Privacy Policy

1. Who We Are

GOTOGROW INC
A Delaware C-Corporation, File No. 10677147
8 The Green, Suite A
Dover, DE 19901
United States
Email: hello@gotogrow.me

For the purposes of the EU General Data Protection Regulation (GDPR), our role depends on the data:

• Data Controller for account, billing and website data.
• Data Processor for prospect data that a customer uploads to the Platform. In that case the customer is the controller, we process on their documented instructions, and the customer is responsible for the lawfulness of how that data was collected.
• Data Controller for prospect data that we source ourselves. When a customer asks the Platform to find companies and people matching their go-to-market hypothesis, we obtain that data from our own licensed providers and we decide how it is collected and structured. For that sourcing we act as a controller and take the obligations that come with it, as described in Section 3.

2. Categories of Personal Data We Collect

A. Information You Provide Directly

When you:

• Create an account
• Subscribe to a plan
• Contact us
• Describe your product through a website, documents or a text description
• Connect your Gmail account or a professional networking account
• Request support

We may collect:

• Full name
• Company name
• Job title
• Email address
• Phone number
• Billing information
• Payment transaction metadata
• Account credentials
• Communication content
• Content you upload, such as product descriptions and documents

If required fields are not provided, we may not be able to provide the Services.

B. Prospect and Lead Data

Prospect data reaches the Platform in two ways.

• Uploaded by you. You may upload your own lists. We process that data on your instructions as a processor, and you are responsible for ensuring it was collected lawfully.
• Sourced by us. At your request we identify companies and people matching your go-to-market hypothesis, using licensed data providers. For that data we act as a controller.

In both cases the data is limited to business contact information: name, job title, employer, public professional profile, business email address, and company information. We do not process special categories of data.

When you run outreach, we also process prospects' responses, such as accepted connection requests and replies, to operate your campaigns and report their results.

C. Automatically Collected Information

We automatically collect:

• IP address
• Browser type
• Device information
• Session logs
• Usage data
• Platform interactions

This is collected via cookies and similar technologies.

D. Information From Third Parties

We may receive limited data from:

• Payment processors (e.g., transaction confirmation)
• Analytics providers
• CRM or marketing tools
• Licensed data providers
• Publicly available sources

We do not collect full credit card details. Payments are processed by third-party providers.

E. Sensitive Data

We do not intentionally collect:

• Health data
• Biometric data
• Political opinions
• Religious beliefs
• Sexual orientation
• Other special category data

Users must not upload sensitive personal data to the Platform.

F. AI Components

GoToGrow uses third-party AI technologies, including:

• Large language models (LLMs) for generating outreach drafts and analysis
• AI-assisted support tools

When you generate AI content:

• Inputs may be processed by AI providers
• Data is processed under enterprise-level privacy commitments
• We may use your content, such as product descriptions, hypotheses, messages and campaign results, to improve and train the models that power the Services, as set out in our Terms of Service
• We do not provide your content to third parties to train their public AI models
• Personal data of prospects is not used for model training, except in anonymized or aggregated form

You are responsible for not submitting sensitive data into AI tools.

Google user data is excluded from all AI processing. Data obtained through Google APIs is never sent to large language models or any third-party AI provider. The AI features described above operate only on data you enter or upload into GoToGrow, such as your product description, documents and campaign inputs, and on data received through connected accounts other than Google, such as replies received through a connected professional networking account.

G. Aggregated and Anonymized Data

We may create anonymized, aggregated data from use of the Services, such as response rates by industry, role or region. We use it to improve the Services and to provide benchmarks to customers. This data does not identify any customer or individual.

3. Legal Bases for Processing (GDPR)

We process personal data under the following legal bases:

Contractual Necessity

To provide the Services, manage accounts, process payments.

Legitimate Interest

To:

• Improve product performance
• Ensure platform security
• Prevent fraud
• Analyze usage

Legitimate Interest in Business-to-Business Communication

This is the basis on which we source and process prospect data as a controller. In that role:

• We process business contact data only, as described in Section 2B
• We do not use this data for profiling beyond matching a professional role to a business offering
• If a person asks where their data came from, we tell them and name the provider
• This notice is publicly available at https://gotogrow.me/privacy, including for people who have never used our Services
• If a person objects to being contacted, we stop immediately and add them to a suppression list that blocks every campaign in the relevant workspace, not only the campaign that contacted them
• Every outbound email carries an opt-out. In every channel, including messages sent through professional networking platforms, a request made by reply has the same effect

Consent

For:

• Marketing communications
• Non-essential cookies

You may withdraw consent at any time.

Legal Obligation

For:

• Tax compliance
• Accounting requirements
• Regulatory compliance

We do not sell personal data.

4. Data Sharing and Sub-Processors

We share data with service providers who act on our behalf:

• Hosting and database providers
• Payment processors
• Email infrastructure providers
• Data providers used to build target lists
• AI providers
• Analytics providers

All of them are bound by confidentiality and data protection obligations. A current list of named sub-processors is available to customers on request.

We may also disclose data to legal or regulatory authorities when required.

We do not sell, rent, or trade personal data.

4a. Google User Data & Gmail API

GoToGrow integrates with Gmail via Google OAuth 2.0 to enable email outreach functionality on behalf of our users. By connecting your Gmail account, you authorize GoToGrow to access your mailbox solely for the purposes described below.

What we access

GoToGrow requests only two Gmail permissions:

• Read access (gmail.readonly) — to detect replies to your outreach campaigns so that sequences stop automatically when a prospect responds, and to read thread information so follow-up messages stay in the correct conversation.
• Send access (gmail.send) — to send the outreach sequences you have configured, from your Gmail account, to your prospects.

We request no other Gmail permissions. We do not modify, label, archive, move, or delete anything in your mailbox, and we cannot do so with the permissions we request.

How we use Gmail data

Gmail data is used exclusively to operate your outreach campaigns within GoToGrow. We do not use Gmail data for advertising, user profiling, or any purpose unrelated to the outreach service you explicitly configured.

AI and automated processing

Google user data is never sent to large language models or to any third-party AI service. Reply detection is performed by our own deterministic processing logic. We do not use Google user data to develop, train, retrain, or fine-tune any generalized or personalized AI or machine learning model, and we do not transfer Google user data to any third party for those purposes.

Data storage & retention

We do not store the full content of emails on our servers beyond what is operationally necessary to execute and track your active campaigns. Campaign metadata such as send status and reply detection is retained for reporting purposes. Raw email content is not persisted after processing.

Data sharing

We do not sell, share, or transfer your Gmail data to any third parties. Access is strictly limited to GoToGrow's core outreach functionality.

Revoking access

You may disconnect your Gmail account at any time from your GoToGrow account settings, or directly via your Google Account permissions page. Revoking access will immediately stop GoToGrow from reading or sending emails on your behalf.

GoToGrow's use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4b. Connected Professional Networking Accounts

When you connect a professional networking account, GoToGrow uses it to operate the outreach campaigns you launch.

What we access

• Basic information about your connected account, such as name, headline and number of connections, to set safe sending limits
• Connection requests, messages and replies within the campaigns you launch

How we use this data

This data is used to send your campaign messages, stop sequences when a prospect replies, and report campaign results. We do not use it for advertising or for any purpose unrelated to the outreach you configured.

Data storage & retention

We do not store your account credentials or the contents of your connected account. We keep only the campaign data needed to run your outreach and show its results, such as whether a connection request was accepted and whether a prospect replied.

Revoking access

You may disconnect your account at any time from your GoToGrow account settings. Disconnecting stops GoToGrow from sending messages or retrieving replies on your behalf.

5. International Data Transfers

GoToGrow is established in the United States. If you are located in the EEA, the United Kingdom, or Switzerland, your personal data will be transferred to and processed in the United States.

Where required, we rely on:

• Standard Contractual Clauses approved by the European Commission
• The UK International Data Transfer Addendum, where applicable
• Other lawful safeguards

We take appropriate measures to ensure an adequate level of protection.

6. Data Security

We implement industry-standard technical and organizational measures including:

• Encrypted data transmission (SSL/TLS)
• Encrypted storage
• Access controls (least privilege principle)
• Secure hosting infrastructure
• Internal confidentiality agreements
• Regular security monitoring

No system is completely secure.

7. Data Retention

We retain personal data:

• As long as your account is active
• As necessary to provide Services
• As required by law (e.g., tax retention requirements)

Prospect data, including responses received through connected accounts, is retained while the workspace that requested it is active. When a workspace is closed, prospect data is deleted or anonymized within a reasonable period unless we are legally required to keep it. Suppression list entries are kept for as long as necessary to honor the objection, which means they outlive the workspace that generated them.

Upon account deletion, data is deleted or anonymized within a reasonable period unless legally required otherwise.

8. Your Rights (EEA & UK Users)

If you are located in the EEA or UK, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent
• Lodge a complaint with your local data protection authority

If you are a prospect who received outreach through the Platform, you have the same rights. Where we sourced your data as a controller, you may ask us where it came from, and we will tell you. An objection is actioned immediately and results in your details being added to a suppression list.

To exercise your rights, email: hello@gotogrow.me

We may request identity verification before fulfilling requests.

9. US Privacy Rights

If you are located in certain US states, you may have rights to:

• Access personal information
• Correct information
• Request deletion
• Opt-out of targeted advertising

We do not sell personal information.

Requests may be submitted to: hello@gotogrow.me

10. Cookies & Tracking Technologies

We use:

• Strictly necessary cookies (platform functionality)
• Analytics cookies
• Marketing cookies (with consent where required)

You may manage cookie preferences through:

• Browser settings
• Cookie banner on our Website

Disabling cookies may limit functionality.

11. Marketing Communications

We send marketing communications only if you:

• Opt in
• Create an account (service-related communications)

You may unsubscribe at any time via the unsubscribe link in emails.

Service-related messages (billing, system updates) cannot be opted out of while your account is active.

12. Third-Party Links

Our Website may contain links to third-party websites.

We are not responsible for their privacy practices.

13. Children

Our Services are intended for business users over the age of 18.

We do not knowingly collect data from minors.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will notify users via:

• Email
• Platform notice

The "Effective Date" at the top of this page will always reflect the latest version.