This Privacy Notice for Shotai, LLC ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@growro.com.
This summary provides key points from our Privacy Notice; you can find more details about each topic in the relevant section below.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the products and features you use.
Do we process any sensitive personal information? No. We do not process sensitive personal information (such as racial origin, sexual orientation, religious beliefs, or biometric data).
Do we collect any information from third parties? Yes — we receive purchase confirmation events from affiliate networks. These contain a click identifier we generated, the order amount, and the commission paid. They do not contain customer names, emails, or payment details.
How do we process your information? We process your information to provide and administer the Services (record activations, match purchases to clicks, accrue and pay out the Robux gift card balance), to respond to user inquiries, for security and fraud prevention, to send you marketing emails you can opt out of at any time, and to comply with law.
In what situations and with which parties do we share personal information? We share personal information with our gift card vendor (Tremendous), our hosting provider (Fly.io), and the affiliate networks that mint our tracking links and report commissions.
How do we keep your information safe? We have appropriate technical and organizational processes and procedures in place to protect your personal information. However, no electronic transmission or storage technology can be guaranteed to be 100% secure.
What are your rights? Depending on where you are located, applicable privacy law may give you certain rights regarding your personal information.
How do you exercise your rights? The easiest way is to contact us at privacy@growro.com or via our contact page. We will consider and act upon any request in accordance with applicable data protection laws.
In short: We collect personal information that you provide to us.
We collect the personal information that you voluntarily provide to us when you create a GrowRo account, sign in, redeem a Roblox gift card, or contact us.
Personal information provided by you is limited to:
Social media login data. You can choose to register or sign in using your Google account (Sign in with Google). If you do, we receive your email address, Google account ID, and the display name and profile picture URL Google associates with your account. We use this information to identify you on subsequent sign-ins and to populate your GrowRo account; we do not receive your Google password, your Google Contacts, or any other Google data beyond what is necessary to complete the sign-in. The scopes we request are documented in our Third Parties section and in the Google OAuth consent screen you see when first authorizing GrowRo.
Google API limited use. GrowRo's use of information received from Google APIs (specifically, the Google Identity / Sign-in API) adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google-provided email, account ID, name, and profile picture solely to authenticate you and personalize your GrowRo account; we do not transfer this data to third parties for advertising, do not allow humans to read it except as described in Section 19 below, and do not use it to develop, improve, or train generalized AI/ML models.
Sensitive information. We do not process sensitive personal information.
In short: Some information — such as URLs of pages you visit on supported retailers, click events, and basic browser/device information — is collected automatically when you use the Services.
We automatically collect certain information when you use the Services. The information we collect includes:
chrome://extensions) so it can detect when you're at a
checkout, the rate at the current store, and similar. It does not
run on your bank, email, social media, or any other site outside
that list.
In short: Affiliate networks send us purchase confirmation events when a click we tracked converts to a sale.
Affiliate networks send us server-to-server notifications ("postback events") when a tracked click converts to a sale. These events contain the click identifier we originally generated, the order amount, and the commission paid. They do not contain customer names, email addresses, payment details, or any directly identifying personal information. We use this data to credit the Robux gift card balance of the user whose click produced the sale. Sources include affiliate networks listed under "When and with whom do we share personal information?" below.
In short: We process your information to provide, improve, and administer the Services, communicate with you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason to do so.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
In short: We only process your personal information when we have a valid legal reason to do so under applicable law.
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on to process your personal information. We may rely on the following legal bases:
Under Canadian privacy law, we may process your information if you have given us specific permission (express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time by contacting us.
In short: We share information in specific situations described in this section and with the third parties listed below.
We may share your data with third-party vendors, service providers, and partners ("third parties") that perform services for us or require access to your data to complete the Services. We have contracts in place with our third parties that include data protection terms (or rely on their published Data Processing Agreements) and limit how they may use the data.
The third parties we share personal information with are:
admin@growro.com, privacy@growro.com,
support@growro.com, partnerships@growro.com,
and press@growro.com mailboxes. Emails you send us
are stored in those mailboxes.
We may also share your personal information in the following situations:
We do not sell, rent, or share your personal information with advertisers, data brokers, or anyone else outside the categories above.
In short: We may use cookies and similar tracking technologies to collect and store your information.
We use cookies and similar tracking technologies to operate and secure the Services. Specifically:
chrome.storage.local
for your account's user ID and session bearer token, so the
extension recognizes your account across sessions. The bearer
token is the same kind of opaque random string our website
stores in the growro_session httpOnly cookie — see
Section 9 below for storage and hashing details.
chrome.storage.session for
stand-down cooldown records (see Section 15).
We use a product-analytics tool (PostHog) to understand how the Services are used and to measure conversion funnels. PostHog stores an anonymous identifier in your browser so that events from the same browser are grouped together. We do not use advertising cookies, retargeting cookies, social-media plug-in cookies, or cross-site behavioral tracking across third-party sites. In the European Economic Area, the United Kingdom, Switzerland, and Brazil, we show a consent banner before any analytics storage is created; in regions where consent is not required (including the United States and Canada), analytics initializes alongside the strictly necessary session cookie. Specific information about each technology and how to refuse cookies is set out in our Cookie Notice.
Some earlier rewards browser extensions silently overwrote whatever affiliate cookie was already on your retailer visit so they could collect the commission for themselves. That practice led to high-profile litigation in 2024 and prompted Google to update Chrome Web Store policy in 2025 to ban the behavior. GrowRo doesn't do it.
Specifically:
cjevent, irclickid,
awc, afsrc=1; or known affiliate
redirector domains like anrdoezrs.net,
awin1.com, click.linksynergy.com).
afsrc=1
stand-down parameter so any compliant downstream affiliate
extension you have installed will pause itself on that retailer
too.
We treat this as a privacy and integrity commitment, not just a legal one.
In short: Our servers are in the United States. We may transfer and process your information in countries other than your own.
Our application servers are located in the United States (Fly.io
region sjc, San Jose, California). The third parties
we share data with are located in the United States and the United
Kingdom. If you are located in the European Economic Area (EEA),
the United Kingdom (UK), Switzerland, or Canada, your personal
information may be transferred to and processed in countries that
do not have privacy laws as comprehensive as those in your home
country.
European Commission's Standard Contractual Clauses. We rely on Standard Contractual Clauses for transfers of personal information from the EEA, UK, or Switzerland to the United States. Our third-party providers (Fly.io, Tremendous, the affiliate networks) similarly maintain SCC-based safeguards for such transfers under their published Data Processing Agreements.
In short: We keep your information only as long as necessary to deliver the Services or as required by law.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it.
In short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. Among these: HTTPS-only transport via Let's Encrypt; passwords hashed with argon2id (OWASP 2024 parameters); per-session 256-bit random session tokens stored as SHA-256 hashes at rest (never as plaintext) with constant-time comparison; HMAC + shared-secret verification on every affiliate postback; data minimization (only opaque user IDs and click identifiers are shared with affiliate networks; your email, name, and password are not); session tokens stored only in httpOnly cookies and Chrome extension storage, never in URL query strings; HMAC-hashed IP addresses (not raw IPs) in session and audit-log records; sliding 1-year session expiry with full per-device revocation from the account page; production manifest hardening that drops localhost host-permissions and gates development endpoints behind an environment flag.
However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.
In short: We do not knowingly collect data from or market to anyone under 18.
The Services are intended only for users who are at least 18 years old. We do not knowingly collect, solicit data from, or market to anyone under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 years old. If we learn that personal information from a user under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from someone under 18, please contact us at privacy@growro.com.
In short: Depending on where you live, you may have rights regarding your personal information including the right to access, correct, delete, or port your data.
In some regions (such as the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right to (i) request access and obtain a copy of your personal information; (ii) request rectification or erasure; (iii) restrict the processing of your personal information; (iv) data portability where applicable; (v) not be subject to automated decision-making; and (vi) object to certain processing.
Self-service data export. You can download a portable copy of your account data at any time from the account page on growro.com (the "Download my data" button), which returns a JSON file containing your profile, sessions metadata, activations, transactions, redemptions, referrals, disputes, and security audit entries. Session token hashes and other users' personal data are intentionally excluded. This satisfies the GDPR Article 20 right to data portability and the equivalent right under US state privacy laws.
You can also exercise any of the rights above by emailing privacy@growro.com or visiting our contact page. We will consider and act upon any request in accordance with applicable data protection laws.
If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or the UK data protection authority.
If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing your consent. If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us. However, withdrawing your consent will not affect the lawfulness of the processing before its withdrawal nor the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
Opting out of marketing emails. You can unsubscribe from GrowRo marketing emails at any time from the account page (Account → Email preferences) or by clicking the unsubscribe link at the bottom of any marketing email. You will be removed from the marketing list; we will still send service emails necessary for your account, such as sign-in security and gift card redemption confirmations.
Cookies and similar technologies. Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. For further information, see our Cookie Notice.
Most web browsers include a Do-Not-Track ("DNT") feature you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals.
Global Privacy Control (GPC). We recognize and honor Global Privacy Control signals. If you use a browser or extension that supports GPC, we treat the signal as a valid request to opt out of the sale or sharing of your personal information for targeted advertising under applicable US state privacy laws, including the California Consumer Privacy Act (CCPA). When we detect a GPC signal we automatically apply your opt-out preference without requiring you to take any additional action. For more information about GPC and how to enable it, visit globalprivacycontrol.org.
In short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you, correct inaccuracies, get a copy, or delete your personal information. These rights may be limited in some circumstances by applicable law.
The table below shows the categories of personal information we have collected in the past twelve (12) months.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Online identifier, account user ID, click identifier, email address, hashed password, hashed session token | YES |
| B. California Customer Records (CA Civil Code §1798.80) | Name, signature, SSN, address, phone, financial info, etc. | NO |
| C. Protected classifications | Gender, age, race, ethnicity, marital status, etc. | NO |
| D. Commercial information | Activation history, postback events, redemption history | YES |
| E. Biometric information | Fingerprints, voiceprints | NO |
| F. Internet or other electronic network activity | Browsing history on supported retailers, click events, interactions with retailer pages | YES |
| G. Geolocation data | Device location | NO |
| H. Audio, electronic, sensory data | Recordings, images | NO |
| I. Professional or employment-related | Work history, professional qualifications | NO |
| J. Education information | Student records | NO |
| K. Inferences from collected information | Profiles or summaries about preferences/characteristics | NO |
| L. Sensitive personal information | SSN, financial account login, precise geolocation, health, biometric, etc. | NO |
Personal information is collected directly from you (email address you save in the GrowRo dashboard), automatically from your interaction with the Services (URLs of supported retailers, click events, browser metadata), and from affiliate networks (postback events). For details, see "What information do we collect?" above.
Learn more in "How do we process your information?" and "When and with whom do we share your personal information?" above.
We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months.
We have disclosed the following categories of personal information to third parties for a business purpose in the preceding twelve (12) months:
The categories of third parties to whom we disclosed personal information are listed under "When and with whom do we share your personal information?" above.
You have rights under certain US state data protection laws. These rights are not absolute, and in certain cases we may decline your request as permitted by law. They include:
To exercise these rights, contact us at privacy@growro.com or via our contact page. We will verify your identity (using the email associated with your account or other information you provide) and respond within the time required by applicable law.
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing privacy@growro.com. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons. If your appeal is denied, you may submit a complaint to your state attorney general.
California Civil Code §1798.83 permits California residents to request, once per year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes in the preceding calendar year. We do not disclose personal information to third parties for direct marketing purposes.
GrowRo is not affiliated with, endorsed by, or sponsored by Roblox Corporation. Roblox, Robux, and the Roblox Tilt logo are trademarks of Roblox Corporation. Our use of "Roblox" and "Robux" across the GrowRo product and in this Privacy Policy is descriptive — we issue Roblox gift cards as the payout to users — and is intended as nominative fair use only. We do not use Roblox's logo, the "Now on Roblox" badge, or any Roblox avatar or character artwork in our marketing materials.
When you visit a supported retailer, the GrowRo browser extension
checks whether another affiliate publisher has already referred
you. If we detect prior attribution (via affiliate URL parameters
such as cjevent, irclickid,
awc, or ranmid, or known affiliate
redirector domains), we record a session-length cooldown for that
retailer in your browser's session storage and display a "paused"
indicator instead of an activation banner. The cooldown clears
automatically when you close the browser. We do not override
another publisher's affiliate cookie. Decisions to pause are
recorded in a server-side compliance audit log (capped at 5,000
entries) and contain only your account's user ID, the retailer
domain, and the type of signal we detected.
In short: Yes — we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top. Material changes will be posted on growro.com with an updated effective date before the new version takes effect. Registered users will additionally receive an email notification of material changes at their account email address before the changes take effect.
If you have questions or comments about this notice, you may email us at privacy@growro.com, call us at +1 (347) 450-0718, or contact us by post at:
Shotai, LLC
c/o Legalinc Corporate Services Inc.
131 Continental Dr, Suite 305
Newark, DE 19713, USA
You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. To exercise any of these rights, please visit our contact page or email privacy@growro.com.
GrowRo's use of information received from Chrome APIs and the Chrome Web Store will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically: