Effective 19 October 2026 · ForgeAI Studio Ltd (company no. 17175307), Oldbury, United Kingdom.
1. Controller
ForgeAI Studio Ltd (company no. 17175307), Oldbury, United Kingdom, is the data controller for personal data processed through GrowthDept. Contact: support@novastacks.co.uk.
2. What we collect
Account data (name, email, authentication identifiers). Business data you provide or we crawl from your public website (offers, audience, brand). Usage data (logs, device/ browser, actions in the app). Content you create in the Service. Data from integrations you connect, within the scopes you grant.
We do not sell your personal data and we do not use it to train third-party models for unrelated purposes.
3. Why we use it (lawful bases)
To provide and secure the Service (performance of contract). To improve and support the Service and prevent abuse (legitimate interests). To send service and, with consent where required, product communications. To comply with legal obligations.
With your consent, we use Google Analytics to measure use of GrowthDept, confirmed signups and verified purchases. We do not load Analytics until you accept it. You can withdraw using Cookie settings on any page. We send sanitised page paths and conversion details, not names, email addresses, card details or form contents. Google receives network and device information. User and event retention is 14 months, with user retention reset by new activity; aggregated reports may remain longer. See our Cookie Policy for storage durations and details. This optional measurement is separate from Analytics accounts you connect to run your own marketing.
When you create an account we record, with the account, the first page you landed on and when, and, where there is one, the campaign tag in the link that brought you or the website that sent you (for example linkedin.com), and your answer if you choose to tell us how you heard about GrowthDept. We use it only to see which of our own posts and pages bring people in, on the basis of our legitimate interests in understanding how we reach customers. It is not stored in cookies or browser storage, and it holds no names, email addresses or form contents.
4. AI processing
To generate strategy, content and analysis we send relevant business and content data to our AI model provider(s) acting as our processor under contract. We minimise what is sent and do not include payment card details. See our Responsible AI Policy.
5. Sharing & sub-processors
We share data with vetted sub-processors who help us run the Service (hosting & database, AI model provider, email delivery, and any integration you connect). All are bound by data-protection terms. We may disclose data where required by law.
6. International transfers
Where data is transferred outside the UK/EEA, we rely on appropriate safeguards such as the UK IDTA / EU Standard Contractual Clauses.
7. Retention
We keep personal data for as long as your account is active and as needed to provide the Service, then delete or anonymise it within a reasonable period unless a longer period is required by law.
8. Your rights
You have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to withdraw consent. To exercise these, email support@novastacks.co.uk. You can also complain to the UK Information Commissioner's Office (ICO).
9. Data from Meta Platforms (Facebook, Instagram and WhatsApp)
If you connect a Facebook Page or Instagram account, we access only the data covered by the permissions you approve in Meta's consent flow: your list of Pages, the ability to publish the posts you approve, engagement data on your own posts, and comments on your own posts so we can draft replies to them. We use this data solely to provide the Service to you, never for advertising to others, profiling unrelated to your business, or resale. Access tokens are encrypted at rest. Disconnecting the integration in Settings deletes our copies of the associated tokens and stops all access; you can also revoke GrowthDept's access at any time from your Facebook settings. See our Data Deletion page for full removal instructions.
If you connect Instagram on its own (Instagram Login), we access only your professional account's name and id, the ability to publish posts under the settings you choose in Controls, the like and comment counts on posts we published for you, and the comments on those posts so we can draft replies for you. We do not read or send Instagram direct messages.
If you connect WhatsApp, we first see the list of WhatsApp Business Accounts and phone numbers your sign in shares, so you can choose one. We then access that account and number, the messages your customers send to it, and the delivery and read receipts for messages we send for you. We send only the messages that go out under the settings you choose in Controls, only to people who have messaged your business, and only within WhatsApp's rules. If a customer replies STOP we stop messaging them. Disconnecting WhatsApp in Connections deletes our stored sign in; you can also remove GrowthDept in your Facebook Business settings. The messages stay in your workspace until you close your account, and are deleted then.
10. Data from Google services
If you connect a Google service, we access only the data covered by the OAuth scopes you approve on Google's consent screen, via Google's official APIs. Google Search Console (read-only): search-performance data for the site you select: queries, pages, clicks, impressions, click-through rate, position and sitemap status. It is used solely to show you your SEO performance and generate SEO recommendations. Google Analytics (read-only): traffic and conversion reports for the GA4 property you select: users, sessions, events and conversions. It is used solely to compute your growth metrics, reports and channel attribution. Google Calendar (read-only): we read events and free/busy availability on the calendar you select, to show you meeting metrics and to avoid proposing times when you are busy. We do not create, change or delete anything on your calendar, and we do not read calendar settings or manage your calendars. Gmail (send-only): where you choose Gmail as your sending account, we send from your own address, using Gmail's official API, only the messages GrowthDept prepares for your business under the settings you choose in Controls; the scope we request cannot read, search or delete your mail, and we never do so. We also see the email address of the Google account you connect, through Google's sign in email permission, only to show you which address is connected and to send you a test email when you ask for one. YouTube (read-only): if you connect YouTube, we read your own channel's video list and its analytics reports to show you how your videos perform; we do not read other people's data and we do not change your channel.
How we store and share it: OAuth tokens are encrypted at rest (AES-256-GCM) with a key held outside our database. Google user data is used only to provide the features above to you; it is never sold, never used for advertising, never used to train generalised AI models, and never transferred to third parties except the sub-processors that host the Service under contract for us. Humans at GrowthDept do not read this data except with your affirmative consent (e.g. a support request), for security purposes, or where required by law. Disconnecting an integration deletes our stored tokens immediately, and you can also revoke GrowthDept's access at any time at https://myaccount.google.com/permissions.
Limited Use disclosure: GrowthDept's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
11. Data from TikTok
If you connect a TikTok account, we access only the data covered by the permissions you approve on TikTok's own consent screen. That is your basic profile (your TikTok name and a stable account identifier), the ability to post the videos you approve to your account, and a read of your own recent videos with their captions, cover images, post dates and view, like, comment and share counts. When you approve a video we send it to TikTok with its caption and the settings you chose for that post, including who can view it. We do not post a video that has not been approved under your settings, and never without your choice of who can view it.
We use this data solely to post the videos you approve and to show you how your own videos did, so the next ones fit your account. These permissions do not let us read your private messages, and we do not read anyone else's account. We do not sell this data and never use it for advertising to others. Access tokens are encrypted at rest.
You can remove TikTok at any time in Settings, Connections, which deletes our stored sign-in for it. TikTok keeps its own record of the permission until you also remove GrowthDept from the apps connected to your TikTok account, which you can do at any time in your TikTok settings. See our Data Deletion page for full removal instructions.
12. AI assistants you connect
You can let an AI assistant such as Claude, ChatGPT or Gemini use GrowthDept for one of your businesses, by signing in through GrowthDept's consent page or with a key you create on the Connections page. Nothing is shared with an assistant until you do.
When the assistant asks, we send it the information for that one business that the request needs: what was published and when, drafts waiting for your decision, your website check, your search and store listing information, and the pages we host for you. The assistant's maker processes that information under its own terms and privacy policy. We do not send it your password, your connected accounts' access tokens or your payment details.
We keep a record of each request an assistant makes (which tool, when, and whether it worked) for security and support, for as long as your account is active. You can remove an assistant at any time under Connections, For developers, AI assistants; it is refused from its next request.
13. Security & changes
We protect data with the measures described in our Security Policy. We may update this policy; the effective date below reflects the latest version.