Privacy statement

1. Introduction

Growf (“Growf”, “we”, “us”) provides an AI operating system for agencies. This Privacy Policy explains what information we collect, why we collect it, and the choices you have. It applies to our website, applications and API (together, the “Services”). For the purposes of the EU General Data Protection Regulation (GDPR), Growf acts as a data controller for account data and as a data processor for the client content you put into the platform.

2. What we collect

We collect information in three ways:

• Information you provide. Account details such as name, work email and workspace name; billing information; and the content you upload, such as briefs, strategies, assets and client context.
• Information from your use. Log data, device and browser information, IP address, and product usage events that help us run and improve the Services.
• Information from integrations. When you connect a third-party tool, we receive the data you authorise that connection to share.

3. How we use data

We use information to:

• provide, maintain and secure the Services;
• run the agents and features you ask for, on your instruction;
• process payments and manage your subscription;
• provide support and respond to your requests;
• understand usage so we can improve the product;
• comply with legal obligations and enforce our Terms.

Our legal bases include performance of our contract with you, your consent where required, our legitimate interests in operating the Services, and compliance with the law.

4. AI & your content

Growf uses AI and agents to turn briefs into strategy and content. This is important, so we say it plainly:

• We do not use your private client content to train shared or foundation models.
• Content is processed to generate outputs for your workspace only, on your instruction.
• Where we use third-party model providers, they act as our subprocessors under contractual terms that prohibit training on your data.

5. Sharing & processors

We do not sell your personal data. We share information only with:

• Subprocessors: vetted vendors (hosting, model providers, payments, analytics) who process data on our behalf under data-processing agreements.
• Within your workspace: with members and roles you grant access to.
• Legal & safety: when required by law or to protect the rights and safety of users and the public.
• Business transfers: in connection with a merger, acquisition or sale of assets, subject to this Policy.

6. Retention

We keep personal data for as long as your account is active and as needed to provide the Services. When you delete content or close your workspace, we delete or anonymise associated personal data within a reasonable period, unless we must retain it to meet legal, accounting or security obligations.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. You can exercise many of these directly in-product, or by contacting us. If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.

8. International transfers

Growf is operated from the European Union and primarily stores data within the EEA. Where data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

9. Changes to this Policy

We may update this Policy from time to time. When changes are material, we’ll notify you through the Services or by email before they take effect. The “last updated” date above always reflects the current version.

---

10. Contact

Questions about privacy, or want to exercise a right? Email our team at privacy@growf.com. You can also review our Security practices and Terms of Service.