Privacy Policy

Last updated: 2026-10-18

GrowthFox ("we," "us," "our") operates the growthfox.app platform. This policy explains what data we collect, why we collect it, and your rights regarding that data.

Information we collect

Account information

When you create an account, we collect your name, email address, and password. If you subscribe to a paid plan, we collect billing information through Stripe — we never store your full card number on our servers.

Usage data

We collect information about how you use the platform: pages visited, features used, campaigns sent, and performance metrics. This helps us improve the product and diagnose issues.

Cookies

We use essential cookies for authentication and session management. We use analytics cookies to understand how the platform is used. You can disable non-essential cookies in your browser settings.

Sign-in records

When you sign in to GrowthFox, we record the time, whether the sign-in worked, the IP address it came from and your browser. We use this to keep accounts and our systems secure, on the basis of our legitimate interest in security. We delete these records after 90 days, unless we need one longer to investigate a specific security incident.

How we use your information

  • -Provide and maintain the GrowthFox platform
  • -Process payments and manage subscriptions
  • -Send transactional emails (account confirmations, password resets)
  • -Improve the product based on usage patterns
  • -Respond to support requests
  • -Detect and prevent fraud or abuse

Data sharing

Service providers. We use these companies to run GrowthFox. They handle personal data only to provide their service to us:

  • -Railway: hosting for our application, database and background jobs.
  • -Vercel: hosting for our website and web app.
  • -Resend: sending email.
  • -Google Fonts: pages published through GrowthFox load fonts from Google, so your browser connects to Google's servers, which receive your IP address.
  • -Stripe: payments for GrowthFox subscriptions. Stripe handles your payment details as its own controller, under its own privacy policy.
  • -Google Tag Manager: our website loads it to manage analytics tags. Google receives your IP address when your browser fetches it. Analytics tags run only if you accept them in the cookie banner.

Data retention

While your account is open. We keep your account data for as long as your account is open.

When you close your account. You can ask us for a copy of your data for 30 days after you close it (see "Your rights" below). Automatic deletion of closed accounts is not running yet. Until it is, we keep the personal data of a closed account until you ask us to delete it, and you can ask at any time (see "Your rights" below). We will update this section when automatic deletion starts.

Backups. Personal data we have deleted from our live systems is removed from our backups as they expire, on a rolling cycle.

When we delete a contact, we keep a coded record of the deletion (a coded form of the email address, dates, and the tables affected) for 90 days, so that a restore from a backup does not bring the deleted data back.

The record we keep after you close a business account. When you close a business account, we keep a short record so that we can tell you if a security incident touches data of yours that is still in our backups. The record has six items: your company name, your owner email address, your privacy notice contact, your Stripe customer id, the date you closed your account, and the date we delete the record. We use the Stripe customer id to look up your billing contact in Stripe when we need to reach you. We do not copy the billing contact into the record. We keep the record because the law requires us to notify you of a data breach without undue delay (Article 33(2) of the GDPR; our legal basis is legal obligation, Article 6(1)(c)). Automatic deletion of closed accounts is not running yet. Until it is, we keep your account's data, and this record, until you ask us to delete them.

Billing records. We keep invoices and payment records for as long as our accounting and tax obligations require. We do not delete them when you close your account. Our payment processor, Stripe, also keeps its own copy under its own terms.

Coded usage data may be retained for analytics purposes.

Your rights

You have the right to:

  • -Access — ask for a copy of the personal data we hold about you, and for information about how we use it. Write to privacy@growthfox.app and we will answer within one month.
  • -Portability — ask us for a copy of the personal data you have given us, in a structured, machine-readable format. Write to privacy@growthfox.app and we will answer within one month.
  • -Deletion — ask us to delete your account and the personal data associated with it. Write to privacy@growthfox.app and we will answer within one month.

Export — ask us and we will send you a copy in a machine-readable format within 30 days, at any time while your account is open and for 30 days after you close it. If you ask during those 30 days, we keep your data until we have sent it.

Cookies

Essential cookies (authentication, session) are required for the platform to function. Analytics cookies are optional and can be disabled. We do not use advertising cookies or tracking pixels from third-party ad networks.

Contact

For privacy-related questions or to exercise your data rights, contact us at privacy@growthfox.app.