Privacy policy

1. Controller

The controller responsible for processing your personal data is Henrique Medeiros, Growbot, c/o Ricardo Moura, Täfernstrasse 26, 5405 Baden-Dättwil, Switzerland, email: info@growbot.ch.

Representative in the EU under Art. 27 GDPR: [EU representative (if required)].

For privacy questions, contact us at the email address above.

2. What data we process

We only process data that we need for Growbot:

• Account: name, email address and profile picture from your Google account, and your language setting. For sign-in we store the IP address and browser identifier of each session.
• Subscription and payment: plan, status, term, billing address, company name and UID/VAT number if provided. You enter card and TWINT details directly with Stripe; we never see them.
• Projects: links to your product, publicly available content of your website, research, brand kit, uploaded images, videos and voices, generated content and schedules.
• Connected accounts: access tokens for accounts you connect yourself (e.g. Instagram, Facebook, Threads, LinkedIn, TikTok, YouTube, Google Search Console, Telegram). We only use them for what you trigger or schedule in Growbot and for statistics on your posts.
• Public posts by third parties: for “Find conversations” we read publicly available posts (e.g. on Reddit or Hacker News), including user names, to show you relevant conversations. We never post there automatically.
• Website usage: page views, clicks and reading time without cookies and without storing IP addresses (see section 7), plus technical server logs (IP address, time, page requested) for security.
• Communication: content of emails and messages you send us, and notifications you switch on (email, Telegram).

3. Purposes and legal bases

• Running Growbot (account, projects, content, publishing): contract with you (Art. 6(1)(b) GDPR).
• Billing, accounting and statutory retention: legal obligation (Art. 6(1)(c) GDPR).
• Security, abuse prevention, debugging and improving the service, pseudonymous usage statistics, reading public posts: legitimate interest (Art. 6(1)(f) GDPR).
• Connected accounts, notifications and newsletters: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by disconnecting the account or switching the notification off.
• In Switzerland we process personal data according to the principles of the revFADP (lawfulness, good faith, proportionality, purpose limitation, transparency).

4. Artificial intelligence

Growbot creates research, texts, images and videos with AI. To do so we send the necessary project data to an AI provider (currently Anthropic PBC, USA, model Claude) or process it with models on our own servers. According to its terms, Anthropic does not use API data to train its models.

Do not enter sensitive personal data (e.g. health data) into projects. AI results may contain errors; check them before publishing.

We do not make automated individual decisions that legally affect you.

5. Who receives your data

We do not sell data and show no ads. We only share data with service providers we need for Growbot, and only as far as necessary:

• Hosting and database: Infomaniak Network SA, Geneva (Public Cloud, data centres in Switzerland).
• Sign-in: Google Ireland Limited / Google LLC (Sign in with Google).
• Payment: Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (USA). For TWINT payments also TWINT AG (Switzerland).
• AI: Anthropic PBC (USA).
• Email delivery: [Email delivery service].
• Platforms you connect yourself (e.g. Meta, LinkedIn, TikTok, Google/YouTube, Telegram): their own privacy policies apply as well.
• Authorities, where we are legally required to.

6. Transfers abroad

Some service providers are located outside Switzerland and the EU, mainly in the USA. We only transfer data there if adequate protection is in place: through the Swiss-U.S. or EU-U.S. Data Privacy Framework where the recipient is certified, otherwise through the European Commission's standard contractual clauses as recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC). You can request a copy.

7. Cookies and statistics

Growbot only sets cookies that are technically necessary: for sign-in (session), your language and your light/dark choice. There are no advertising or tracking cookies, so we do not ask for consent.

For website statistics we use Growbot's own tracking. It sets no cookies, stores nothing in your browser and stores no IP addresses. Visitors are only recognised within one day, by a pseudonym (a checksum of IP address, browser and date that changes daily). After 2 days at the latest we replace this pseudonym with a value that can no longer be linked to anyone. We store the page, referrer, country, device type, browser and operating system, clicked links and buttons (only their visible text and target, never form input), reading time and scroll depth, and events such as sign-ups. We determine the country from the IP address with a country database on our own server (IP geolocation by DB-IP, db-ip.com); the IP address is not stored. Once a day an AI (Anthropic) briefly summarises the visits; it only receives pages, clicks, times, device and country, no pseudonym and no IP address.

8. Data on our customers' websites

If you add the Growbot tracking to your own website, use short links or connect accounts, we process data about your visitors and followers on your behalf. You are then the controller and we are the processor under Art. 9 revFADP and Art. 28 GDPR. Mention the tracking in your own privacy policy.

Data processing agreement (DPA): it is part of the terms (section 12) and applies with your account. In short:

• Data: page viewed, referrer, UTM parameters, country, device type, browser and operating system, clicked links and buttons (visible text and target, never form input), reading time and scroll depth, events such as sign-ups and a daily pseudonym. No cookies, nothing stored in the browser, no stored IP addresses.
• Purpose: only the statistics and features you use in Growbot; no purposes of our own, no disclosure to third parties.
• Sub-processors: Infomaniak Network SA (hosting, Switzerland); Anthropic PBC (USA) for the daily AI summary of visits, without pseudonym or IP address. We announce changes; you can object.
• Retention: the pseudonym at most 2 days, individual events and clicks 25 months, then totals only. If you delete the project, we delete the data immediately.
• We send you a signed copy of the DPA on request to info@growbot.ch.

9. How long we keep data

• Account and projects: until you delete them. You can delete a project yourself at any time in its settings, your whole account under “Account”. We then delete the data immediately, withdraw our access to connected accounts at the platforms where they offer this, and cancel a running subscription. If you only cancel your subscription, we do not delete anything on our own: your account and data stay stored until you delete them or ask us to delete them. We then delete them within 30 days. Backups are encrypted and overwritten after 30 days at the latest.
• Connected accounts: until you disconnect them. We then delete the access token and withdraw our access at the platform where it offers this.
• Invoices and accounting records: 10 years, as required by law (Art. 958f Swiss Code of Obligations).
• Server logs (IP address, time, page requested): 30 days, then they are deleted.
• Website statistics: the daily pseudonym at most 2 days, individual events 25 months, then aggregated only, without reference to individuals.

10. Security

We protect your data with appropriate technical and organisational measures: encrypted transfer (HTTPS), access only for authorised people, regular updates and backups.

11. Your rights

You have the right at any time to:

• find out which data we process about you,
• have incorrect data corrected,
• have data deleted or its processing restricted,
• object to processing based on legitimate interest,
• receive your data in a common format or have it transferred,
• withdraw consent with effect for the future.

12. Deleting your data

How to delete your data at Growbot:

• Whole account: in Growbot under “Account” → “Delete account”. We immediately delete your account with all projects, content and connected accounts and revoke Growbot's access at the connected platforms.
• A single connected account (e.g. Facebook, Instagram, Threads, TikTok, YouTube): disconnect it in the project under “Connect accounts”. We then delete the stored access tokens of that account.
• You can also revoke access at the platform at any time; on Facebook and Instagram under “Settings” → “Apps and websites”.
• Or email us at info@growbot.ch. We delete your data within 30 days and confirm it to you. Backup copies expire after 30 days at the latest.

13. Changes

We update this policy when Growbot or the law changes. The version on this page applies. We inform signed-in users of material changes by email.