Privacy Policy
GrowthBase360 (“GrowthBase360”, “we”, “us”) is a business growth platform. Our website is at growthbase360.com and the application is at app.growthbase360.com. Businesses use it to manage customers, deals and tasks, handle email and social messages in a shared inbox, publish forms, landing pages and booking pages, send email campaigns, plan and publish social media content, run automations, create sales documents, and see information from their accounting software, online store and payment provider.
This policy explains what personal data we handle, why, who receives it, how long we keep it, and your rights. It applies to our website, the application, and the public pages and forms it hosts.
GrowthBase360 is operated by Daniel Schembri, based in Malta. For any privacy question, write to [email protected].
1. Who is responsible for your data
- We are the controller of account data (your name, email address, sign-in details, plan and billing status), of what you send us through our website’s contact form, and of the technical and security records of our own website and service.
- The business that owns a workspace is the controller of its workspace content: the customers, deals, notes, files, emails, messages, orders, payments, forms and other information in that workspace. We are its processor, handling that content only to provide the service and on that business’s instructions. A data processing agreement is available on request.
2. What we collect
Information you give us
- Account information: name, email address and password (stored only as a salted hash; we cannot read it), the workspace name, and your role in it.
- Workspace content: everything you or your teammates enter or connect: customers, companies, pipelines, deals, tasks, notes, files, forms and their responses, landing pages, calendars and bookings, campaigns and audiences, automations and their run history, quotes and invoices, social media ideas and posts, your brand profile and brand files, and settings.
- Invitations: the email address and name you enter when inviting a colleague.
- Enquiries: what you enter in our website’s contact form (such as your name, email address, phone number, company and message), or send us by email. Fields we need in order to reply are marked as required.
Information from services you connect
If you choose to connect them, we receive information from your mailbox, calendar, social accounts, accounting software, online store and payment account. See section 4 and section 5.
Information collected automatically
- Technical data: IP address, browser and device type, and the time of requests, recorded in server and security logs.
- Sign-in and activity records: when you sign in, and actions that change team membership, roles or plans (an activity log visible to your workspace owners and admins). Inbox actions such as assigning or closing a conversation are recorded too.
- Usage counts: for example the number of deals and team members, to apply plan limits and keep the service running.
- Abuse prevention: on public booking pages and forms, the visitor’s IP address is kept for up to 24 hours to limit spam and abuse.
Payments
If you subscribe to a paid plan, payment is handled by Stripe. We never see or store your card number. We keep a Stripe customer reference, your subscription status and renewal date.
Do you have to give us this data?
We need your account details to create and run your account, as part of our contract with you. Without them we cannot provide the service. Connecting other services, and using AI features, is optional. We do not ask for special categories of data (such as health or religious beliefs); please do not put them in the service unless your business has a lawful reason to.
3. How and why we use it
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Provide the service | Create your account and workspace, store and display your content, send sign-in and password-reset emails, run automations, sync connected services, publish public pages and forms | Performance of a contract |
| Security and fraud prevention | Detect abuse, rate-limit public pages, investigate incidents, keep audit logs | Legitimate interests (keeping the service and its users safe) |
| Billing | Process subscriptions, send receipts, keep records | Contract; legal obligation |
| Support | Answer questions and diagnose problems. Our staff can see account details (names, email addresses, roles, plan, usage counts and sign-in times) but do not open your workspace content unless you ask us to or the law requires it. Every support change is logged. | Contract; legitimate interests (helping customers) |
| Answer enquiries | Reply to a message sent through our contact form, and keep a record of the conversation in our own workspace | Steps at your request before a contract; legitimate interests (answering people who contact us) |
| Improve and run the service | Fix errors, monitor capacity and reliability | Legitimate interests (a working, reliable service) |
| Legal compliance | Respond to lawful requests, keep required records | Legal obligation |
| Service notices | Security alerts, maintenance and important changes (shown in the app or sent by email) | Contract; legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see section 11). Where we rely on consent, you can withdraw it at any time.
We do not sell personal data and we do not show advertising. We do not send you promotional email unless the law allows it, and you can always opt out. We do not use your workspace content or Google or Microsoft user data to train artificial-intelligence or machine-learning models.
4. Google and Microsoft accounts
Connecting a Google or Microsoft account is optional. Connections run through our email and calendar provider, Nylas, and you approve them on Google’s or Microsoft’s own consent screen. Nylas holds the access tokens; we keep only a reference to the connection. There are two separate kinds of connection, and you can use either or both.
| Connection | What it lets GrowthBase360 do | What we store |
|---|---|---|
| Email and calendar (Settings → Connected applications) | See your account’s email address. Send an email from your address when you, or a campaign or automation you set up, send one. See which calendars you have and when you are busy, so booking pages offer only free times. Create a calendar event for a booked meeting, invite the visitor, and remove the event if the booking is cancelled. | Your account’s email address, the connection reference, busy time ranges for roughly the next 90 days (refreshed regularly), and the identifier of each event we created. Emails sent from a deal are kept on that deal in your workspace. We do not edit or delete calendar events we did not create. |
| Inbox mailbox (Settings → Connected applications) | Read the messages in that mailbox, so that your team can read and answer them in the Unified Inbox: new messages as they arrive, and on first connection the previous 14 days. Trash, spam and drafts are skipped. Send your replies and new emails, and mark messages as read or unread. | Copies of the messages: senders and recipients, subject, message text and attachment details, in your workspace. Attachments are fetched only when someone opens them. Anyone in your workspace can read these messages, according to their role, so only connect a mailbox your team is meant to share. |
How we use and share Google and Microsoft data
- It is used only to provide the features described above, visible to you in the app.
- We do not sell it, use it for advertising, use it to train AI or machine-learning models, or send it to our AI provider. We do not transfer it to others except to provide the service to you (the providers in section 7 process it on our behalf), to comply with the law, or with your consent.
- No person at GrowthBase360 reads your emails, except where you give explicit consent for a specific request, where it is needed for security or to investigate abuse, or where the law requires it. Members of your own workspace can read them, as explained above.
- Automated rules you set up, such as an automation that starts when an email arrives, act on your instructions.
Your control
- Disconnect any time in Settings. Disconnecting revokes our access through Nylas. For an email and calendar connection, the stored connection and busy times are deleted straight away.
- Messages already copied into the Inbox stay in your workspace after you disconnect a mailbox, because your team may need them. To have them removed, delete the workspace or email [email protected].
- You can also remove access yourself at myaccount.google.com/permissions or in your Microsoft account settings. We then stop using the connection.
5. Other connected services
All of these are optional. A workspace owner or admin chooses whether to connect them. You sign in on the other service’s own page wherever it offers this, and we never ask for your password there.
| Service | What comes in or goes out |
|---|---|
| Social media accounts and WhatsApp Business, through Zernio | Connected account details; the posts you publish or schedule; messages and comments, where the platform allows it, including the names and handles of the people who write to you; and performance figures the platforms report. Zernio holds the access to those accounts. |
| Paid advertising, through Zernio | The campaigns you create. Anything that spends money needs your explicit confirmation, which we record. |
| Xero or QuickBooks Online | A read-only copy of customers, invoices, payments, credit notes and expenses, with names and contact details. With Xero, we create a draft invoice only when a person asks us to. |
| Shopify, WooCommerce and your own Stripe account | A read-only copy of orders, products, customers, refunds, payments and subscriptions, with names, email addresses and purchase details. We never receive full card numbers and we do not move money or change your store. |
| Addresses you set up yourself | If an automation posts to Slack or Discord, or makes a request to another service, the data you put in that step is sent there. |
These services have their own privacy policies. Credentials we hold for accounting and e-commerce connections are encrypted with a key held separately from the database.
6. AI features
Some social media features use AI to suggest content, draft text, build a brand profile and comment on results. These use Anthropic’s API and are optional. When you use them, we send what they need: your business questionnaire answers, your brand profile and brand files, content ideas, your feedback on them, and post performance figures.
We do not send your customer records, inbox messages, or Google or Microsoft data to the AI provider. Our agreement with the provider does not allow it to train its models on what we send. AI output is only a suggestion: nothing is published until a person acts on it. Check it before you use it, because it can be wrong.
7. Who we share data with
We share personal data only with the service providers (“sub-processors”) we need to run GrowthBase360, under contracts that require them to protect it, and otherwise only as described here.
| Provider | What for | Data involved |
|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | All account data and workspace content (hosted in the EU, Stockholm, Sweden) |
| Cloudflare | Website hosting, network security, DNS, robot checks and email forwarding | Technical data, web traffic; forwarded support emails |
| jsDelivr | Delivers a software library to the sign-in and public pages | Your IP address and browser details, when your browser requests it |
| Brevo (France) | Delivering account emails (sign-up confirmation, password reset) | Your email address and the email content |
| Stripe | Payments for paid plans | Name, email, billing details you give Stripe; we receive status only |
| Nylas (if you connect a mailbox or calendar) | Email and calendar connections | As described in section 4 |
| Zernio (if you connect social accounts or WhatsApp) | Social publishing, messages, advertising and WhatsApp | As described in section 5 |
| Anthropic (if you use AI features) | AI suggestions for social media content | As described in section 6 |
| Services you connect | Google, Microsoft, social platforms including Meta, Xero, Intuit (QuickBooks), Shopify, your WooCommerce store, your Stripe account | As described in sections 4 and 5 |
Other people in your workspace can see its content according to their role. We may also disclose information if the law, a court or a competent authority requires it, to protect rights, safety and security, or in connection with a merger or sale of the business (we would tell you, and the new owner would have to honour this policy).
8. Where data is stored
Customer data is stored in the European Union (Stockholm, Sweden). Some providers process data outside the European Economic Area, including in the United States: for example Nylas, Zernio, Anthropic, Stripe, Cloudflare and the services you connect. Where personal data leaves the EEA, we rely on adequacy decisions (such as the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses. You can ask us for details at [email protected].
9. How long we keep data
- Account data and workspace content: for as long as your account or workspace exists. When you delete a workspace, its data and files are removed from the live system immediately. When you delete your account, your login and profile are removed; items you added to a shared workspace stay there with your name kept as plain text.
- Copies from connected services: mailbox messages and records from accounting software, stores and Stripe stay in the workspace after you disconnect, until they are deleted or the workspace is deleted. Commerce records can be deleted in a separate step when you disconnect.
- Connection credentials: removed when you disconnect.
- Enquiries to us: for as long as we need them to deal with your enquiry and any relationship that follows. Enquiries that lead nowhere are deleted within 24 months.
- Backups: deleted data can remain in encrypted backups for up to 30 days and is then destroyed.
- Logs and technical records: security and server logs for the limited period our hosting providers keep them (typically up to 90 days); public-page abuse records up to 24 hours; processed automation events 14 days; anonymous page and form view events about 13 months.
- Billing records: as long as tax and accounting law requires (typically up to six years).
- Support notes and activity logs: while the workspace exists, then deleted with it.
10. How we protect data
- All traffic uses HTTPS (TLS encryption in transit); data is encrypted at rest by our infrastructure provider.
- Each business’s workspace is separated from every other at database level (row-level security), and this is covered by automated tests.
- Passwords are stored as salted hashes. Mailbox tokens are held by Nylas and social account access by Zernio; accounting and e-commerce credentials are encrypted with a key stored separately. None of these reach your browser.
- Incoming email is cleaned and shown in a sandbox, and remote pictures stay blocked until you choose to show them.
- Team roles (owner, admin, member) limit who can invite people, connect services and change settings; important changes are recorded in an activity log.
- Access to production systems is limited to the operator and protected by sign-in security.
- If a personal-data breach affects you, we will notify you and the competent authority as the law requires.
No online service can be perfectly secure. Please use a strong, unique password and tell us promptly if you suspect misuse.
11. Your rights and choices
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict its use, receive a portable copy, and withdraw consent where we rely on it. You also have the right to object to our use of your data where we rely on legitimate interests. You can do much of this yourself:
| Export: Settings → Data → Export backup. | Delete: Settings → Data → Delete this workspace, or Delete my account. |
| Disconnect a service: Settings → Connected applications. | Update your details: Settings → Profile. |
For anything else, email [email protected]. We reply within one month. We may need to confirm your identity first. Using your rights is free unless a request is plainly unfounded or excessive.
California residents: you may request to know, correct or delete the personal information we hold about you. We do not sell or share personal information for cross-context behavioural advertising, and we do not discriminate against anyone for exercising these rights.
12. Cookies and similar technologies
We use only what is strictly necessary to run our website and service, stored in your browser’s local storage and session storage: your sign-in session, your active workspace, a pending invitation, your cookie choices, interface preferences such as theme, and dismissed announcements. Cloudflare may set essential security cookies to protect the site. We do not currently use analytics or advertising cookies. Our website asks for your choice first, and would keep any such cookies off unless you agree. See our Cookie Policy.
A business’s landing page may load fonts from Google or show videos from YouTube or Vimeo, if that business chooses to, and those providers then receive the visitor’s IP address. A business can also choose to remember campaign details between its pages, using session storage. Page and form views are counted without cookies, using a daily code that cannot be traced back to a person.
13. If a business using GrowthBase360 holds your data
You may be here because a business that uses GrowthBase360 has your details: you filled in its form or landing page, booked a meeting, emailed it or wrote to its social account, are on its campaign list, or bought from its store.
- That business is responsible for your data and for telling you how it uses it. GrowthBase360 stores and processes it on the business’s behalf. We do not use it for our own purposes except for security and abuse prevention.
- When you submit a form, the business can see what you entered, the page and form, the website you came from, campaign details in the link, your device type and the time. The business may also score enquiries using its own rules.
- Emails from a business’s campaigns include an unsubscribe link, and we skip people who have unsubscribed.
- To use your rights, contact that business first. We will help it respond. If you cannot reach it, write to [email protected].
14. Automated decisions
We do not make decisions about you with legal or similarly significant effects based solely on automated processing. Businesses can set up their own automations and lead-scoring rules; these act on that business’s instructions and it remains responsible for them.
15. Children
GrowthBase360 is a business service and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.
16. Changes to this policy
We may update this policy as the service or the law changes. We will change the date at the top and, for material changes, notify you in the app or by email before they take effect. The Google user data section will not be loosened without asking for your consent again where Google’s policy requires it.
17. Contact and complaints
GrowthBase360, operated by Daniel Schembri, Malta
Email: [email protected]
Website: https://growthbase360.com
If you are in the EU/EEA you may also complain to your national data-protection authority. In Malta this is the Office of the Information and Data Protection Commissioner (IDPC). We would appreciate the chance to resolve your concern first.