Last updated: 2026-10-25
This policy explains how [Legal name], [Registered address] ("we") handles personal data when you use Grower Platform. We are the controller of this data. Questions or requests: [Privacy contact email].
| Data | Purpose | Legal basis |
|---|---|---|
| Account: email address and a scrambled (hashed) password | Create and secure your account | Performance of our contract with you |
| What you enter: product descriptions, links, plans, posts and the results you log | Generate your plan and content, run reviews | Performance of contract |
| Usage records: AI actions, tokens and searches used, last active time | Enforce fair-use limits, prevent abuse, control costs, improve the Service | Legitimate interests |
| Product events: which steps and features you use (for example “built a plan”, “marked a post as posted”, “copied a caption”), errors, a reason if you choose to give one when cancelling, and whether a result you logged had any signups (yes or no). Event names and small numbers only, never what you type | Understand where people get stuck and fix it; find and fix errors. If you agree to join a pilot, we also look at the order and timing of your own events to see where setup is slow | Legitimate interests |
| Feedback and check-in answers you choose to send: your suggestion, what you use today instead, and how you'd feel if you could no longer use the app | Decide what to fix and build next | Legitimate interests |
| Signup source: the campaign tag or website that sent you to us, if any | Know which channels bring customers | Legitimate interests |
| Product workspaces, uploaded files, generated slides and videos | Store and organize your marketing materials by product | Performance of contract |
| Connected social accounts: profile/channel identifiers, display names, encrypted authorization tokens, recent post metadata and aggregate counts | Import and display performance for the product you connect; no viewer identities are collected | Performance of contract |
| AI provider keys you choose to save | Run AI requests on your own account | Performance of contract |
| Subscription details from Paddle: status, customer and subscription IDs, renewal date | Give subscribers access, handle billing questions | Performance of contract; legal obligations |
| Technical data: IP address and failed sign-in attempts (kept in memory for up to 15 minutes) | Security and preventing password guessing | Legitimate interests |
We do not collect your card details; Paddle handles payment. We don't use advertising trackers or session recording, and we don't sell your data.
Some recipients are located outside the UK and EEA, including in the United States. Where that happens, we rely on adequacy decisions or Standard Contractual Clauses (and the UK International Data Transfer Addendum) to protect your data.
Website imports and uploaded assets are saved with the product you select. Optional website tracking records daily event totals by product, event type and campaign source. The collector does not store visitor identities, cookies, IP addresses or full page URLs; totals expire after 90 days. Optional email reminders use your account email and selected product/timezone settings and can be stopped in Today or through the stop link in each email. Reminder delivery uses the configured email provider.
We keep account data, content, saved provider keys and app usage records while your account is open. Product events expire after 180 days. Successful account deletion in Settings removes your account and associated records from the live app database, deletes your stored material files, stops active video jobs and invalidates all sign-in sessions. If you contact us instead, we handle your request without undue delay, subject to applicable law. Existing backups may retain older data until they expire under our backup schedule: [Backup retention in days] days. Backups are restricted to recovery; before restoring a backup, we must reapply deletions. Paddle and AI providers handle data already sent to them under their own terms and retention policies. Paddle may retain billing records for legal or tax obligations.
Depending on where you live, you can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Email [Privacy contact email]; we respond within one month. You can also complain to your data protection authority (in the UK, the ICO; in the EU, the authority where you live).
We use HTTPS, hash passwords with scrypt, encrypt saved provider keys with AES-256-GCM, limit sign-in attempts and scope every request to the signed-in user. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.
We set the strictly necessary gp cookie to keep you signed in (7 days). When you start connecting a social account, a temporary gp_social_* cookie binds the authorization callback to your browser for up to 10 minutes. We don't use analytics or advertising cookies, and our signup-source tracking works without cookies. When you open checkout, Paddle may set its own cookies for payment and fraud prevention; see Paddle's policy.
The Service is not for anyone under 18.
We'll post updates here and tell you about material changes by email or in the app.