Grawx is an AI-powered marketing automation service accessible via the Telegram bot t.me/grawx_bot and the website grawx.com.
The service is provided by:
We act as the data controller for all personal data processed through Grawx.
We collect only what is necessary to provide and improve the service.
| Data Type | What Exactly | Why |
|---|---|---|
| Telegram User ID | A unique numeric identifier assigned by Telegram. We do not collect your username, name, phone number, or profile photo. | To identify your account, store credits, and send bot messages. |
| Business Information | Your website URL, niche, target audience, brand voice, product details, CTA preferences, and anything you voluntarily provide during onboarding or automation setup. | To generate marketing content tailored to your business. |
| Usage Data | Account creation and last-activity timestamps, selected timezone, content generation count, automation settings. | To schedule content, manage credits, and improve service quality. |
| Generated Content History | Full text of generated content stored for up to 30 days, then permanently deleted. Metadata (hook type, tone, ratings, scores) retained longer. | A/B testing, performance tracking, and quality improvement. |
| Payment Records | Amount paid, credit package, purchase date, and Stripe transaction reference ID. We never store card numbers or bank details. | Billing records and financial compliance. |
| Referral Data | Telegram user IDs of referring and referred users. | To attribute and award referral credits. |
| API Usage Logs | AI model name, token count per operation, timestamp. No message content is stored in logs. | Cost monitoring and capacity planning. |
Service delivery: Generating marketing content based on your business information and preferences.
Account management: Tracking credits, processing purchases, managing automation schedules.
Service improvement: Analysing aggregated, anonymised performance data. Individual user data is never used to train third-party AI models.
Communications: Sending generated content, updates, and service notifications via Telegram. We do not send unsolicited marketing messages.
Legal compliance: Retaining financial records as required by Slovenian and EU accounting regulations.
| Processing Activity | Legal Basis |
|---|---|
| Delivering the Grawx service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Processing payments | Performance of a contract (Art. 6(1)(b) GDPR) |
| Retaining financial records | Legal obligation (Art. 6(1)(c) GDPR) |
| Service improvement and analytics | Legitimate interests (Art. 6(1)(f) GDPR) |
| Service notifications via Telegram | Performance of a contract (Art. 6(1)(b) GDPR) |
We share only the minimum data required for each provider to function.
| Data | Retention Period |
|---|---|
| Full generated content text | 30 days, then permanently deleted |
| Content metadata (type, tone, scores, ratings) | Duration of your account |
| Business information | Duration of your account |
| Purchase records | 10 years (Slovenian accounting law) |
| Account data (user ID, credits, timestamps) | Duration of account + 30 days after deletion |
| API usage logs | 90 days |
To exercise any right below, contact hello@grawx.com. We respond within 30 days.
Request a copy of all personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Request deletion of your account and all associated data, subject to legal retention obligations.
Receive your business data in a structured, machine-readable format.
Ask us to pause processing your data in certain circumstances.
Object to processing based on legitimate interests.
You may also lodge a complaint with Slovenia's supervisory authority: Informacijski pooblaščenec at ip-rs.si.
Grawx is not intended for anyone under 16 years of age. We do not knowingly collect data from children under 16. Contact hello@grawx.com immediately if you believe a minor has used the service.
Grawx is available worldwide. As an EU-based company we apply GDPR as our baseline — one of the strictest frameworks globally. All users benefit from the same high level of protection regardless of location.
United Kingdom: UK GDPR applies. Your rights are equivalent to Section 7. Supervisory authority: ICO (ico.org.uk).
California, USA (CCPA/CPRA): We do not sell your personal information. California residents may request to know, delete, and opt out of any future sale. Contact hello@grawx.com.
Brazil (LGPD): Rights to access, correction, deletion, and portability apply as in Section 7. Supervisory authority: ANPD.
Australia: Australian Consumer Law guarantees apply and cannot be excluded.
All other jurisdictions: Where local law provides stronger rights, those apply. Contact us with jurisdiction-specific questions.
Our website grawx.com uses cookies and similar tracking technologies. We do not set any non-essential cookies without your explicit consent, which you can provide or withdraw at any time via the cookie banner on our site.
Essential cookies are required for the site to function and are set automatically. Marketing cookies — including the Meta (Facebook) Pixel — are only activated after you give consent. The Pixel allows us to measure the effectiveness of our advertising and, if you have a Facebook account, may be used by Meta to show you relevant ads.
You can change or withdraw your consent at any time by clicking the cookie settings link in the banner. For more about how Meta uses this data, see facebook.com/privacy/explanation.
The full list of cookies used on this site:
All API communications use encrypted HTTPS. Our database is hosted on Railway's EU infrastructure with restricted access. Payment processing is handled entirely by Stripe — no card data touches our servers. While we apply industry-standard measures, no internet transmission is 100% secure.
Material changes will be communicated via the Telegram bot at least 7 days before taking effect. Continued use after the effective date constitutes acceptance. Current version always at grawx.com/privacy-policy.
For privacy questions, data requests, or complaints — we respond within 30 days.