Privacy Policy

1. Who we are

Growty (growty.ai) is a business software service operated by Diojen Tech FZ-LLC (“Growty”, “we”, “us” or “our”):

For anything in this policy—questions, requests to exercise your rights or requests to delete data—email [email protected].

In this policy:

• “Customer” means a business that uses Growty;
• “User” means a person who uses Growty for a Customer, such as an employee who signs in to the Growty dashboard; and
• “end customer” means a person a Customer deals with through Growty, such as someone who fills in a form on the Customer’s website or messages the Customer on WhatsApp.

2. Our role

Growty has two roles, depending on whose data it is.

• Controller. We decide how and why we process account data—the personal data of Users—and the usage and security logs we keep to run and protect Growty. We are also the controller when you visit growty.ai or email us.
• Processor. When a Customer uses Growty to capture leads and talk to them, the Customer is the controller of its end customers’ data—leads, contacts and messages—and Growty processes that data on the Customer’s behalf and on its instructions.

If you are an end customer, the business you dealt with is responsible for telling you how it uses your data. Please read its privacy notice and contact it first with any request. We help that business respond (see Section 15).

3. Data we collect

The personal data we handle falls into five groups.

3.1 Account data

Name, email address, phone number, company and role, and the login and security data we need to sign Users in and protect their accounts—for example, when a User signs in and from which IP address and device.

3.2 Customer configuration

The information a Customer gives us, or authorises Meta or Google to give us, to set Growty up:

• the Customer’s WhatsApp Business Account, phone number and business identifiers;
• the access tokens Meta issues to Growty when the Customer connects WhatsApp through Meta Embedded Signup;
• the Customer’s WhatsApp message templates;
• the identifiers of the ad accounts, datasets and conversion actions the Customer connects for conversion reporting, and the credentials needed to report to them; and
• the Customer’s settings, including its AI assistant settings.

3.3 End-customer data

Data about a Customer’s end customers, which Growty processes for the Customer:

• name, phone number and email address;
• WhatsApp messages and media exchanged with the Customer, and message details such as timestamps and delivery status;
• form submissions from the Customer’s website, sent through the Growty API or the Growty form;
• information that the Customer’s team or the AI assistant records about a lead, such as lead details and pipeline stage; and
• attribution data: UTM parameters; click identifiers (gclid, gbraid, wbraid, fbclid and ctwa_clid); the values of the _fbp, _fbc and _ga cookies; page URL; referrer; IP address; user agent; and consent state.

3.4 Usage and device logs

Records of how Growty and growty.ai are used: IP address, browser and device type, pages and features used, timestamps, errors, and security and audit events—for example, which User changed a setting and when.

3.5 Messages you send us

If you email us—for example, to request access or ask for support—we receive your email address, your name and whatever you write.

4. Where data comes from

• From you, when you or your organisation set up an account, use the dashboard or contact us.
• From a Customer’s website, when a visitor submits a form through the Growty API or the Growty form script.
• From Meta, through the WhatsApp Business Platform, when a Customer connects WhatsApp and when people message the Customer (see Section 8).
• From Google, when a Customer connects a Google Ads account or a Google Analytics 4 property (see Section 9).
• Automatically, from the browsers and devices that use Growty or visit growty.ai.

5. How we use data and why

As controller, we use account data, usage and device logs and the messages you send us for the purposes below. Where the law requires a legal basis, we rely on the one shown, or on another basis that the applicable law provides.

As processor, we use end-customer data only to provide Growty to the Customer, on the Customer’s documented instructions: to receive leads from the Customer’s website, send and receive the Customer’s WhatsApp messages, show conversations in the team inbox and pipeline, and run the AI assistant and conversion reporting as the Customer configures them. The Customer decides the legal basis for this processing.

6. The AI assistant

Growty’s AI assistant works for the Customer’s own business. It is a business-specific assistant, never a general-purpose AI chatbot.

When a Customer uses the assistant, Growty processes the content of conversations between the Customer and its end customers to draft or send replies and to extract lead details for the Customer—for example, the lead’s name or what they are asking about. The assistant works within the Customer’s settings, such as whether replies are drafted for staff to review or sent automatically, and hands conversations off to the Customer’s staff.

The AI providers we use (see Section 10) are contractually bound not to train their models on this data. Customers control the assistant’s settings and can turn AI off.

7. Conversion reporting

A Customer can connect its own advertising and analytics accounts so that Growty reports a conversion when a lead event happens—for example, when a lead sends a first WhatsApp message or when a deal is marked as won. Growty reports conversions only to the accounts the Customer connects, and only as the Customer configures:

• Google Ads, through the Google Data Manager API;
• Google Analytics 4, through the Measurement Protocol; and
• Meta, through the Conversions API, including the Conversions API for Business Messaging for Click-to-WhatsApp ads.

Depending on the platform and the Customer’s settings, a conversion report can include details of the event, such as its type and time; the click identifiers and cookie values captured with the lead; the IP address and user agent captured with a form submission; the lead’s consent state; and the lead’s email address or phone number, hashed where the platform requires it. Google and Meta process this data under their own terms with the Customer.

The Customer is responsible for obtaining any consent its website visitors and leads must give for this reporting. Growty honours the consent signals the Customer passes to it.

8. Data from Meta Platforms (WhatsApp)

This section explains how Growty handles the data it receives from Meta through the WhatsApp Business Platform and Meta’s APIs (“Meta Platform Data”). Growty is a Meta Tech Provider: each Customer connects its own WhatsApp Business Account to Growty through Meta Embedded Signup, and Meta bills the Customer directly for WhatsApp usage.

8.1 What we receive

• When a Customer connects WhatsApp: the Customer’s WhatsApp Business Account, phone number and business identifiers, and an access token that lets Growty act for that Customer.
• While WhatsApp is connected: the messages and media that end customers send to the Customer’s WhatsApp number, with the sender’s phone number and WhatsApp profile name; the delivery status of messages; the review status of the Customer’s message templates; and, for conversations that start from a Click-to-WhatsApp ad, the click identifier (ctwa_clid).

8.2 How we use it

Growty uses Meta Platform Data only to provide its services to the Customer that authorised it: to send and receive the Customer’s WhatsApp messages and show them in the Customer’s team inbox and pipeline, to run the AI assistant as the Customer configures it, to manage the Customer’s message templates and to report the conversions the Customer configures.

8.3 What we never do

• We never sell, license or purchase Meta Platform Data.
• We do not use Meta Platform Data for profiling or advertising, except to report the conversions the Customer configures.
• We share Meta Platform Data only with the sub-processors listed in Section 10, or when the law requires it.

8.4 How long we keep it

We delete Meta Platform Data when it is no longer needed to provide the service, and in any case within 30 days after the Customer disconnects WhatsApp or closes its account, unless the law requires us to keep it longer. Meta access tokens are deleted when the Customer disconnects WhatsApp. Copies in backups rotate out within a further 35 days.

8.5 How to request deletion

Follow our data deletion instructions, or email [email protected].

8.6 Compliance with Meta’s terms

Growty complies with the Meta Platform Terms, the Meta Developer Policies and the WhatsApp Business terms.

9. Google API data

When a Customer connects a Google Ads account or a Google Analytics 4 property for conversion reporting, the information Growty receives from Google APIs is what it needs to connect the accounts the Customer chooses and to report conversions to them, such as the authorisation Google issues for the connection and the identifiers of the Customer’s accounts, properties and conversion actions. We use it to report the conversions the Customer configures, store it as part of the Customer’s configuration (see Section 12), protect it as described in Section 13 and process it with the sub-processors listed in Section 10.

Growty’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A Customer can stop conversion reporting to Google by disconnecting the account in Growty or by removing Growty’s access in its Google account.

10. Sub-processors and sharing

We use these sub-processors to provide Growty:

Data goes to Meta’s messaging and advertising services and to Google Ads and Google Analytics only at the Customer’s direction, for the features the Customer uses. When it does, those companies also handle it under their own terms and privacy policies.

We also disclose personal data when the law requires it, for example in response to a valid court order.

11. International transfers

Diojen Tech FZ-LLC is based in the United Arab Emirates, and we and our sub-processors may process personal data in other countries, including countries whose data protection laws differ from those where you live. When we transfer personal data internationally, we use appropriate safeguards, such as Standard Contractual Clauses. To ask about these safeguards, email [email protected].

12. Retention

If the law requires us to keep data for longer, we keep it for as long as the law requires.

13. Security

We protect personal data with:

• TLS encryption for data in transit;
• encryption at rest;
• envelope encryption for access tokens issued by third parties, such as Meta;
• least-privilege access; and
• audit logging.

If we become aware of a personal data breach affecting end-customer data, we notify the affected Customer without undue delay.

14. Cookies and similar technologies

Growty sets no advertising or analytics cookies on growty.ai. Cloudflare, which hosts and protects the website, may set strictly necessary security cookies. The Growty dashboard uses strictly necessary cookies or similar browser storage to keep Users signed in.

When a Customer adds the Growty form script to its website, the script may keep click identifiers and UTM values in first-party storage on the Customer’s domain, so that a later form submission can be attributed to the ad or campaign that brought the visitor. Form submissions can also include the _fbp, _fbc and _ga cookie values set by the Customer’s own Meta and Google tags. The Customer is responsible for the consent and notices its visitors need, and Growty honours the consent signals the Customer passes to it.

15. Your rights

Depending on where you live and which law applies—including the EU General Data Protection Regulation (GDPR), the UK GDPR, Turkey’s Law No. 6698 on the Protection of Personal Data (KVKK) and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, PDPL)—you may have the right to:

• find out whether we process your personal data, get a copy of it and learn how we use it and who receives it;
• have inaccurate or incomplete data corrected;
• have your data deleted;
• restrict or object to our processing, including processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw consent, where we rely on consent;
• object to decisions based solely on automated processing that significantly affect you; and
• complain to a data protection authority—for example, the authority in the EU country where you live or work, the UK Information Commissioner’s Office, Turkey’s Personal Data Protection Authority or the UAE Data Office.

How to make a request. Email [email protected]. We answer within 30 days. We may ask for information to confirm your identity before we act on a request.

If you are an end customer. The business you dealt with controls your data in Growty, so please contact that business first. If you contact us instead, we pass your request on to the business and help it respond.

16. Children

Growty is not intended for anyone under 18.

17. Changes to this policy

We may update this policy. We announce material changes by email or in the Growty dashboard. The effective date at the top of this page shows when the current version took effect.

18. Contact us

For support, privacy questions and deletion requests, email [email protected], or write to: