Privacy Policy

1. Data Controller

1.1

The controller of the personal data referred to in section 2 is Growth Hub sp. z o.o., with its registered office at ul. gen. Tadeusza Pełczyńskiego 14D/149, 01-471 Warszawa, Poland, KRS 0001093247, NIP 5223291362.

1.2

The Provider has not appointed a data protection officer, not being obliged to do so under Article 37 GDPR. Correspondence concerning the processing of personal data is directed to privacy@growthmention.com.

2. Categories of Data, Purposes and Legal Bases

2.1

The Provider processes the following categories of personal data, for the purposes and on the legal bases indicated:

Category	Purpose	Legal basis	Retention period
Identification and contact data: given name and surname, email address, password stored in hashed form	Maintenance of the Account and provision of the Service	Art. 6(1)(b) GDPR — performance of the Agreement	For the term of the Agreement, and 30 days thereafter
Configuration data: organisations, projects, Prompts, brand designations	Provision of the Service	Art. 6(1)(b) GDPR	For the term of the Agreement, and 30 days thereafter
Settlement data: business name, address, VAT number, Plan, amounts, invoices	Settlement of fees and issuance of accounting documents	Art. 6(1)(b) and Art. 6(1)(c) GDPR in connection with tax law	5 years from the end of the tax year in which the tax became due
Correspondence and support requests	Handling of enquiries and complaints	Art. 6(1)(f) GDPR — the legitimate interest in supporting Clients	3 years
Technical data: IP address, request details, time of request	Ensuring the security and correct operation of the Service	Art. 6(1)(f) GDPR — the legitimate interest in the security of the service	30 days

2.2

The data comes from the data subject, save for technical data, which is generated by the connection itself. The Provider does not acquire personal data from external sources and does not enrich its records from them.

2.3

Where the Client invites a User to its organisation, the Client provides that person's email address. It is used to deliver the invitation, and upon its acceptance the person becomes the holder of an Account subject to this Policy. The obligation to inform that person rests with the Client.

2.4

The provision of data is voluntary but necessary for the conclusion and performance of the Agreement; failure to provide it prevents use of the Service.

3. Prompts, Answers and the Use of Artificial Intelligence

3.1

Prompts defined by the Client are submitted to AI Assistants and the answers obtained are recorded in full. Each answer is then analysed by a language model for the purpose of identifying brand mentions, their position and sentiment, and the sources cited.

3.2

Prompts are submitted without any account of the Client or of the Provider being signed in. No data identifying the Client is transmitted to AI Assistants beyond the content of the Prompt itself.

3.3

The unprocessed response payloads returned by providers are erased after 7 days. The text of the answers, the extracted mentions and the citations are retained for the term of the Agreement, that data constituting the subject matter of the Service.

3.4

Personal data should not be included in the content of Prompts. Where it is, it is transmitted to AI Assistants and to the providers referred to in section 5 as part of the Prompt.

4. Data Entrusted by the Client

4.1

In respect of data collected by means of Agent Analytics the Client is the controller and the Provider is the processor, on the terms set out in clause 6 of the Terms of Service.

4.2

The following categories of data are recorded:

Recorded	Not recorded	Retention period
Requests from recognised automated agents: the agent designation, the path, the response status code, the user-agent string and the IP address of the request	No data concerning requests made by natural persons — neither the path, nor the time, nor the fact of the request	24 weeks; the IP address is erased after 30 days
The aggregate daily number of requests, constituting the denominator for the share of automated traffic	No addresses, paths or identifiers	24 weeks
Visits originating from an AI Assistant: the assistant designation and the path	No address and no data concerning the visitor	24 weeks
Optionally, and only where activated by the Client: page views comprising the path and an IP address truncated at source to its first three octets	Never a full IP address, no cookie and no identifier permitting views to be linked	24 weeks

4.3

IP addresses recorded in respect of automated agents are those of the operators' servers and are retained solely in order to verify the authenticity of an agent declaring a given identity. They are erased after 30 days, the record of the request being retained without them.

5. Recipients of Data and Transfers Outside the EEA

5.1

Data is disclosed solely to the categories of recipient set out below, each bound by an agreement permitting the use of the data exclusively for the provision of its service to the Provider. The Provider does not sell personal data and does not disclose it for marketing purposes.

Category of recipient	Purpose	Scope of data	Location
Hosting and storage	The servers and the database everything lives in	All service data, at rest and in processing	Germany (EU)
Answer collection	Putting your prompts to the AI assistants	The text of your prompts. No account of yours, and no personal data of yours	Inside the EEA, or a country the European Commission has found adequate
Answer analysis	Reading each answer for which brands it names, where and in what tone	The text of assistant answers. Not your account, not your billing details	United States, under Standard Contractual Clauses
Payments	Taking payment and issuing invoices — Stripe Payments Europe, Ltd.	Name, email, billing address, VAT number, and the card itself, which never reaches us	Ireland (EU), with transfers to the United States under Standard Contractual Clauses
Email delivery	Sending sign-in, report and notification email	Your email address and the content of the message	United States, under Standard Contractual Clauses

5.2

Data is stored on servers located in Germany. Where a recipient is established outside the European Economic Area, the transfer is effected on the basis of the Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR.

5.3

Recipients are indicated by category and not by name, which Article 13(1)(e) GDPR permits, the identity of the providers used for the collection and analysis of answers constituting the Provider's business secret. This limitation applies to this Policy and not to the Client: a Client is entitled to the identity of the individual sub-processors and receives it in writing upon request sent to privacy@growthmention.com, together with a data processing agreement identifying them.

5.4

Data may also be disclosed to competent authorities where an obligation to do so arises from generally applicable law. Where permitted, the Provider shall inform the data subject of such disclosure.

6. Data Security

6.1

The Provider applies the technical and organisational measures required by Article 32 GDPR, in particular: encryption of transmission by means of TLS, storage of passwords in hashed form precluding their recovery, storage of ingest keys in hashed form, isolation of the database from public networks, encryption of backups, and restriction of access to persons operating the Service.

6.2

In the event of a personal data breach resulting in a risk to the rights and freedoms of natural persons, the Provider shall notify the supervisory authority within 72 hours pursuant to Article 33 GDPR and shall inform the data subjects without undue delay where the risk is high.

7. Cookies and Tracking Technologies

7.1

The Service uses one cookie, designated gm_signed_in, which holds the value 1 and contains no identifier, email address or authentication token. Its sole function is to indicate to the marketing website whether a session is active, so as to determine which navigation element is displayed.

7.2

The session itself is maintained by means of a token held in the browser's local storage, which is not transmitted to other domains.

7.3

The Provider does not employ analytical, advertising or tracking tools of any kind, on either the marketing website or the Service — in particular no analytics scripts, tracking pixels or session recording.

7.4

The cookie referred to in clause 7.1 is strictly necessary for the provision of a service requested by the user within the meaning of Article 173(3) of the Telecommunications Law, and its storage does not require consent. Accordingly no consent mechanism is presented.

7.5

The Provider discloses that the pages load a typeface from an external provider of web fonts, in consequence of which that provider obtains the IP address of the visitor for the duration of the request. The Provider is in the course of migrating those files to its own infrastructure, which will end that transfer.

8. Rights of Data Subjects

8.1

The data subject has the right to:

access to the data and to obtain a copy of it (Art. 15 GDPR);
rectification of data which is inaccurate or incomplete (Art. 16 GDPR);
erasure of the data (Art. 17 GDPR), save to the extent that its retention is required by law, in particular in respect of accounting documents;
restriction of processing (Art. 18 GDPR);
data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR);
object to processing carried out on the basis of Art. 6(1)(f) GDPR (Art. 21 GDPR).

8.2

Requests are directed to privacy@growthmention.com and are dealt with without undue delay and in any event within one month of receipt, which period may be extended in accordance with Article 12(3) GDPR.

8.3

A number of these rights may be exercised without a request: the data may be exported in CSV format from within the Service, and deletion of the Account results in deletion of the data on the terms set out in clause 12.4 of the Terms of Service.

8.4

The data subject has the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa — or with the authority competent for their place of residence.

9. Automated Decision-Making, Profiling and Minors

9.1

The Provider does not take decisions concerning data subjects based solely on automated processing, including profiling, which produce legal effects concerning them or similarly significantly affect them within the meaning of Article 22 GDPR.

9.2

The analysis carried out by the Service is directed at the content of answers given by AI Assistants and not at natural persons. No stage of that process evaluates, scores or classifies the Client or its Users.

9.3

The Service is not addressed to persons under 16 years of age and the Provider does not knowingly process their data. Where such data comes to light it is deleted upon notification sent to privacy@growthmention.com.

10. Change of Provider

10.1

In the event of a sale, merger or reorganisation of the Provider's enterprise, personal data may be transferred to the acquirer, where it remains subject to this Policy or to a policy affording no lesser protection.

10.2

Account holders are notified at least 30 days in advance of such a transfer, so as to permit the export of data and the closure of the Account before it takes effect. Clause 15 of the Terms of Service applies.

11. Amendments to the Policy

11.1

The Provider may amend this Policy. Material amendments are notified to Account holders by email, and the date at the head of the document is updated.

11.2

Amendments do not operate retroactively: data collected under a previous version is processed on the terms in force at the time of its collection.