires it (for example a valid court order), to protect the rights, safety and security of people and the Service, and in a merger, acquisition or sale of assets (we would tell affected customers first).

Text messages (SMS)

Businesses that use the Service text people who agreed to get their texts, and we text the Service's own users (for example sign-in codes). A person agrees on the business's sign-up page, a form or in writing, and can stop at any time.

What we keep: the mobile number, the messages and their delivery status, STOP and HELP replies, and the proof of consent (the words agreed to, the time, the number, the IP address and the browser).
Sign-up requests: A request made on a sign-up page or a business's web form is not consent until it is confirmed from that phone. We send one text to the number asking for a reply of YES (only if the business may text it: never to a number that sent STOP or is on a do-not-call list, and only during texting hours), and only a YES to that text from that phone within 72 hours makes it consent. While a request is open we keep which version of the words was shown, the page, the time, the IP address, the browser, the number encrypted, the last 4 digits and a one-way code of the number. For a number that asked not to be contacted we keep only that the request was not taken and why, the last 4 digits, the time, the IP address and the browser. A request that is not confirmed is deleted after 30 days, and so are the IP address and browser kept with it; the confirmation text and any reply stay in the business's message history like its other texts.
Sign-in codes: a user's mobile number is added to their own account (by them or their organization's administrator), and the user confirms it is their phone before any code is sent there. We text a one-time code only when that user signs in, confirms a sensitive action or confirms their number; never marketing. Reply STOP to stop these texts: codes then go to the user's email instead.
Why: to send the texts the person asked for, to stop them when asked, and to show the consent if a carrier or a court asks.
Message frequency varies. Msg & data rates may apply. Reply STOP to any text to stop getting texts from that business, or HELP for help. After STOP we send one message to confirm and nothing else.
Consent records are kept as legal evidence for as long as the law requires (see "How long we keep it").

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

The phone carriers and our messaging provider receive the number and the message only to deliver it. The text message terms are in the Terms of Service.

How long we keep it

Retention periods
Information	How long
Customer content in an active organization	While the customer uses the Service, until the customer or the person deletes it
A contact erased on request	Personal details are removed from the Service at once; records the law makes us keep as evidence keep only identifiers
Deleted files	Removed from storage after a short grace period (about 7 days by default)
Sign-in activity (IP address, location, device)	13 months
Text sign-up requests that were not confirmed (with their IP address and browser)	30 days
Remembered device records	Until they expire, 30 days
Request and usage logs, page-view records, email events	13 to 25 months, depending on the type
Notifications	About 90 days after they are read; unread ones after 1 year
Organization closed: download window	30 days, then deletion (see the Terms of Service)
Organization closed: encrypted archive	Up to 90 days, then deleted
Legal evidence (e-signature events, consent and authorization records, money ledgers, sanctions screenings)	Until its legal retention ends, which is several years depending on the record. These hold identifiers rather than personal details wherever possible

Backups of our systems are encrypted and age out on a fixed cycle. Deleted data can remain in backups until they expire.

Your rights

Depending on where you live (for example the EU or UK under the GDPR, or California and other US states), you may have the right to access, correct, delete, restrict or object to the use of your information, to receive a portable copy, to withdraw consent, and not to be treated worse for using these rights. You also have the right to complain to your data-protection authority.

To use a right, email [email protected]. If your information sits in a customer's CRM, we pass your request to that customer, who decides, and we help them carry it out. We will answer within 30 days. We may need to confirm who you are first.

Text messages: reply STOP to a message from a business using the Service to stop its texts. Email: use the unsubscribe link in any marketing email.

International transfers

We and our sub-processors are mostly in the United States. If you are in the EU, UK or Switzerland, we rely on appropriate safeguards such as standard contractual clauses where information moves outside your region.

Cookies and tracking

We use only cookies and browser storage that the Service needs to work: your session, the one-time code step of sign-in, a remembered-device marker you opt into, and your light or dark theme. We do not use advertising cookies, analytics trackers or third-party tracking scripts on the Service or on these public pages. If we see repeated failed sign-ins we may show Cloudflare Turnstile, a bot check, and a business's text sign-up page may show it too. Businesses that use our public forms, booking or help pages may measure visits to their own pages; they are responsible for telling their visitors.

Security

We protect information with encryption in transit, encryption of stored secrets and tokens, tenant isolation enforced in the database, role-based access, two-factor sign-in, audit logs and encrypted backups. Read more on the security page. No system is perfectly secure. If a breach affects you, we will notify you and the customer as the law requires.