Privacy notice
Last updated 28 September 2026
Who is responsible
Groma is operated by Jorge Gil, who decides how the personal data described here is used. For anything about your data, write to jorge.gil@rolandberger.com.
What we hold, and why
- Your account - your name, email address and a password (stored only as a secure hash). Used to sign you in and to show your team who did what.
- Project content - the workstreams, tasks, dates and updates you and your team put into a project, and a history of changes to them. Used to run the project; only members of that project can see it.
- Conversations with RB AI - the questions you ask and the answers given, kept so you can come back to them. Only you can see your conversations.
- Error reports - when something breaks, a technical report of the error, with email addresses, passwords and session tokens removed. Used only to fix the fault.
The legal basis is the performance of the service you were invited to use and, for error reports, the operator's legitimate interest in keeping it working.
Who processes it for us
- Supabase - the database and sign-in, hosted in the European Union (Ireland).
- Vercel - hosting of the application, served from the European Union (Dublin).
- Anthropic - the model behind RB AI. When you ask RB AI something, your question and the relevant project content are sent to Anthropic to produce the answer. This may involve processing outside the European Union, under the provider's data processing terms.
- Sentry - error reports, hosted in the European Union (Germany).
Your data is not sold, and it is not used for advertising.
Cookies
Groma uses only the cookies needed to keep you signed in, and remembers your light or dark theme in your browser. There are no analytics or advertising cookies.
How long we keep it
Account and project data are kept while your account or the project exists. You can ask for your account to be deleted at any time; project content you created stays with the project for its other members unless you ask for it to be removed.
Your rights
You can ask for a copy of your data, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable format - write to jorge.gil@rolandberger.com. You may also complain to your data protection authority; in Spain, the Agencia Española de Protección de Datos (aepd.es).