Privacy Policy

1. Controller

ForgeAI Studio Ltd (company no. 17175307), West Bromwich, United Kingdom, is the data controller for personal data processed through GrowthDept. Contact: support@growthdept.app.

2. What we collect

Account data (name, email, authentication identifiers). Business data you provide or we crawl from your public website (offers, audience, brand). Usage data (logs, device/ browser, actions in the app). Content you create in the Service. Data from integrations you connect, within the scopes you grant.

We do not sell your personal data and we do not use it to train third-party models for unrelated purposes.

3. Why we use it (lawful bases)

To provide and secure the Service (performance of contract). To improve and support the Service and prevent abuse (legitimate interests). To send service and, with consent where required, product communications. To comply with legal obligations.

4. AI processing

To generate strategy, content and analysis we send relevant business and content data to our AI model provider(s) acting as our processor under contract. We minimise what is sent and do not include payment card details. See our Responsible AI Policy.

5. Sharing & sub-processors

We share data with vetted sub-processors who help us run the Service (hosting & database, AI model provider, email delivery, and any integration you connect). All are bound by data-protection terms. We may disclose data where required by law.

6. International transfers

Where data is transferred outside the UK/EEA, we rely on appropriate safeguards such as the UK IDTA / EU Standard Contractual Clauses.

7. Retention

We keep personal data for as long as your account is active and as needed to provide the Service, then delete or anonymise it within a reasonable period unless a longer period is required by law.

8. Your rights

You have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to withdraw consent. To exercise these, email support@growthdept.app. You can also complain to the UK Information Commissioner's Office (ICO).

9. Data from Meta Platforms (Facebook & Instagram)

If you connect a Facebook Page or Instagram account, we access only the data covered by the permissions you approve in Meta's consent flow: your list of Pages, the ability to publish the posts you approve, engagement data on your own posts, and comments on your own posts so we can draft replies for your approval. We use this data solely to provide the Service to you — never for advertising to others, profiling unrelated to your business, or resale. Access tokens are encrypted at rest. Disconnecting the integration in Settings deletes our copies of the associated tokens and stops all access; you can also revoke GrowthDept's access at any time from your Facebook settings. See our Data Deletion page for full removal instructions.

10. Data from Google services

If you connect Google services (e.g. Search Console, Analytics, Calendar), our use of that data complies with the Google API Services User Data Policy, including the Limited Use requirements: we use Google user data only to provide and improve the features you asked for, we do not transfer it except as necessary to provide those features (or for security/legal compliance), we do not use it for advertising, and humans do not read it except with your explicit consent, for security, or to comply with law. Disconnecting a Google integration deletes our stored tokens and stops all access.

11. Security & changes

We protect data with the measures described in our Security Policy. We may update this policy; the effective date below reflects the latest version.