Last updated: August 26, 2026
This policy explains what personal data Growli collects, why we process it, who we share it with, and the rights you have over it. It is written to be read, not to be survived.
We do not use advertising cookies, and we do not track you across other websites. The only things we store in your browser are listed in full below.
Growli is the controller of the personal data described in this policy. For any data protection question — or to exercise any of the rights set out below — write to us at the contact address below.
Contact: support@growli.xyz
We collect three kinds of data, and no more than we need for each.
Each purpose below has its own legal basis under Article 6 GDPR and its own retention period.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Providing the platform, running analyses and generating reports | Account details, business information, uploaded content | Performance of a contract (Art. 6(1)(b)) | While your account is active, then deleted within 90 days of closure |
| Taking payment and meeting tax obligations | Billing details, transaction records | Contract, and legal obligation (Art. 6(1)(b), (c)) | 10 years, as required by accounting law |
| Securing accounts, preventing fraud and abuse | IP address, session identifiers, access logs | Legitimate interests (Art. 6(1)(f)) — keeping the service safe | 12 months |
| Showing the site in the language of your country | IP address, resolved to a country only | Legitimate interests (Art. 6(1)(f)) — a usable first visit | Not stored server-side; the result is kept in your browser only |
| Answering support requests | Your message and account context | Contract, and legitimate interests (Art. 6(1)(b), (f)) | 24 months after the request is closed |
| Sending product and marketing email | Email address, engagement with the message | Consent, which you can withdraw at any time (Art. 6(1)(a)) | Until you unsubscribe |
| Considering you for a job | Your CV and the message you send us | Steps taken at your request before entering a contract (Art. 6(1)(b)) | 6 months after the decision, unless you ask us to delete it sooner |
Growli sends the business information you provide to AI models to produce analyses, strategies and reports. This is the core of the product.
Model providers are engaged as processors and are not permitted to use your content to train their models. You keep ownership of everything you submit.
These are the only third parties that can receive personal data, and what each does for us.
| Recipient | Purpose | Region |
|---|---|---|
| OpenRouter | AI model routing for analyses and reports | United States |
| Paddle | Payments, invoicing and tax as merchant of record | United Kingdom / EU |
| Stripe | Payments, where Stripe is the configured provider | United States / EU |
| Resend | Transactional and notification email | United States |
| Sign-in with Google, and business listing data | United States / EU | |
| DataForSEO | Search result and keyword data | United States |
| SE Ranking | Search ranking metrics | EU |
Growli is operated from the European Union and your data is stored there. Some of the recipients above are outside the EEA, mainly in the United States.
Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses, or by an adequacy decision where one applies to that provider.
We use no advertising cookies, no cross-site tracking, and no third-party analytics. Everything below is set by Growli itself and is needed for the site to work or to remember a choice you made.
Because these are strictly necessary or functional, they do not require consent. If we ever add analytics or marketing tracking, we will ask you first and it will not run until you agree.
| Stored item | Purpose | Lifetime |
|---|---|---|
| growli_token | Keeps you signed in | Until you sign out |
| growli_geo | Remembers the language matched to your country | Until cleared |
| growli_locale_dirty | Records that you chose a language yourself | Until cleared |
| growli_brand_profile | Keeps your onboarding answers between steps | Until cleared |
| growli_workspace_type | Remembers which workspace you use | Until cleared |
| growli_active_project | Remembers the project you were viewing | Until cleared |
| growli_active_analysis | Restores an audit in progress | Until the audit finishes |
| growli_playbook_banner_dismissed | Stops re-showing a banner you closed | Until cleared |
| growli_playbook_popup_dismissed | Stops re-showing a popup you closed | Until cleared |
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your rights, we will notify the supervisory authority within 72 hours and tell you where the law requires it.
Under the GDPR you can exercise all of the following, free of charge. Write to us and we will respond within one month.
If you think we have handled your data badly, tell us first — we would rather fix it. You also have the right to complain directly to your data protection supervisory authority, and you can do so without contacting us.
Applications reach us by email. We use your CV and message only to assess you for the role you applied for.
We keep applications for 6 months after a decision so we can consider you for something else, then delete them. Ask us at any time and we will delete yours sooner.
Growli is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
When this policy changes materially we will update the date above and, for significant changes, tell account holders by email.