Privacy Policy

Last updated: 22 July 2026

GrowGMB ("we", "us", "our") operates the website growgmb.com (the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have. By using the Service, you agree to this Policy.

1. Information we collect

1.1 Account information

Name and email address provided at signup.
Password (stored only as a salted hash; we never see your plaintext password).
Profile photo (if you sign in with Google).

1.2 Google Business Profile data

When you connect a Google Business Profile, we receive an OAuth access token and refresh token, which we encrypt at rest using AES-256-GCM. We use these tokens only to:

List the GBP accounts and locations you can manage.
Read reviews, posts, insights, photos, and other public/owner data for your selected business.
Publish posts and review replies on your behalf when you trigger an action.

We never share your GBP data with third parties beyond the AI providers used to power specific features (described below).

1.3 Billing information

Payments are processed by Razorpay. We do not see or store your card details. We retain your Razorpay customer ID and subscription ID to manage your subscription, plus invoices and credit ledger entries.

1.4 Usage data

IP address, user agent, page paths, and event metadata necessary for security, rate limiting, and product improvement.

2. How we use the data

To provide the Service (analytics, posting, reporting).
To authenticate you and protect your account.
To process payments and prevent fraud.
To send transactional emails (reports, agency invites, billing notices).
To improve product quality and detect abuse.

3. AI providers and data processing

GrowGMB sends business and review content to AI providers strictly to power the features you trigger. We currently use:

Anthropic (Claude) — AI Insights, AI Review Insights, AI review reply suggestions, PostFlow Stages 1, 2, and orchestration.
OpenAI (GPT-4o) — PostFlow Stage 3 (content writing).
Google (Gemini Imagen) — PostFlow Stage 4 (image generation).

We do not use your data to train any third-party model. Each provider's own privacy terms govern their handling of inputs; we recommend reviewing them if you have specific compliance requirements.

4. Cookies

We use first-party cookies for session management (NextAuth) and CSRF protection. We do not use third-party advertising cookies.

5. Data sharing

We do not sell your data. We share data only with the service providers necessary to operate the platform:

Vercel (hosting), Neon (Postgres database).
Razorpay (payments).
Resend (transactional email).
Google, Anthropic, OpenAI (AI / GBP APIs as described above).
DataForSEO (only when you trigger citation scans).

We will disclose data when required by a valid legal request from competent Indian authorities.

6. Data retention

We retain account data while your account is active. On account deletion, we erase your personal data within 30 days, except where retention is required for legal or accounting compliance (typically up to 8 financial years for invoices).

7. Security

We use industry-standard practices including HTTPS-only traffic, AES-256-GCM token encryption, bcrypt password hashing, server-side OAuth secrets, scoped database permissions, and rate limiting on sensitive endpoints. No system is perfectly secure; if you suspect a breach, contact security@growgmb.com.

8. Your rights

Access — request a copy of the data we hold about you.
Correction — update inaccurate information.
Deletion — close your account and erase your data.
Portability — receive your data in a machine-readable format.
Withdraw consent — disconnect Google Business Profile at any time from the dashboard.

To exercise these rights, email privacy@growgmb.com.

9. Children

The Service is not directed to anyone under 18. We do not knowingly collect data from minors.

10. International transfers

Some of our processors operate outside India. Where we transfer data internationally, we rely on standard contractual safeguards offered by those providers.

11. Changes

We may update this Policy. Material changes will be highlighted on the dashboard or emailed to you. The "Last updated" date above always reflects the current version.

12. Contact

GrowGMB · privacy@growgmb.com · India