Legal
Privacy policy
The short version
GrowAgent records what your AI agents do and what results came back, so the next attempt is better informed. We do not train AI models on your data. We do not sell it. Your own provider keys do your own AI work. You can export everything or have it deleted.
1. Who this covers
This policy covers growagent.dev, the GrowAgent API, and the products built on it — including Maya, Scout, and the other agents. Where you use GrowAgent as a customer, you are the controller of the personal data you put into it and we are your processor. Where we handle your own account details, we are the controller.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Name, work email, organisation, role, authentication identifiers | To give you an account and keep it secure |
| Agent activity | What an agent was asked to do, what it produced, which guidance it followed | This is the product. Without it nothing can learn. |
| Outcomes | Replies, meetings booked, engagement, revenue you report back | To tell what worked from what merely happened |
| Artefacts | The message, post or draft an agent produced | To explain later why a recommendation was made |
| Contacts and companies | People and organisations your agents research or contact, and facts about them | So one agent does not repeat what another already learned |
| Connected accounts | Access tokens for services you connect, encrypted at rest | To act on your behalf where you have asked us to |
| Operational | Request logs, error traces, usage counts, IP address | Security, billing, and keeping the service up |
We do not ask for special category data, payment card numbers (our payment provider handles those directly), or government identifiers. Please do not put them into GrowAgent.
3. What we never do
- We do not train AI models on your data. GrowAgent learns by writing down what worked as text and reading it back — not by fine-tuning a model. This is a design choice, and it is why a lesson that turns out to be wrong can simply be removed.
- We do not sell your data or share it for advertising.
- We do not read your data to build our own product beyond operating and securing the service for you.
- We do not share one customer's data with another. Isolation is enforced by the database itself, not only by application code.
4. Google user data
If you sign in with Google or connect a Google account, we handle that data as follows.
What we request, and why
| Permission | What we do with it |
|---|---|
| Your name, email address and profile | To create and identify your account. Nothing else. |
Send email on your behalf (gmail.send) |
To send only the messages you or your team have set up and approved in GrowAgent. We do not read your mailbox — this permission does not allow it. |
Read your Google Analytics data (analytics.readonly) |
To report on how content and campaigns performed. Read-only; we never change your Analytics configuration. |
Limited use
GrowAgent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google APIs is:
- used only to provide and improve the features you have asked for;
- never transferred to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition;
- never used for advertising, and never sold;
- never read by a human, except with your explicit permission for support, where the law requires it, or for security purposes;
- never used to train generalised AI or machine learning models.
Disconnecting
You can disconnect a Google account inside GrowAgent at any time, which revokes our access at Google as well as deleting the stored token. You can also revoke it yourself at myaccount.google.com/permissions.
5. Email you send through GrowAgent
When your team sends email through GrowAgent — from a connected mailbox or a dedicated sending domain — you are the sender. You decide who is contacted and what is said, and you are responsible for complying with the marketing and privacy laws that apply to you, including CAN-SPAM, GDPR and PECR where relevant.
We help where we can: recipients who opt out are suppressed across every agent and every channel in your account, automatically and permanently, and we enforce sending limits designed to protect your domain's reputation.
6. Learning across customers
Collective learning is off unless you switch it on. If you do, what leaves your account is limited to generalised statements with numbers attached — for example, "messages that quote the recipient's own words are associated with higher reply rates."
What is never shared, even with collective learning enabled:
- Anything identifying a person or company your agents contacted
- The text of anything an agent produced
- Your brand, positioning or internal notes
- Your name, your customers' names, or any account identifier
A pattern is only ever shared once it holds across several independent accounts, so no single account's behaviour can be inferred from it.
7. How long we keep it
| Data | Retention |
|---|---|
| Agent activity and outcomes | 24 months |
| Session records | 12 months |
| Operational event logs | 6 months |
| Usage records for billing | As long as tax law requires |
| What was learned (the lessons themselves) | Until invalidated, superseded, or you delete them — this is the asset you are paying us to keep |
| Connected account tokens | Until you disconnect |
When you close your account we delete your data within 30 days, except where we must keep records for legal or accounting reasons.
8. Where it lives
Your account is assigned to one region when it is created, and your data stays there. We currently operate in the United States. We do not move your data between regions.
9. Who else touches it
We use a small number of service providers to run GrowAgent. They act on our instructions, under contract, and only for the purposes below.
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and file storage |
| Vercel | Application hosting, and the request logs we use to diagnose faults |
| Sign-in, and sending mail from a Google account you connected | |
| Microsoft | Sending mail from a Microsoft account you connected |
| Unipile | Sending and receiving messages on channels that have no direct API, such as LinkedIn |
| Stripe | Subscriptions and invoices. Card details go to Stripe directly and never reach us. |
On AI providers. By default, the AI work GrowAgent performs for you runs on your provider account using your key. Your prompts and data go to the provider you chose, under your agreement with them, and never through an account of ours. If you ask us to manage keys on your behalf we will tell you which provider is used before we do.
10. Your rights
Depending on where you live you may have the right to access, correct, export, delete or restrict use of your personal data, to object to processing, and to complain to a regulator. Two of these are built into the product rather than being a request you have to make:
- Export. Everything in your account, in a machine-readable file.
- Deletion. Including a check on anything that was derived from the deleted data, so a lesson learned from a record you removed does not quietly outlive it.
Email ops@growagent.dev and we will respond within 30 days.
11. Security
- Encrypted in transit and at rest.
- Connected-account tokens encrypted with a separate key, and never returned by our API — not even to you.
- Customer isolation enforced in the database, so an application bug cannot leak across accounts.
- Access to production limited to staff who need it, and logged.
No system is perfect. If you find a vulnerability, please tell us at ops@growagent.dev — we will not pursue you for good-faith research.
12. Children
GrowAgent is a business tool and is not intended for anyone under 16.
13. Changes
If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always reflects the current version.
14. Contact
ops@growagent.dev
GrowAgent
Bengaluru, India