Privacy Policy

1. Who We Are

Data Controller:

GOTOGROW INC
A Delaware C-Corporation, File No. 10677147
8 The Green, Suite A
Dover, DE 19901
United States
Email: hello@gotogrow.me

For purposes of the EU General Data Protection Regulation (GDPR), we act as:

• Data Controller for account, billing, and website data
• Data Processor for prospect data uploaded or processed by our users

2. Categories of Personal Data We Collect

A. Information You Provide Directly

When you:

• Create an account
• Subscribe to a plan
• Contact us
• Connect your Gmail account
• Request support

We may collect:

• Full name
• Company name
• Job title
• Email address
• Phone number
• Billing information
• Payment transaction metadata
• Account credentials
• Communication content

If required fields are not provided, we may not be able to provide the Services.

B. Prospect / Lead Data (Processed on Your Behalf)

Our users may upload or generate:

• Names
• Business email addresses
• Company information
• Public professional data

We process this data solely on your instructions as a Data Processor.

You are responsible for ensuring lawful collection and use of prospect data.

C. Automatically Collected Information

We automatically collect:

• IP address
• Browser type
• Device information
• Session logs
• Usage data
• Platform interactions

This is collected via cookies and similar technologies.

D. Information From Third Parties

We may receive limited data from:

• Payment processors (e.g., transaction confirmation)
• Analytics providers
• CRM or marketing tools
• Publicly available sources

We do not collect full credit card details. Payments are processed by third-party providers.

E. Sensitive Data

We do not intentionally collect:

• Health data
• Biometric data
• Political opinions
• Religious beliefs
• Sexual orientation
• Other special category data

Users must not upload sensitive personal data to the Platform.

F. AI Components

GoToGrow uses third-party AI technologies, including:

• Large language models (LLMs) for generating outreach drafts and analysis
• AI-assisted support tools

When you generate AI content:

• Inputs may be processed by AI providers
• Data is processed under enterprise-level privacy commitments
• We do not use your content to train public AI models

You are responsible for not submitting sensitive data into AI tools.

Google user data is excluded from all AI processing. Data obtained through Google APIs is never sent to large language models or any third-party AI provider. The AI features described above operate only on data you enter directly into GoToGrow, such as your product description and campaign inputs.

3. Legal Bases for Processing (GDPR)

We process personal data under the following legal bases:

Contractual Necessity

To provide the Services, manage accounts, process payments.

Legitimate Interest

To:

• Improve product performance
• Ensure platform security
• Prevent fraud
• Analyze usage

Consent

For:

• Marketing communications
• Non-essential cookies

You may withdraw consent at any time.

Legal Obligation

For:

• Tax compliance
• Accounting requirements
• Regulatory compliance

We do not sell personal data.

4. Data Sharing

We may share data with:

• Hosting providers
• Payment processors
• Email infrastructure providers
• AI providers
• Analytics providers
• Legal or regulatory authorities when required

All service providers are bound by confidentiality and data protection obligations.

We do not sell, rent, or trade personal data.

4a. Google User Data & Gmail API

GoToGrow integrates with Gmail via Google OAuth 2.0 to enable email outreach functionality on behalf of our users. By connecting your Gmail account, you authorize GoToGrow to access your mailbox solely for the purposes described below.

What we access

GoToGrow requests only two Gmail permissions:

• Read access (gmail.readonly) — to detect replies to your outreach campaigns so that sequences stop automatically when a prospect responds, and to read thread information so follow-up messages stay in the correct conversation.
• Send access (gmail.send) — to send the outreach sequences you have configured, from your Gmail account, to your prospects.

We request no other Gmail permissions. We do not modify, label, archive, move, or delete anything in your mailbox, and we cannot do so with the permissions we request.

How we use Gmail data

Gmail data is used exclusively to operate your outreach campaigns within GoToGrow. We do not use Gmail data for advertising, user profiling, or any purpose unrelated to the outreach service you explicitly configured.

AI and automated processing

Google user data is never sent to large language models or to any third-party AI service. Reply detection is performed by our own deterministic processing logic. We do not use Google user data to develop, train, retrain, or fine-tune any generalized or personalized AI or machine learning model, and we do not transfer Google user data to any third party for those purposes.

Data storage & retention

We do not store the full content of emails on our servers beyond what is operationally necessary to execute and track your active campaigns. Campaign metadata (e.g., send status, reply detected) is retained for reporting purposes. Raw email content is not persisted after processing.

Data sharing

We do not sell, share, or transfer your Gmail data to any third parties. Access is strictly limited to GoToGrow's core outreach functionality.

Revoking access

You may disconnect your Gmail account at any time from your GoToGrow account settings, or directly via your Google Account permissions page. Revoking access will immediately stop GoToGrow from reading or sending emails on your behalf.

GoToGrow's use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. International Data Transfers

GoToGrow is established in the United States. If you are located in the EEA, the United Kingdom, or Switzerland, your personal data will be transferred to and processed in the United States.

Where required, we rely on:

• Standard Contractual Clauses approved by the European Commission
• The UK International Data Transfer Addendum, where applicable
• Other lawful safeguards

We take appropriate measures to ensure an adequate level of protection.

6. Data Security

We implement industry-standard technical and organizational measures including:

• Encrypted data transmission (SSL/TLS)
• Encrypted storage
• Access controls (least privilege principle)
• Secure hosting infrastructure
• Internal confidentiality agreements
• Regular security monitoring

However, no system is 100% secure.

7. Data Retention

We retain personal data:

• As long as your account is active
• As necessary to provide Services
• As required by law (e.g., tax retention requirements)

Prospect data is retained based on user configuration.

Upon account deletion, data is deleted or anonymized within a reasonable period unless legally required otherwise.

8. Your Rights (EEA & UK Users)

If you are located in the EEA or UK, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent
• Lodge a complaint with your local data protection authority

To exercise your rights, email: hello@gotogrow.me

We may request identity verification before fulfilling requests.

9. US Privacy Rights

If you are located in certain US states, you may have rights to:

• Access personal information
• Correct information
• Request deletion
• Opt-out of targeted advertising

We do not sell personal information.

Requests may be submitted to: hello@gotogrow.me

10. Cookies & Tracking Technologies

We use:

• Strictly necessary cookies (platform functionality)
• Analytics cookies
• Marketing cookies (with consent where required)

You may manage cookie preferences through:

• Browser settings
• Cookie banner on our Website

Disabling cookies may limit functionality.

11. Marketing Communications

We send marketing communications only if you:

• Opt in
• Create an account (service-related communications)

You may unsubscribe at any time via the unsubscribe link in emails.

Service-related messages (billing, system updates) cannot be opted out of while your account is active.

12. Third-Party Links

Our Website may contain links to third-party websites.

We are not responsible for their privacy practices.

13. Children

Our Services are intended for business users over the age of 18.

We do not knowingly collect data from minors.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will notify users via:

• Email
• Platform notice

The "Effective Date" at the top of this page will always reflect the latest version.