Privacy Policy

This policy explains how Growbeam ("we", "us") collects and uses personal data when you use growbeam.co.uk and related services. We aim to be clear about what we need to run the product and what stays under your control.

We are the data controller for personal data described here. For privacy questions or to exercise your rights, contact info@growbase.co.uk.

Depending on how you use Growbeam, we may process:

• Account data — email address, authentication identifiers, and billing customer references when you subscribe.
• Business profile — business name, website URL, services, location, goals, and settings you enter in the dashboard.
• Audit and plan data — findings from public pages we fetch at URLs you submit, generated recommendations, action items, notes, and enquiry records you log.
• Usage and technical data — sign-in activity, feature usage needed to enforce plan limits, and basic server logs (IP address, user agent, timestamps) for security and troubleshooting.
• Support communications — messages you send us by email or through support channels.

We do not require you to connect Facebook, Google Analytics, or other third-party marketing accounts to use the core service in this release. If we add optional integrations later, we will update this policy and ask for consent where required.

• Provide and maintain your account, dashboard, website checks, growth plans, and exports.
• Authenticate you and keep your session secure.
• Process subscriptions and invoices through our payment provider.
• Improve reliability, prevent abuse, and enforce our terms and plan limits.
• Respond to support requests and important service notices.
• Comply with legal obligations and defend our legal rights where necessary.

We rely on the following bases, depending on the processing:

• Contract — processing needed to deliver the service you signed up for.
• Legitimate interests — security, fraud prevention, and improving the service, balanced against your rights.
• Consent — where we ask explicitly (for example optional analytics or marketing cookies, if enabled).
• Legal obligation — where we must retain or disclose information to comply with law.

We use trusted processors who handle data only on our instructions and under appropriate contracts:

• Supabase — authentication, database, and file storage for your account and business data (hosting region depends on your project configuration, typically EU or US).
• Stripe — payment processing and subscription management when you purchase a paid plan.
• Hosting and infrastructure providers — to run the web application and background jobs.

We do not sell your personal data. We do not use your business content to train public third-party AI models unless we tell you otherwise in product settings or a separate agreement.

We keep account and business data while your account is active and for a reasonable period afterward so you can export information or reactivate. Billing records may be kept longer where required for tax and accounting. Security logs are retained for a limited period unless needed for an investigation.

You can request deletion of your account and associated personal data subject to exceptions (for example unresolved billing or legal holds).

We use industry-standard measures including encrypted connections (HTTPS), access controls, and row-level security in our database so each account can only access its own business data. No online service can guarantee perfect security; please use a strong, unique password and keep your login details confidential.

Some processors may process data outside the UK. Where they do, we rely on appropriate safeguards (such as UK adequacy regulations, standard contractual clauses, or equivalent mechanisms) as required by UK data protection law.

Under UK GDPR you may have the right to:

• Access a copy of personal data we hold about you.
• Rectify inaccurate data.
• Erase data in certain circumstances.
• Restrict or object to certain processing.
• Data portability for data you provided, where applicable.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the Information Commissioner's Office (ICO) in the UK.

To make a request, email info@growbase.co.uk. We may need to verify your identity before responding.

Growbeam is aimed at businesses and is not intended for children under 16. We do not knowingly collect data from children.

We may update this policy from time to time. We will post the new version on this page and adjust the "Last updated" date. Material changes may also be notified by email or in-app notice where appropriate.

See also our Cookie policy and Terms of Service.