Privacy Policy

JRJ Group Holdings LLC, doing business as UNIFY (“UNIFY,” “we,” “us,” or “our”), operates the GroFi application and website at https://grofi.com. Our office is at 40 Wall Street, 21FL, New York, NY 10005.

GroFi is a commercial financing platform. Merchants apply for merchant cash advances and similar commercial transactions. Independent sales organizations (brokers) submit deals. Job candidates apply for roles. This policy covers personal information processed through those surfaces.

This policy applies to:

• The public website and contact form
• Merchant funding applications and supporting documents
• Bank account linking through Plaid, when that feature is used
• The broker portal and broker onboarding documents
• Careers applications
• Staff use of the GroFi admin application

This policy does not cover third-party sites we link to, including Plaid’s own services. Plaid’s end-user privacy policy is at plaid.com/legal.

Merchant and owner information. From a funding application we collect business identity (legal name, DBA, EIN, entity type, industry, address, sales, start date, phone, email); owner and optional co-applicant identity (name, Social Security number, date of birth, home address, ownership percentage, credit score or estimate); funding details (amount requested, use of funds, monthly revenue, average bank balance, existing advances); uploaded bank statements and other underwriting documents; and the signed authorization.

Bank account information via Plaid. If you connect a financial account through Plaid Link, we receive account and routing identifiers, balances, and transaction history needed to underwrite the application. We request read-only access. We cannot move, withdraw, or initiate payments on the connected account through that connection. Plaid, not GroFi, collects your financial-institution login credentials.

Broker information. Name, company, email, phone, password, ISO agreement signature, and onboarding compliance documents.

Website and communications. Contact-form name, email, phone, and message; careers resume and cover letter; IP address recorded with an application signature; and essential cookies described in the Cookie Policy.

• To evaluate, underwrite, and service commercial financing applications
• To obtain consumer and business credit reports, as you authorize in the application
• To verify identity, ownership, and bank activity, including through Plaid
• To communicate about an application, offer, or support request
• To operate the broker portal and pay or track partner activity
• To review job applications
• To secure the platform, prevent fraud, and meet legal obligations

We do not sell personal information. We do not use connected bank data for targeted advertising.

We share information only as needed to run GroFi and as the merchant authorization allows:

• Financing recipients. The application authorization lets UNIFY and its representatives, successors, assigns, and designees who may be involved with or acquire the transaction receive application information, credit reports, and bank or processor statements.
• Consumer reporting agencies such as TransUnion, Experian, and Equifax, for credit pulls you authorize.
• Plaid Inc., to connect financial accounts. Your use of Plaid is also subject to Plaid’s privacy policy.
• Service providers that host GroFi (application hosting, PostgreSQL database, object storage), send email, and run our deal pipeline. Pipeline records sent to Monday.com exclude SSN, EIN, owner names, email, and phone. Those fields stay in GroFi under access control.
• Brokers who submitted a deal, limited to deal status and offer terms they need to work the file, not full owner SSN or date of birth.
• Legal and safety. If required by law, to respond to lawful process, or to protect UNIFY, merchants, or the public.

GroFi encrypts data in transit with TLS. Sensitive identity fields (SSN, date of birth, EIN) are encrypted at rest with AES-256-GCM before they are stored. Application documents sit in a private object-storage bucket gated by GroFi access control. Public marketing media uses a separate bucket. Staff access is role-based (admin, editor, broker) and described in the Access Control Policy and Data Encryption Practices.

We keep application and transaction records for the life of the relationship and then for seven years, unless a longer period is required by law or an active dispute. You may request deletion at privacy@grofi.com. We will delete or de-identify personal information when we no longer need it and law does not require us to keep it. Details are in the Data Deletion and Retention Policy.

• Request access, correction, or deletion at privacy@grofi.com or via the contact form.
• Disconnect a Plaid-linked account by contacting us. We will stop new pulls from that Item.
• Brokers can reset a password from the broker login screen.
• California residents may request to know, delete, or correct personal information. We will not discriminate for exercising those rights. We do not sell or share personal information as those terms are used in the CCPA/CPRA.

Because GroFi is commercial financing, some records must be retained even after a deletion request (for example, a funded file needed for tax, audit, or anti-fraud obligations). We will say so if that applies.

GroFi is for businesses and their authorized officers. It is not directed at children under 18. We do not knowingly collect personal information from children.

We will post updates on this page and change the effective date. Material changes that affect how we use personal information already collected will be called out on this page.

Privacy requests: privacy@grofi.com
General: info@grofi.com or grofi.com/contact
Mail: JRJ Group Holdings LLC D/B/A UNIFY, 40 Wall Street, 21FL, New York, NY 10005