Privacy Policy
What we collect, why, who else sees it, and how to have it deleted. Short version: your name, email, country and a public handle. Never a password, never a card number.
What we collect
What you type at checkout: your name, email address, country, the public username or post links the campaign should run on, and the services and quantities you chose. That is the whole order record, together with its order number, price, status and campaign history.
Payment data: we don't see it. Card payments happen on our payment partner's pages; we receive a confirmation, the amount and a reference, not your card number. Crypto payments go through our crypto payment partner; we see the transaction reference, the amount and the paying wallet address, which is public on the network anyway.
What your browser sends: your IP address, browser and device type, the pages you open and when. It lands in our server logs and in the security logs of the network partner that sits in front of the site. The checkout also runs that partner's bot check, one that looks at browser signals instead of asking you to click on traffic lights.
What you write to support: your emails and whatever you attach to them.
What stays on your device: to save you retyping, your browser stores the name, email, country and handles you entered, and a draft of the order you were building. This is local storage on your own device; it is not sent to us until you order, and you can clear it from your browser settings at any time. There is no account, so there is nothing to sign out of.
Why we use it
- To take, run and track your order, to restore results under retention protection, and to refund it when we owe you one. Legal basis: the contract with you.
- To keep the accounting and tax records the law requires, and to answer lawful requests from authorities. Legal basis: legal obligation.
- To keep the site up and safe: blocking abuse, rate-limiting, spotting fraud and payment disputes, fixing bugs. Legal basis: our legitimate interest in running a working service.
- To measure how the site is used and how fast its pages load, and, where we run them, to attribute advertising, through our network, analytics and advertising partners. Legal basis: our legitimate interest in knowing which pages work and which ads pay for themselves. You can opt out; the Cookies section says how.
We don't send marketing email. If we ever start, it will be opt-in, with an unsubscribe link in every message.
Who else sees it
We don't sell personal data, and nobody gets more of it than they need to do their part:
- Our payment partners, for card and for crypto, process the payment itself under their own privacy policies.
- Our campaign partners receive the public handle or link, the service and the quantity. They never receive your name, email or country.
- Profile look-up providers receive the public handle so we can show you your own posts to choose from. Same rule: handle only.
- Our network partner runs the edge in front of the site: content delivery, the firewall, the bot check and the login gate for our own staff area. It sees the traffic to do that. It also measures how fast pages load for real visits: load and response times, the page address without anything after the question mark, the referring site, the country and the browser and device type, without cookies or anything else stored on your device.
- Our hosting partner runs our servers in Helsinki, Finland. Encrypted backups are stored with a storage partner, in an EU-jurisdiction bucket.
- Our log-monitoring partner receives a copy of our server logs, in the European Union, so we notice errors quickly.
- Our analytics and advertising partners, for analytics and ads measurement, where we run them, under their own privacy policies.
We disclose data beyond this only when the law requires it, or to defend a payment dispute with the records of the order in question.
Where it lives
Order data is stored in the European Union. Some of the partners above (payment, network, analytics and some look-up partners) may process data outside the EU; where they do, the transfer relies on the European Commission's standard contractual clauses or an adequacy decision such as the EU-US Data Privacy Framework.
How long we keep it
- Order records: for the retention window plus the period accounting and tax law requires us to keep invoices and payment records. After that they are deleted or anonymised.
- Support emails: as long as the conversation and the order it concerns are open, then alongside the order record.
- Server logs: kept for up to 90 days on our servers and 14 days with our log-monitoring partner, then deleted automatically.
- Backups: encrypted, rotated on a fixed schedule; the oldest copies are around three months old.
- The data your own browser stores: until you clear it.
Security
Everything travels over HTTPS. Card numbers never reach us. Our staff area sits behind a separate login gate at the network edge, our database accepts only the minimum access each part of the system needs, and backups are encrypted before they leave the server. No system is perfect; if a breach ever affects your data, we tell you and the supervisory authority as the law requires.
Your rights
Under the GDPR you can ask us to show you the data we hold about you, correct it, delete it, restrict or object to how we use it, hand it over in a portable format, or withdraw a consent you gave. Some of it we must keep for accounting for a fixed period even if you ask for deletion; we'll tell you what and for how long.
Write to support@growillo.com with the order number and the email you used at checkout, so we can find the right record and know it's you. We answer within one month.
If you think we've handled your data badly, you can complain to the data protection authority in RO (ANSPDCP) or to the one in your own country.
Children
Our services are for adults. We don't knowingly collect data from anyone under 18; if you believe a minor has ordered from us, tell us and we'll delete the record.
Changes
We update this policy when what we do with data changes. If a change matters to orders already placed, we say so on this page.