Privacy Policy

GASEFC LLC, doing business as Growth Automations ("we", "us", or "our"), operates the growthautomations.com platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and password. If you sign up through a third-party provider (e.g., Google), we receive your name and email from that provider.

1.2 Billing Information

Payment processing is handled by Stripe. We do not store your full credit card number. Stripe may collect and store payment details in accordance with their privacy policy.

1.3 Site Content

When you build a website through our platform, we store the content, images, and configuration you provide. This data belongs to you and can be exported at any time.

1.4 Connected Accounts (OAuth)

If you connect third-party services (Google, Microsoft, Meta, Notion, etc.) to your account, we receive and securely store access tokens and refresh tokens to maintain the connection. We access only the data scopes you authorize during the connection flow. Tokens are encrypted at rest. Section 1.5 describes exactly what we receive from Google.

1.5 Information We Receive from Google

You can connect Google services to the Service. Each one asks for its own permission on Google's consent screen, and you can grant or decline each permission separately. We only request a Google service when you choose to connect it. Here is exactly what each one lets us access and what we do with it:

• Your Google account identity (all Google connections): your email address and Google account ID. We use them to show which Google account is connected and to tell connections apart.
• Google Business Profile: the list of Business Profile accounts and locations you manage. We show this list so you can choose which location belongs to which of your websites, and we save the location you choose.
• Google Search Console (read-only): the list of sites you can access in Search Console, and search performance for the site you link: clicks, impressions, click-through rate, average position and top search queries for the last 28 days. We show these numbers in your dashboard.
• Google Analytics (read-only): the list of Analytics accounts and properties you can access, and report totals for the property you link: users, sessions, page views, top pages and traffic channels for the last 28 days. We show these numbers in your dashboard.
• Google Calendar: your free/busy times, so our booking scheduler does not offer times when you are already busy. We read only when you are busy, never the titles, attendees or details of your events. If you turn on calendar sync, we also create, update and delete calendar events for appointments booked and tasks scheduled through the Service (with a Google Meet link if you ask for one). We change only events we created.

How we use it. We use Google user data only to provide and improve the features described above that you can see and use. We show it only to you and to the members of your Growth Automations account you choose to give access to.

How we store it. Google access and refresh tokens are encrypted at rest. Search Console, Analytics and Business Profile data is fetched from Google when you view it and is not kept in our database. The only exceptions are the location, site or property you choose to link, by its ID and name. For Calendar, we store your busy periods as start and end times only, replaced on every sync, plus the IDs of events we created so we can update or remove them.

Google user data and AI. The Service has AI features (for example, drafting website content and CRM messages). Those features never receive Google user data: no raw, aggregated, anonymized or derived data from any Google API is sent to an AI model, and none is used to create, train or improve any AI or machine learning model, including foundational or generalized models. We use our AI providers, Anthropic and OpenAI, only through their commercial APIs, which by default do not train their models on data sent to them. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

How we share it. We do not sell Google user data. We do not use it for advertising, and we do not give it to data brokers or information resellers. We do not use it to train or improve artificial intelligence or machine learning models. We do not transfer it to anyone else except: the service providers that host and run the Service on our behalf (listed in Section 3), only as needed to provide your features; when you tell us to; when the law requires it; or as part of a merger or acquisition, with notice to you. Our staff do not read your Google user data unless you ask us to for support, it is needed for security or abuse investigations, or the law requires it.

How to remove it. When you disconnect a Google service in the Service, we delete its stored tokens. You can also remove our access at any time from your Google Account at myaccount.google.com/permissions. To delete everything else we hold about you, see Section 5 and our Data Deletion page.

Google API Services User Data Policy. Growth Automations' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

1.6 Usage Data & Analytics

We use PostHog for product analytics. We collect information about how you interact with the Service, including pages visited, features used, and actions taken. This data helps us improve the product. You can opt out of analytics tracking via the cookie consent banner.

1.7 Cookies

We use cookies and similar technologies for authentication, preferences, and analytics. See our Cookie Policy for details.

1.8 Business Email

If you use our hosted Business Email service, the mail in your mailboxes (messages, attachments, and anything else stored there) and related metadata (addresses, sender and recipient details, message dates and sizes, sign-in and delivery logs) are stored and processed by our email provider, Tucows Inc. and its OpenSRS service, in the provider's data centers, which the provider states are located in Canada. We store the mailbox settings you choose (addresses, display names, aliases, forwarding, and who each mailbox is assigned to), but not the contents of your mail. For mail in your mailboxes, your business decides what is collected and why; we and Tucows process it only to provide the service. See our Business Email Terms.

We do not read your mail. Our support team looks inside a mailbox only when the account owner or an account admin asks us to, and we log that access. We disclose mail contents only with the account owner's consent, when valid legal process such as a search warrant requires it, or where the law allows it to protect people from serious harm, and we notify the account owner of legal requests unless the law forbids it. Tucows may access mail on its systems when needed to maintain the service or to investigate abuse.

1.9 Your Own AI Key

If you add your own OpenAI or Anthropic key, your account's CRM and content AI requests (for example chatbot replies and AI skills) go directly to that provider under your account and the provider's terms. We store the key encrypted and never log it. Platform AI features, such as site generation and the editor's coding assistant, use our own provider keys and are not routed through your key.

2. How We Use Your Information

• Provide, maintain, and improve the Service
• Process transactions and send billing-related communications
• Authenticate your identity and maintain session security
• Facilitate third-party integrations you authorize
• Send important notices about your account or the Service
• Analyze usage patterns to improve functionality and performance
• Detect, prevent, and address technical issues or abuse

3. How We Share Your Information

We do not sell your personal information. We share data only in these circumstances:

• Service providers: Supabase (database and authentication), Stripe (payments), PostHog (analytics), Netlify (hosting), GitHub (code deployment), and Tucows Inc. / OpenSRS (hosted Business Email mailboxes, if you use them) — each processes data in accordance with their own privacy policies and, where applicable, our data processing terms with them.
• Third-party integrations: When you connect external services (Google, Microsoft, Meta, Notion), data flows to those providers as authorized by you. Google user data is never transferred except as described in Section 1.5.
• Legal requirements: We may disclose information if required by law, subpoena, or legal process.

4. Data Security

We implement industry-standard security measures including encrypted connections (TLS), encrypted credential storage (pgcrypto), role-based access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure.

5. Data Retention

We retain your account data for as long as your account is active. When you close your account, removal happens in stages rather than all at once, as described in our Terms of Service (Account Closure and Termination):

• Grace period (30 days) — read-only access; you can export your data and reactivate, and your sites stay live.
• Cold-storage period (60 days) — sites are taken offline, active subscriptions are canceled, and connected repositories are archived. An administrator can still restore your account on request during this window.
• Archival — your account and content are archived, and personal data is anonymized two years after archival pursuant to GDPR Article 17 (right to erasure), except where retention is legally required.

Billing and tax records (invoices, payment history) are retained for up to 10 years where required by applicable tax law, with personal identifiers hashed once the retention period expires. You may request erasure of eligible personal data at any time; we honor verified requests within 30 days, extendable where the law permits.

Business Email mailboxes are kept while they are active. When a mailbox is deleted — by you, when your account is closed, or at the end of the non-payment timeline in our Business Email Terms — our email provider keeps a recoverable copy for about 30 days and then permanently deletes it.

Deleted data is also purged from our encrypted backups as they age out of the normal backup-rotation cycle (within 90 days). When you disconnect a third-party integration (such as Facebook/Meta) or close your account, we delete the stored OAuth access and refresh tokens and any provider-derived data we cached for that connection. For step-by-step instructions on requesting deletion or removing a connected account, see our Data Deletion page.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data.
• Portability: Request a machine-readable export of your data.
• Opt-out: Opt out of analytics tracking via the cookie consent banner.
• Withdraw consent: Revoke any consent you have provided at any time.

6.1 For California Residents (CCPA)

California residents have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information.

6.2 For EU/EEA Residents (GDPR)

If you are located in the EU/EEA, our legal bases for processing are: performance of a contract (providing the Service), legitimate interests (improving the Service and preventing abuse), and consent (analytics and marketing cookies). You may lodge a complaint with your local data protection authority.

7. Children's Privacy

The Service is not directed to individuals under 16. We do not knowingly collect personal information from children. If we learn we have collected data from a child, we will delete it promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or a notice on the Service. Your continued use after changes constitutes acceptance of the updated policy.

9. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: support@growthautomations.com