1. Who we are
Growpad (“we”, “us”) is the data controller for the personal data you submit to our Service, and the data processor for any data you import from your Google or HubSpot accounts on behalf of end users.
Contact for privacy inquiries: privacy@growpad.co.
2. What we collect
Account data (you provide): email, display name (optional), your organization name + domain.
Connected-account data (you authorize): Google Search Console metrics; Google Analytics 4 metrics; and from HubSpot, your deals (stage, amount, currency, close date and lead source), companies (name, website, industry, size, revenue band and country), contacts and form submissions.
HubSpot contacts are personal data. For each contact we store their first and last name, job title, lifecycle stage, how they first found your site, and the other contact fields your HubSpot account holds. We do not keep the email address in readable form: we store a one-way hash of it, only so we can match a contact to their form submissions and deals. We also store each contact’s activity from HubSpot (notes, calls, emails, meetings and tasks, including their text), the pages they viewed and the emails they opened, and the fields each form submission collected, which can include the email address typed into the form. We use this to show which pages and searches bring in real buyers: job titles, companies and lifecycle stages in your buyer profile, and the contacts and deals behind each topic.
Usage data (we observe): page views, feature interactions, recommendation feedback, and the IP address of each request in our audit log (kept 1 year).
What we do NOT collect: payment card data (we do not take payments yet; see section 4).
3. Why we collect it
- Service delivery - search-intent clusters + pipeline recommendations.
- Security + fraud prevention - audit logs retained 1 year.
- Customer support - so we have context when you email us.
- Product improvement - metrics on recommendations acted on and, with your consent, product analytics (PostHog, below). Never shared or sold.
We rely on legitimate interest (GDPR Art 6(1)(f)) for service delivery + security, and consent for product-improvement analytics (change or withdraw it any time with Cookie preferences at the bottom of this page).
4. Who we share with
Only the subprocessors listed below:
- Supabase - authentication (magic link, OAuth). Sees your email + auth events.
- AWS Bedrock - AI processing of the summaries we build from your data, on models AWS hosts for us in its US East (N. Virginia) region (from DeepSeek, Zhipu AI and Amazon). The model makers do not receive your data. Sees your site’s page addresses and the search terms that lead to them (with URL parameters and email addresses removed), topic labels, per-topic and per-page figures (traffic, rankings, click and scroll metrics, lead and deal counts and values), buyer-profile percentages (industry, company size, job title) and, if you connect Hotjar, your visitors’ survey answers. Never a HubSpot contact’s name, email address or other contact-level details. AWS Bedrock’s terms forbid model training on customer prompts.
- Google - you connect GSC/GA4; Google sees the same.
- HubSpot - you connect HubSpot; HubSpot sees the same.
- Semrush (optional, you connect) - public SEO data fetched with your Semrush API key. Sees your domain, competitor list and country choice.
- Microsoft Clarity (optional, you connect) - page friction metrics fetched with your Clarity API token. Sees your page addresses and aggregate click and scroll metrics.
- Hotjar (optional, you connect) - survey responses sent to us. Sees the same survey content your visitors submit on your site.
- SerpAPI (optional, you connect) - Google AI Overview, AI Mode and Copilot answers for your tracked queries. Sees the query text and target country.
- DataForSEO (optional, you connect) - keyword, competitor and backlink data, daily Google rank checks and AI Overview checks for your tracked search terms, a crawl of your public pages with page-speed checks, and ChatGPT, Claude, Gemini and Perplexity answers for your tracked questions, fetched with your DataForSEO login. Sees your domain, competitor list, target market, and the search terms we track: your tracked questions and search terms from your Search Console. It asks ChatGPT, Claude, Gemini and Perplexity (OpenAI, Anthropic, Google, Perplexity) those questions on your behalf. Never your traffic figures, CRM data or anything about your visitors.
- Resend - magic-link + transactional email delivery.
- Amazon Web Services (S3-compatible storage) - encrypted raw payloads and encrypted backups. Sees encrypted files only; we hold the keys.
- Telegram (internal alerts) - pages our operator when something breaks. Sees a workspace identifier and a short technical reason, never your data.
- PostHog (only if you accept analytics in the cookie banner) - product analytics on how the Growpad app is used: the address of each page viewed (without its search parameters) and named actions such as opening a brief or accepting a recommendation, linked to your Growpad user ID. No automatic click capture, no session recording, never your email or your connected accounts’ data. Hosted in the US.
- DuckDuckGo - fetches your website’s icon for the workspace avatar. Sees your website’s domain name only.
- Sentry (optional, error aggregation) - stack traces with PII scrubbed at the SDK layer.
We do not currently process payments or share data with any payment processor. If we add billing later, we’ll update this policy and notify you in advance.
We do NOT sell, rent, or share personal data for third-party marketing.
5. Where we store it
Your data is stored on Amazon Web Services servers in the Asia Pacific (Mumbai) region. Backups are encrypted, stored in the same region and kept for 7 days. All data is encrypted in transit (TLS 1.2 or later), and the sign-in tokens for your connected accounts are encrypted at rest. No user data leaves the region except when sent to the subprocessors listed above; AI processing (AWS Bedrock) runs in the US East (N. Virginia) region.
6. Retention
- Raw API payloads: 90 days by default
- Normalized + aggregated metrics: 2 years (730 days) by default
- Data-quality and buyer-profile snapshots: 90 days by default
- You can change each of the three windows above for a workspace in Settings › Retention: metrics and snapshots from 7 days to 5 years (1,825 days), raw payloads from 7 to 180 days (a daily cleanup removes every payload older than 180 days).
- Reports + recommendations: indefinite until you delete them
- Recommendation feedback: indefinite (aggregated, no PII)
- Deleted accounts: kept for a 30-day grace period, then permanently erased
- Product analytics events (PostHog, only if you accepted analytics): kept for PostHog’s retention period. They are not removed automatically when you delete your account; email privacy@growpad.co and we delete them.
- Audit logs (including request IP addresses): 1 year. Each entry is hash-chained so it cannot be altered, which is why the IP stays with the entry until the entry is deleted. Backups: 7 days, encrypted
7. Your rights (GDPR + analogous)
- Access (Art 15): download a copy of your data from Export your data
- Portability (Art 20): the same export, as machine-readable JSON
- Rectification (Art 16): edit your account settings or email us
- Erasure (Art 17): delete your account in your account settings, or email privacy@growpad.co
- Restriction (Art 18): email privacy@growpad.co
- Objection (Art 21): email privacy@growpad.co
- Withdraw consent: use Cookie preferences at the bottom of this page for analytics, unsubscribe from email in your notification settings, and disconnect any connected account from a workspace’s Integrations page
We respond within 30 days. No fees for reasonable requests; excessive requests may incur a fee per Art 12(5).
8. Children
The Service is not directed at children under 16. If you believe a child has signed up, email privacy@growpad.co and we’ll delete the account.
9. Changes
We’ll notify customers of material changes at least 30 days in advance via email + in-app banner.
10. Complaints
You may lodge a complaint with your local data protection authority. For EU customers: the relevant DPA depends on your country of residence.
Questions: privacy@growpad.co.