Effective date: To confirm: effective date
This policy explains what personal data we collect through gruworks.com and in our work, why, who else handles it, how long we keep it, and the choices you have.
1. Who we are
The website gruworks.com is run by GRU Universal Consulting LLP, which trades as gruworks. We are a limited liability partnership registered in India (LLPIN ACE-8026), working from Bengaluru and Mysuru with founders in India and abroad. In this policy, "we", "us" and "our" mean GRU Universal Consulting LLP.
We decide why and how your personal data is used, so under Indian law we are the data fiduciary for it.
- Registered office: Prestige Atlanta, 80 Feet Rd, Koramangala 1A Block, Koramangala 3 Block, Koramangala, Bengaluru, Karnataka 560034, India
- Email: growth@gruworks.com
2. What this policy covers
It covers personal data of:
- visitors to gruworks.com;
- people who send us an enquiry, book an intro call or buy an audit;
- founders we contact before they contact us;
- the people we deal with at our clients.
When a client asks us to handle personal data on its behalf (for example its customers' data in its CRM or ad accounts), our signed agreement with that client governs that data, and we act only on the client's instructions.
3. What we collect
When you send the enquiry form
| What | Required? |
|---|---|
| Your name and email address | Yes |
| Your WhatsApp number | No, only if you want us to message you there |
| Your company or website | No |
| Your brief, your 18-month goal, what is stopping you, when you would like to start | No |
| The lead you would like to talk to and the audit you are curious about | No |
| Your consent to keep your details and contact you, the time you gave it and the wording you saw | Yes |
| Whether you want your lead's newsletter | No, a separate choice |
The form also sends, without you typing them:
- Where your visits came from: for your first visit
and your latest tracked visit in the last 90 days, any campaign tags in
the link (such as
utm_source), any ad click identifier added by Google, Meta, LinkedIn, Microsoft or TikTok, the website that sent you (its address, without any query string), the page you landed on, the time, and the channel we work out from these. - Technical details: the Google Analytics identifier for your browser, a random identifier for the enquiry, how long the form was open before you sent it, and the page it was sent from.
Because the Google Analytics identifier travels with the form, we can link your enquiry to your earlier visits in Google Analytics.
When you use the site
- Find your lead: the options you pick are kept in your browser so they can fill in the enquiry form for you. The options picked, and the lead and audit suggested, are also recorded as analytics events, without your name or contact details.
- The grunior chat: grunior answers from a fixed set of approved facts, inside your browser. What you type is not sent to us or to anyone else. We record only that the chat was opened or closed and how many messages were sent. To confirm: whether grunior will send messages anywhere at launch; if it does, this paragraph changes
- Analytics and advertising tags: pages you view, what you click, how far you scroll, time on the page, which form fields you start and finish (never what you type in them), your browser and device type, and your approximate location from your IP address, collected by the services in sections 5 and 6.
Before we contact you
Before we write to a founder for the first time, we read what the founder and the business have made public, such as the company website and public professional profiles. We note only what helps us judge whether we can be useful.
When you work with us
Names, roles and business contact details of the people we deal with, what we discuss and agree, and the billing details needed for invoices and tax records.
We do not ask for sensitive personal data such as passwords, bank or card details, health information or biometric information through this website. No payment is taken on this website yet. To confirm: update this section when Razorpay payments go live
4. Why we use it
| Purpose | Data used |
|---|---|
| Reply to your enquiry, book your intro call and prepare for it | Enquiry form details; what you and your business have made public |
| Send your audit, proposal and agreement | Enquiry details; business contact details |
| Send your lead's newsletter, only if you ticked the box | Name and email address |
| Know which channels and campaigns bring enquiries | Visit sources; Google Analytics identifier; enquiry identifier |
| Understand how the site is used and improve it | Analytics data |
| Run our own advertising and measure it | Advertising tags and ad click identifiers |
| Keep the form free of spam and abuse | A one-way scrambled form of your IP address (section 7) |
| Deliver our services, invoice and keep records the law requires | Client contact, engagement and billing details |
We do not sell your personal data. We do not send your name, email address, phone number or anything you type to Google, Meta or LinkedIn through the tags on this site.
5. Cookies and browser storage
The site stores small pieces of data in your browser. Ours:
| Name | Type | What it holds | How long |
|---|---|---|---|
_gru_attr |
Cookie | Where your visits came from (section 3) | 90 days |
gruworks.attr |
Browser storage | The same, as a copy | 90 days |
gruworks.brief |
Browser storage | Your Find your lead answers, to fill in the form | Until you press "Clear my brief from this browser" or clear your browser |
gruworks.market |
Browser storage | Whether you view prices for India or abroad | Until you clear your browser |
gruworks.motion |
Browser storage | Whether you paused motion on the site | Until you clear your browser |
gruworks.greeted |
Session storage | Whether the grunior greeting has been shown | Until you close the tab |
Google Tag Manager on the site loads three services that set their own cookies:
| Service | Cookies (as each provider describes them) | Provider's page |
|---|---|---|
| Google Analytics 4 | _ga tells browsers apart; _ga_<id>
keeps the session; 2 years by default |
policies.google.com/technologies/partner-sites |
| Meta pixel | _fbp holds an identifier for your browser;
_fbc holds the Meta ad click identifier when you arrive
from a Meta ad; Meta sets how long they last |
facebook.com/privacy/policies/cookies |
| LinkedIn Insight Tag | li_fat_id (30 days) and li_giant (7 days)
on our site, and cookies on LinkedIn's own domain such as
bcookie (1 year), lidc (24 hours),
UserMatchHistory (30 days),
AnalyticsSyncHistory (30 days) and li_sugr (90
days) |
linkedin.com/legal/cookie-policy |
The site's fonts load from Google Fonts, so your browser connects to Google's servers, which see your IP address.
Your choices. You can block or delete cookies and browser storage in your browser settings, or use a tracker blocker; the site still works without them. You can also:
- install Google's opt-out browser add-on for Google Analytics (tools.google.com/dlpage/gaoptout);
- manage ads from Meta in the Accounts Centre of Facebook or Instagram;
- manage ads from LinkedIn in your LinkedIn advertising settings.
To confirm: whether the site will ask for consent before analytics and advertising tags load; if a consent control is added, describe it here
6. Who else handles your data
We share personal data only with the service providers below. Google, Meta and LinkedIn also use what their tags collect under their own privacy policies.
| Provider | What they do for us |
|---|---|
| Google Cloud (Firebase Hosting), our hosting provider | Runs the website. The script that receives the enquiry form runs in Mumbai, India. |
| Zoho (Zoho CRM) | Stores enquiries in our CRM, on Zoho's servers |
| Google (Workspace) | Hosts our team inbox, which receives an email of each enquiry |
| Google (Tag Manager, Analytics, Fonts) | Site analytics and fonts |
| Meta | Advertising measurement (Meta pixel) |
| Advertising measurement (Insight Tag) | |
| Google (Meet), WhatsApp, LinkedIn | Calls and messages, when you choose them |
| AI tools | Help our team with research and first drafts; a person checks everything before it reaches you. To confirm: which AI providers may process enquiry or client information, and on what terms |
We may also disclose personal data when the law requires it, or to protect our legal rights.
7. How we protect it
- The enquiry form travels over an encrypted connection to our own script, which checks each request before passing it to our CRM.
- Your IP address is not stored. To stop repeated sending, the script keeps a one-way scrambled form of it for a short window, then deletes it.
- The script's logs record whether each enquiry went through, never your name, email address, phone number, message or IP address.
- If our CRM cannot be reached, the enquiry waits in a private folder on our hosting account, outside the public website, until it can be delivered or a person enters it by hand.
- Only our team can sign in to our CRM and team inbox. To confirm: who holds these logins
No method of sending or storing data is completely secure, but we take reasonable care to protect it.
8. How long we keep it
| Data | How long |
|---|---|
| Visit source data in your browser | 90 days |
| Enquiries, in our CRM and inbox | Kept in our CRM with no set end date, unless you ask us to delete them (section 9) |
| An enquiry waiting to reach our CRM | Until it is delivered or entered by hand, then deleted from the waiting folder |
| Client records, contracts and invoices | Kept in our CRM with no set end date, and at least as long as the law requires |
| Google Analytics data | To confirm: retention setting in our Google Analytics property |
When we no longer need personal data, we delete it or remove what identifies you, unless the law requires us to keep it.
9. Your rights
You can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct, complete or update it;
- delete it, where we no longer need it and the law does not require us to keep it;
- stop sending you the newsletter or other messages;
- withdraw your consent, at any time, as easily as you gave it. Withdrawing does not affect what we did before, and we may then be unable to respond to your enquiry;
- name another person to act for you if you are unable to.
Write to the contact in section 13. We may ask you to confirm who you are before we act.
10. If you are outside India
We are based in India and our service providers may store and handle data in India and in other countries, including the United States. Depending on where you live (for example the European Union, the United Kingdom, California, Australia, New Zealand or the United Arab Emirates), your local law may give you further rights, such as to object to some uses, to limit how your data is used, to receive your data in a portable format, or to opt out of advertising that uses your activity on other sites. Write to us at the address in section 13 to use any of them, and tell us where you live. Where your local law lets you complain to a data protection authority, you may do so.
11. Children
Our services are for businesses and their founders. This site is not meant for anyone under 18, and we do not knowingly collect personal data from children.
12. Changes to this policy
When we change this policy, we will update it on this page and change the effective date at the top.
13. Contact and grievance officer
For any question, request or complaint about your personal data, write to our grievance officer:
- Name and designation: Sudharshanan Nadhamuni, Co-founder, Principal Consultant
- Email: growth@gruworks.com
- Address: GRU Universal Consulting LLP, Prestige Atlanta, 80 Feet Rd, Koramangala 1A Block, Koramangala 3 Block, Koramangala, Bengaluru, Karnataka 560034, India
We will acknowledge your message within To confirm: days to acknowledge and resolve it within one month of receiving it.
14. The law we follow
We handle personal data under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We are preparing for the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as their provisions come into force. Once they do, if you are not satisfied with our answer to a grievance, you may complain to the Data Protection Board of India.