Privacy Policy

1. Who We Are

Data Controller: GrowOut Co. LLC, 1209 Mountain Road PL NE, STE R, Albuquerque, NM 87110, USA — hello@growoutco.com.

2. Data We Collect

Directly from you: name and contact details; email and phone; business name and website; product information and brand assets you upload in your brief; communications. Payment data is processed by Stripe; we do not store card numbers. Automatically: IP address, browser/device, pages visited, time on site, referring site, and analytics/session data via the tools in §4. We do not request or process special-category/biometric data; do not upload it to us.

3. How We Use Your Data

To perform our contract (process your order, produce and deliver creatives, communicate, provide the client portal and support); for legitimate interests (improve our services and production systems, secure the site, prevent fraud); and to meet legal/tax obligations. We do not sell or rent personal data. We use AI tools as processors to produce your deliverables (see §4); your brief content may be processed by those tools solely to fulfil your order and is not used by us to train our own models without your separate consent.

4. Data Sharing — Sub-processors

We share data only with processors necessary to deliver the service:

• Stripe, Inc. — payment processing
• MongoDB, Inc. — database hosting
• Cloudinary — storage of uploaded brief assets and delivered files
• Railway — application hosting
• Zapier — internal workflow automation
• Kitchen.co — client delivery portal (your contact details, brief, and deliverables are processed here)
• Google Analytics (Google LLC) — site analytics
• PostHog — product analytics and session analytics
• Crisp — live chat (messages you send via chat are processed here)
• AI production tools — third-party AI image/video generation providers used to produce your deliverables; brief inputs may be processed by these providers solely to fulfil your order

We do not sell, rent, or trade personal data. Processors are bound to use data only to provide their service to us.

5. Data Retention

Active session data: retained for the active order lifecycle and a short period after (target 7 days from session creation). Order/transaction records: 7 years (tax/legal). Brief and creative files: up to 90 days after project completion, then deleted from active storage. Chat/support communications: up to 24 months. Marketing communications: until you unsubscribe. Deletion requests honoured subject to legal retention.

6. Your Rights

Access, correction, deletion, restriction, portability, objection. California (CCPA): know, delete, correct, opt out of "sale"/"sharing" (we do neither), non-discrimination. EU/UK (GDPR): the above plus the right to complain to a supervisory authority (UK: ICO). Email hello@growoutco.com with subject "Data Rights Request"; we respond within 30 days (or as law requires). Include your country of residence for EU/UK requests.

7. International Transfers

We are US-based; EU/UK data is transferred to the USA under Standard Contractual Clauses and data minimisation. By using the service you acknowledge this transfer; this acknowledgement does not waive your statutory rights.

8. Cookies & Tracking

Essential cookies are required for the site and cannot be disabled. Analytics/session tools (Google Analytics, PostHog) and the Crisp chat widget set cookies or similar identifiers and may record usage and session activity. Where required by law we will obtain consent for non-essential tracking.

9. Children's Privacy

Not directed to under-18s; we do not knowingly collect their data.

10. Changes

Posted here with a new effective date.