Privacy Policy

GASEFC LLC, doing business as Growth Automations ("we", "us", or "our"), operates the growthautomations.com platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and password. If you sign up through a third-party provider (e.g., Google), we receive your name and email from that provider.

1.2 Billing Information

Payment processing is handled by Stripe. We do not store your full credit card number. Stripe may collect and store payment details in accordance with their privacy policy.

1.3 Site Content

When you build a website through our platform, we store the content, images, and configuration you provide. This data belongs to you and can be exported at any time.

1.4 Connected Accounts (OAuth)

If you connect third-party services (Google, Microsoft, Meta, Notion, etc.) to your account, we receive and securely store access tokens and refresh tokens to maintain the connection. We access only the data scopes you authorize during the connection flow. Tokens are encrypted at rest.

1.5 Usage Data & Analytics

We use PostHog for product analytics. We collect information about how you interact with the Service, including pages visited, features used, and actions taken. This data helps us improve the product. You can opt out of analytics tracking via the cookie consent banner.

1.6 Cookies

We use cookies and similar technologies for authentication, preferences, and analytics. See our Cookie Policy for details.

2. How We Use Your Information

• Provide, maintain, and improve the Service
• Process transactions and send billing-related communications
• Authenticate your identity and maintain session security
• Facilitate third-party integrations you authorize
• Send important notices about your account or the Service
• Analyze usage patterns to improve functionality and performance
• Detect, prevent, and address technical issues or abuse

3. How We Share Your Information

We do not sell your personal information. We share data only in these circumstances:

• Service providers: Supabase (database and authentication), Stripe (payments), PostHog (analytics), Netlify (hosting), and GitHub (code deployment) — each processes data in accordance with their own privacy policies.
• Third-party integrations: When you connect external services (Google, Microsoft, Meta, Notion), data flows to those providers as authorized by you.
• Legal requirements: We may disclose information if required by law, subpoena, or legal process.

4. Data Security

We implement industry-standard security measures including encrypted connections (TLS), encrypted credential storage (pgcrypto), role-based access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure.

5. Data Retention

We retain your account data for as long as your account is active. When you close your account, removal happens in stages rather than all at once, as described in our Terms of Service (Account Closure and Termination):

• Grace period (30 days) — read-only access; you can export your data and reactivate, and your sites stay live.
• Cold-storage period (60 days) — sites are taken offline, active subscriptions are canceled, and connected repositories are archived. An administrator can still restore your account on request during this window.
• Archival — your account and content are archived, and personal data is anonymized two years after archival pursuant to GDPR Article 17 (right to erasure), except where retention is legally required.

Billing and tax records (invoices, payment history) are retained for up to 10 years where required by applicable tax law, with personal identifiers hashed once the retention period expires. You may request erasure of eligible personal data at any time; we honor verified requests within 30 days, extendable where the law permits.

Deleted data is also purged from our encrypted backups as they age out of the normal backup-rotation cycle (within 90 days). When you disconnect a third-party integration (such as Facebook/Meta) or close your account, we delete the stored OAuth access and refresh tokens and any provider-derived data we cached for that connection. For step-by-step instructions on requesting deletion or removing a connected account, see our Data Deletion page.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data.
• Portability: Request a machine-readable export of your data.
• Opt-out: Opt out of analytics tracking via the cookie consent banner.
• Withdraw consent: Revoke any consent you have provided at any time.

6.1 For California Residents (CCPA)

California residents have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information.

6.2 For EU/EEA Residents (GDPR)

If you are located in the EU/EEA, our legal bases for processing are: performance of a contract (providing the Service), legitimate interests (improving the Service and preventing abuse), and consent (analytics and marketing cookies). You may lodge a complaint with your local data protection authority.

7. Children's Privacy

The Service is not directed to individuals under 16. We do not knowingly collect personal information from children. If we learn we have collected data from a child, we will delete it promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or a notice on the Service. Your continued use after changes constitutes acceptance of the updated policy.

9. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: support@growthautomations.com