Privacy Policy

1. Who decides about each piece of data

Platform users (each Company's administrators and agents): Growther Up is responsible for their account data.

Prospects and buyers who talk to a Company: each Company decides what data it keeps and why; Growther Up processes it on the Company's behalf, as a service provider. If you are a Company's prospect, your main contact is that Company, although you can also write to us.

2. What data we process

• Users: name, email, password (stored hashed by the sign-in provider; we never see it in plain text), company and role, last sign-in date and a log of relevant actions.
• Prospects: name, phone number, email if the Company adds it, WhatsApp messages and the files exchanged (photos, videos, audio, documents), search preferences, sales stage, notes, appointments and the consent record: when and how they agreed to receive messages, and whether they asked to stop.
• From Instagram, when a Company connects its professional account: that account's ID, username and name, its posts (caption, thumbnail, link and date), an encrypted access token, and, for people who comment on or message that account: their Instagram ID and username, the text of their comments on the Company's posts and the private messages they exchange with it. We do not access followers, insights or accounts that have not interacted with the Company.
• Technical data: strictly necessary cookies to keep the session and remember the active company, and error logs from which phone numbers, emails and keys are removed before storage. We do not use advertising or analytics cookies.

3. What we use it for

• Providing the service: receiving and sending WhatsApp messages, generating automatic replies when the Company turns them on, scheduling follow-ups and appointments, and showing reports.
• On Instagram: detecting the keywords the Company set up in comments on its posts, posting a reply and sending the single private message Meta allows per comment, and showing private conversations in the inbox so the Company (or its AI assistant, if turned on) can answer.
• Honoring consent and opt-outs: the platform blocks Company-initiated messages to anyone who has not consented or asked to stop.
• Security, abuse prevention, cost control and support.

We do not sell personal data, we do not use prospects' data for our own marketing, and we do not use it to train artificial intelligence models.

4. Artificial intelligence

When a Company turns on automatic replies, the necessary part of the conversation and the information the Company added (for example, listings and FAQs) is sent to OpenAI to draft the reply. Requests are made with the option not to store responses at OpenAI and, under OpenAI's API policies, that data is not used to train its models. Automatic replies may contain mistakes; the Company can review them and take over the conversation at any time.

5. Who we share it with

Only with the providers we need to run the service, who process it on our instructions:

• Supabase: database, sign-in and file storage (servers in the United States).
• Vercel: application hosting.
• Meta Platforms (WhatsApp Business Cloud API): sending and receiving WhatsApp messages.
• Meta Platforms (Instagram API with Instagram Login): connecting the Company's professional account, reading its posts and the comments it receives, and sending replies and private messages.
• OpenAI: generating automatic replies, only if the Company turns them on.
• Resend: internal system alerts addressed to Growther Up, without prospects' contact details.

We may also disclose it when required by law or by a competent authority.

6. WhatsApp and Instagram messages, and opt-outs

Companies must have each person's prior consent before sending them messages the Company initiates. Anyone can stop receiving messages by replying "STOP" or "BAJA": the platform records the opt-out and stops sending messages to that number.

On Instagram the platform never starts conversations: it only answers a comment on one of the Company's posts (at most one public reply and one private message) or someone who wrote privately, within the time limits set by Meta. Replying "STOP" or "BAJA" also stops messages on Instagram.

7. How long we keep it

• While the Company's account is active or suspended.
• If the Company closes its account, its contacts, conversations, files and settings are permanently deleted. Only an internal record that the Company existed remains, without prospects' data.
• Error logs are deleted after 30 days.

8. Security

We use encrypted connections (HTTPS), store WhatsApp and Instagram access tokens encrypted, isolate each Company's data in the database, limit what each user sees by role and log relevant actions. No system is infallible: if we detect an incident affecting personal data, we will notify the affected Companies.

9. Your rights

You can request access to, correction or deletion of your data, and stop receiving messages. If you are a prospect, write to the Company you talked to or to [COMPLETAR: email de contacto] with your phone number. If you are a user, write to [COMPLETAR: email de contacto]. We reply within 30 days. The steps to request deletion are on the "Data deletion" page.

10. International transfers

Data is hosted in the United States. Growther Up's team may access it from other countries to provide support, with the same security measures.

11. Minors

The platform is intended for businesses and people over 18. We do not seek to process minors' data.

12. Changes and contact

If we change this policy, we will publish the new version on this page with its date. For any question: [COMPLETAR: email de contacto] · Growther Up, [COMPLETAR: dirección].