Terms of Service

"Service" means the Grou artificial intelligence-assisted human resources platform, including all software, interfaces, AI Agents, APIs, integrations, authentication mechanisms, and related documentation made available by Grou.

"Client" means the organisation or business entity that has entered into this Agreement and whose personnel access the Service.

"Authorised User" means any individual employee, contractor, or agent of the Client who is granted access to the Service by the Client, whether authenticated via email and password or via an approved Identity Provider.

"Client Data" means all data, content, and information submitted to the Service by the Client or its Authorised Users, including employee records, HR data, and related materials.

"AI Agent" means any automated conversational or analytical system deployed within the Service that processes Client Data to assist in HR operations, including agentic workflows that orchestrate multi-step processes on the Client's behalf.

"Third-Party AI Infrastructure" means external artificial intelligence processing infrastructure used by Grou to power components of the Service, as further described in the Privacy Policy.

"Documentation" means all user guides, technical specifications, and support materials provided by Grou in connection with the Service.

"Identity Provider" or "IdP" means a third-party authentication service used to verify the identity of Authorised Users seeking access to the Service, including Google acting as an OAuth 2.0 identity provider via Supabase Authentication.

"SSO" or "Single Sign-On" means an authentication mechanism that allows Authorised Users to access the Service using credentials managed and verified by an approved Identity Provider, without requiring a separate Grou-specific password.

"Google SSO Addendum" means the enterprise-specific terms set out in Section 15 of this Agreement, governing the use of Google as the Identity Provider for the Service.

"Provisioned Account" means an Authorised User account created within the Service upon first sign-in via an approved Identity Provider.

"Super Admin" means an Authorised User with the highest level of administrative privileges within the Client's Grou account, responsible for account configuration, user management, and integration settings.

"Subscription Term" means the period during which the Client is licensed to access the Service, as specified in the applicable Order Form or Subscription Agreement.

2.1 Platform Access — Subject to the terms of this Agreement and timely payment of applicable fees, Grou grants the Client a limited, non-exclusive, non-transferable, revocable licence to access and use the Service during the Subscription Term solely for the Client's internal HR operations purposes.

2.2 Service Description — The Service provides AI-assisted HR operations capabilities including, without limitation: employee self-service facilitation for HR-related requests and inquiries, accessible via conversational AI Agents; operational HR administration support and workflow automation, including attendance, leave, and payroll advisory functions; data analysis and reporting on workforce and HR metrics with AI-generated insights; integration with the Client's existing HRIS and enterprise systems as agreed upon during onboarding, including Mekari Talenta and other third-party systems of record; and authentication services, including support for Google Sign-In where enabled by the Client.

2.3 Agentic Operations — Certain components of the Service involve AI Agents that operate autonomously or semi-autonomously to complete multi-step HR workflows on behalf of the Client. The Client acknowledges that: agentic operations may involve AI Agents reading, writing, or modifying data within connected systems of record on the Client's behalf; the Client retains full responsibility for defining the scope and access boundaries of any agentic workflow deployed within its environment; Grou provides controls for configuring and limiting agentic access, and the Client is responsible for configuring such controls in accordance with its internal policies; and Grou will document all agentic actions taken on behalf of the Client and make such logs available to the Client upon request.

2.4 Modifications to Service — Grou reserves the right to modify, update, or discontinue any aspect of the Service at any time. Where modifications materially reduce the core functionality of the Service, Grou shall provide the Client with no less than thirty (30) days prior written notice. Changes to authentication integrations, including modifications to Google Sign-In compatibility, shall be subject to a minimum of forty-five (45) days prior notice.

3.1 Authorised Use — The Client agrees to use the Service solely for lawful purposes and in accordance with this Agreement. The Client shall not: use the Service to process data in violation of applicable laws or the rights of third parties; attempt to reverse-engineer, decompile, disassemble, or derive the source code of any component of the Service; resell, sublicence, or otherwise transfer access to the Service to any third party without Grou's prior written consent; introduce malicious code, conduct unauthorised penetration testing, or otherwise interfere with the integrity or security of the Service; use AI Agent outputs as the sole basis for consequential employment decisions without independent human review; or circumvent or disable authentication controls, including by sharing SSO-linked credentials between users or bypassing Identity Provider verification mechanisms.

3.2 Account Security — The Client is solely responsible for maintaining the confidentiality of its access credentials and for all activities occurring under its account. Where Google Sign-In is enabled, the Client is additionally responsible for ensuring that only current, authorised employees use it to access the Service. The Client shall notify Grou immediately upon becoming aware of any unauthorised access or security breach.

3.3 Administrator Responsibilities — The Client's Super Admin is responsible for: promptly deactivating Authorised Users who are no longer employed by or affiliated with the Client; reviewing and applying Grou-recommended security configurations within the Client's administrative console; and conducting a review of provisioned Grou accounts and access levels at least once every ninety (90) days.

3.4 Data Accuracy — The Client is responsible for ensuring that Client Data submitted to the Service is accurate, complete, and lawfully obtained. Grou shall bear no liability for outcomes resulting from inaccurate or incomplete Client Data.

4.1 Ownership of Client Data — As between the parties, the Client retains all ownership rights in and to Client Data. Grou makes no claim of ownership over Client Data and shall not use Client Data for any purpose other than the performance of this Agreement and as described in the Privacy Policy.

4.2 Licence to Process — The Client grants Grou a limited, non-exclusive licence to access, process, and use Client Data solely to the extent necessary to provide, maintain, improve, and support the Service.

4.3 Data Controller and Processor — For the purposes of applicable data protection legislation, including Law No. 27 of 2022 on Personal Data Protection (UU PDP) and, where applicable for European Union, the General Data Protection Regulation (GDPR), the Client acts as the data controller in respect of personal data contained in Client Data, and Grou acts as the data processor. Grou shall process such personal data only on the documented instructions of the Client and in accordance with the Data Processing Agreement, which forms part of this Agreement.

4.4 Third-Party AI Infrastructure — The Client acknowledges and agrees that Grou utilises third-party AI infrastructure providers to deliver certain components of the Service. Client Data may be transmitted to and processed by such providers in accordance with Grou's Privacy Policy and applicable data protection obligations. Grou shall ensure that any such providers are bound by data processing terms no less protective than those set out in this Agreement.

4.5 Google Workspace Data — Where the Client's Authorised Users sign in via Google, or where the Client connects Google Calendar or Google Drive, Grou may access the following, each only with the user's explicit OAuth consent: Sign-in — full name, primary email address, and profile photo URL, via Supabase Authentication's Google OAuth integration. Google Calendar (calendar.events scope) — Grou creates calendar events (including Google Meet links) at the user's request. Grou does not read, edit, or delete existing calendar events or other calendars the user can access. Google Drive (drive.readonly scope) — Grou reads the contents of Drive files the user chooses to connect, to index them for search within Grou's Intelligence Base. Grou does not create, edit, or delete any file in the user's Drive.

Grou shall not request or process Google user data beyond the scopes expressly consented to. The Client acknowledges that Google LLC's own terms of service and privacy policies govern Google's processing of data within its systems, and Grou makes no representations regarding Google's data practices.

5.1 Nature of AI Outputs — The AI Agents within the Service produce outputs based on automated processing of data and models. Such outputs are informational and assistive in nature. They do not constitute professional HR, legal, financial, or regulatory advice and should not be treated as such.

5.2 Human Review Obligation — The Client accepts that all outputs generated by AI Agents that relate to employment decisions, performance management, disciplinary action, compensation, or other consequential HR determinations must be reviewed and ratified by a qualified human professional with appropriate authority before being acted upon. Grou disclaims all liability for decisions made on the basis of AI Agent outputs without such independent human review.

5.3 Agentic Action Scope — Where agentic workflows are enabled, AI Agents may take actions within connected systems of record (including read, write, and update operations) within the permission boundaries configured by the Client. The Client acknowledges that: Grou AI Agents operate within the access privileges granted to them by the Client's Super Admin at the time of configuration; the Client is solely responsible for reviewing and limiting the scope of permissions granted to Grou's service accounts and integrations; and Grou will document all agentic actions taken on behalf of the Client and make such logs available to the Client upon request.

5.4 No Guarantee of Accuracy — Grou does not warrant that outputs produced by AI Agents will be free from error, bias, or omission. The Client is responsible for validating AI Agent outputs against its own records, policies, and applicable legal requirements, including Indonesian labour law and social security regulations.

6.1 Subscription Fees — Access to the Service is subject to the fees set out in the applicable Order Form or Subscription Agreement executed between the parties. All fees are quoted in the currency stated in such documents and are exclusive of applicable taxes.

6.2 Payment Terms — Invoices are due and payable within thirty (30) days of the invoice date unless otherwise specified. Grou reserves the right to suspend access to the Service for accounts that are more than fourteen (14) days past due, following written notice to the Client.

6.3 Taxes — The Client is responsible for all applicable taxes, levies, or duties imposed on the Service, excluding taxes on Grou's net income. For Indonesian Clients, fees may be subject to applicable VAT (PPN) in accordance with prevailing Indonesian tax regulations.

7.1 Mutual Obligations — Each party agrees to keep confidential all non-public information received from the other party that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and circumstances of disclosure ("Confidential Information"). For the avoidance of doubt, Grou's AI model architecture, prompt engineering, integration specifications, and pricing structures constitute Confidential Information of Grou.

7.2 Exclusions — Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the receiving party; (b) was already known to the receiving party prior to disclosure; (c) is independently developed without use of or reference to the disclosing party's Confidential Information; or (d) is required to be disclosed by applicable law or valid court order, provided the disclosing party is given reasonable prior notice.

7.3 Duration — Confidentiality obligations shall survive the termination or expiration of this Agreement for a period of three (3) years.

8.1 Grou's Intellectual Property — Grou retains all right, title, and interest in and to the Service, including all underlying software, models, algorithms, prompt systems, interfaces, authentication modules, and documentation. Nothing in this Agreement transfers any intellectual property rights to the Client.

8.2 Feedback — To the extent the Client provides Grou with feedback, suggestions, or recommendations regarding the Service ("Feedback"), the Client grants Grou a perpetual, irrevocable, royalty-free licence to use such Feedback for any purpose, including the development and improvement of the Service. Feedback shall not include Client Data.

9.1 Grou's Warranties — Grou warrants that: (a) it has the authority to enter into this Agreement; (b) the Service will perform materially in accordance with the Documentation under normal use conditions; (c) it maintains commercially reasonable security measures to protect Client Data; and (d) its integration with Google operates in compliance with Google's API Terms of Service as applicable.

9.2 Disclaimer — TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". GROU EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. GROU DOES NOT WARRANT UNINTERRUPTED AVAILABILITY OF THE SERVICE OR OF THIRD-PARTY AUTHENTICATION SERVICES INCLUDING GOOGLE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, GROU'S AGGREGATE LIABILITY TO THE CLIENT FOR ANY CLAIMS ARISING UNDER OR RELATED TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES PAID BY THE CLIENT TO GROU IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

IN NO EVENT SHALL GROU BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, DATA, BUSINESS, OR GOODWILL, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

For the avoidance of doubt, Grou shall not be liable for any loss or damage arising from: (a) the unavailability or malfunction of Google or any third-party Identity Provider; or (b) unauthorised access to the Client's account resulting from compromise of the Client's Google account.

The Client agrees to indemnify, defend, and hold harmless Grou and its officers, directors, employees, and agents from and against any claims, damages, losses, and expenses (including reasonable legal fees) arising out of or relating to: (a) the Client's use of the Service in violation of this Agreement; (b) Client Data, including any allegation that Client Data infringes the rights of a third party; or (c) the Client's employment decisions or actions taken on the basis of AI Agent outputs.

12.1 Term — This Agreement commences on the date the Client first accesses the Service and continues for the duration of the applicable Subscription Term, unless earlier terminated in accordance with this section.

12.2 Termination for Cause — Either party may terminate this Agreement immediately upon written notice if the other party: (a) materially breaches this Agreement and fails to cure such breach within thirty (30) days after receiving written notice of the breach; or (b) becomes insolvent, makes an assignment for the benefit of creditors, or becomes subject to insolvency proceedings.

12.3 Effect of Termination — Upon termination or expiration: (a) all licences granted under this Agreement shall immediately cease; (b) each party shall return or destroy the other party's Confidential Information; (c) Grou shall provide Client Data for export in a standard format for a period of thirty (30) days following termination, after which Grou may delete Client Data from its systems; and (d) any Google OAuth tokens associated with the Client's Grou account shall be revoked.

13.1 Governing Law — This Agreement shall be governed by and construed in accordance with the laws of the Republic of Indonesia, without regard to its conflict of laws principles.

13.2 Dispute Resolution — The parties agree to first attempt to resolve any dispute through good-faith negotiation. If a dispute is not resolved within thirty (30) days of written notice, either party may refer the matter to binding arbitration in Jakarta, Indonesia, in accordance with the rules of the Badan Arbitrase Nasional Indonesia (BANI).

14.1 Entire Agreement — This Agreement, together with all Order Forms, the Privacy Policy, any Data Processing Agreement, and the Google SSO Addendum (Section 15 where applicable), constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements, understandings, and negotiations.

14.2 Amendments — Grou reserves the right to amend this Agreement from time to time. Clients will be notified of material changes no less than thirty (30) days in advance. Continued use of the Service after the effective date of such changes constitutes acceptance.

14.3 Severability — If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

14.4 Waiver — No failure or delay by either party in exercising any right under this Agreement shall constitute a waiver of that right.

14.5 Force Majeure — Neither party shall be liable for any failure or delay in performance due to circumstances beyond its reasonable control, including natural disasters, acts of government, infrastructure failures, or the unavailability of third-party services including Google.

14.6 Contact — For questions or notices relating to this Agreement, please contact: PT Visi Maju Anak Negeri Email: admin@grou.co.id Website: grou.co.id

This Section 15 applies to Clients whose Authorised Users sign in to the Service using Google, via Supabase Authentication's Google OAuth integration.

15.1 Applicability — This Addendum applies where Authorised Users authenticate to the Service using their Google account. By enabling Google Sign-In, the Client confirms that it has disclosed the use of third-party AI-assisted HR tools to its employees as required by applicable law.

15.2 Authentication Mechanism — Grou supports Google Sign-In via OAuth 2.0 / OpenID Connect (OIDC), handled through Supabase Authentication. Grou acts as the OAuth relying party and requests identity tokens from Google's authorisation server on behalf of Authorised Users. Authentication credentials (passwords) are never transmitted to or stored by Grou when Google Sign-In is used. Grou receives only cryptographically signed identity assertions from Google.

15.3 OAuth Consent Scopes — Grou requests the following Google OAuth 2.0 scopes: openid — core authentication and identity assertion (standard sensitivity); email — retrieve primary email address for account matching (standard sensitivity); profile — retrieve display name and profile photo URL (standard sensitivity). Where a user separately connects Google Calendar or Google Drive, Grou additionally requests calendar.events (create calendar events) and/or drive.readonly (read connected Drive files), each only with the user's explicit, separate consent — see Section 4.5 of these Terms and the Privacy Policy for full detail. Grou does not request or store OAuth refresh tokens beyond what is required to maintain an authenticated session or an active Calendar/Drive connection the user has explicitly enabled.

15.4 Provisioning — Where the Client enables directory synchronisation, an Authorised User account is created within the Service the first time a Client's employee signs in via Google. The Client's Super Admin is responsible for promptly deactivating accounts of individuals no longer employed by or affiliated with the Client, via the Grou administrative console.

15.5 Data Received from Google — Grou's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data received via Google OAuth will only be used to provide and improve the Grou Service; Grou will not use Google user data to serve advertisements; Grou will not allow humans to read Google user data unless (a) the Client has given express permission, (b) it is necessary for security purposes, (c) it is required by law, or (d) the data is aggregated and anonymised; and Grou will not sell Google user data to third parties.

15.6 Security Requirements for Google SSO Clients — Clients enabling Google Sign-In are encouraged to implement the following minimum security configurations within their own Google account settings. Multi-Factor Authentication (MFA) — Grou strongly recommends the Client's Authorised Users, and especially Super Admins, enable phishing-resistant MFA (e.g., passkeys or hardware security keys) on their Google accounts. Session Management — The Client should configure appropriate session duration and token expiry settings commensurate with its security requirements. Grou supports session timeouts of a minimum of one (1) hour and a maximum of ninety (90) days.

15.7 Incident Notification Obligations — In the event of a security incident affecting an Authorised User's Google account that may impact the security or integrity of the Service: the Client must notify Grou at admin@grou.co.id within twenty-four (24) hours of becoming aware of the incident; the Client must cooperate with Grou to assess the scope of any potential impact on Authorised User accounts within the Service; and Grou may, at its discretion, temporarily suspend Google Sign-In access for the affected user and require re-authentication via alternative methods pending investigation.

15.8 Compliance with Google's Terms — The Client's use of Google Sign-In in connection with the Service is subject to and must comply with Google's applicable terms of service, including the Google API Terms of Service and Google API Services User Data Policy. Grou is not responsible for changes to Google's APIs, authentication flows, or terms that affect the availability or functionality of the integration.

15.9 Fallback Authentication — Grou maintains a fallback email and one-time password (OTP) authentication mechanism for Super Admin accounts to ensure continuity of administrative access in the event Google Sign-In is unavailable. The Client is responsible for ensuring that fallback contact email addresses for Super Admins are registered and kept up to date within the Grou administrative console.

15.10 Disconnection of Google SSO — An Authorised User may disconnect their Google account from the Service at any time through the Grou administrative console. Upon disconnection: all active Google-authenticated sessions for that user will be terminated and the user will be required to authenticate via Grou's fallback mechanism; Grou will delete all Google-origin OAuth tokens for that user from its systems within seventy-two (72) hours of disconnection confirmation; and the user's account within the Service is retained and transitions to management by the Client's Super Admin.