Privacy Policy

Last updated: November 2026

What we collect

When you submit a form on this site we collect the details you enter: name, email, phone number, website and message. Our server also keeps standard access logs (IP address, browser, pages requested) for security and troubleshooting.

How we use it

We use form details only to reply to your request and to prepare a proposal. We do not sell or rent personal information, and we do not add you to a mailing list unless you ask.

If you subscribe, we store your email address to send the newsletter. Every issue has an unsubscribe link, and you can also ask us to remove you at any time.

Client portal accounts

If you create a portal account we store your name, contact details, the orders you place and the messages you exchange with our team. Passwords are stored only as one-way hashes. The portal uses one essential session cookie to keep you signed in. No card or bank details are collected on this website.

Connected social accounts

If you use Social Publishing to connect a TikTok account, you authorise it on TikTok's own website and we never receive your TikTok password. We store the access and refresh tokens TikTok issues, your public TikTok profile name, username and avatar, the videos you queue and the status of each post. We use them for one purpose only: to publish the posts you have set up and to show you their status. Videos are stored on our server only until TikTok has finished retrieving them, and are then deleted; queued videos are served from an unlisted address so TikTok can fetch them. We do not read your TikTok messages, followers or analytics, and we do not share this data with anyone. Disconnecting the account in the portal revokes our access with TikTok immediately and deletes the stored tokens. You can also remove our access from the Manage app permissions page in your TikTok settings. TikTok's own handling of your data is covered by its privacy policy.

Growth CRM app, Facebook and Instagram

The Growth CRM mobile app uses the same account as the client portal. If you connect a Facebook Page or an Instagram professional account, you sign in on Facebook's own website through Facebook Login and we never receive your Facebook password. Meta gives us an access token for each Page and account you choose, plus its name, ID and picture. Depending on the permissions you grant, we use these to: publish the posts you, or our team with your approval, schedule; show whether each post went out and how many likes, comments and shares it received; show you the comments, messages and reviews on your Page and Instagram account so you can read and answer them in the app; show reach, follower and audience statistics (age, gender and city totals, never individual followers); list the leads from your own lead forms so you can save them as customers; and show results of, pause, resume or boost the ads in the ad account you choose. This data is shown only to you and to our team when you hire us. We do not use it for advertising, and we do not sell it or share it with anyone else. Photos and videos you upload are stored on our server until the post is published and are removed after that. App purchases are handled by Google Play or the App Store; we receive only a purchase confirmation, never your card details.

Growth CRM business records

The Business section of the app stores what you enter there: income and expenses (with any receipt photo you add), invoices, your customers' names and contact details, reminders, and the business profile you fill in (what you sell, your customers, goals and brand style). These records are stored on our own server, are visible only to you and our team, and are used only to run those features. Your business profile is also kept with your account record, described below. Invoice links you share can be opened by anyone who has the link. Reminders are scheduled as notifications on your own phone.

Growth CRM account records, offers and notifications

When you sign up we keep an account record so we can run your account, support you and, if you agree, send you offers. It holds your name, email address, phone number, business name and the business profile you fill in, how you signed up (email, Apple, Google or Facebook), when you signed up and last used the app, your plan and AI credits, which social accounts you connected, simple usage counts (posts, service requests, invoices), whether you agreed to offers, and for each phone the app version, platform, time zone, language and a push notification token. This record is stored on our server and in Google Firebase (Google LLC, USA), which acts as our data processor and does not use it for its own purposes. We use it only inside Growth Asteroid; we do not sell it or share it with advertisers. If you turn on "Send me offers and tips" (in the sign-up questions or in Account, Offers and tips), we may email you and send app notifications about discounts on our services, marketing tips and app news; every email has an unsubscribe link and you can turn offers off in the app at any time. Account and service notifications (for example a post that failed, or a reminder) are sent whatever you choose for offers, and you can switch all notifications off in your phone's settings. Push notifications are delivered through Firebase Cloud Messaging and Apple Push Notification service.

Growth CRM WhatsApp bot

If you switch on the WhatsApp bot, the Growth CRM app on your Android phone reads the notifications of new WhatsApp and WhatsApp Business messages on that phone and answers them through the notification's reply button. It does this only after you turn on "This phone answers WhatsApp" and allow notification access in Android settings, and you can turn it off at any time in the app, by sending #off from your own number, or by removing notification access. For each message it answers, the app sends our server the name the sender is saved under on your phone (or their number), the message text and the chat it came from; it does not read other apps' notifications, your contacts list, photos, voice notes or older messages. Our server keeps a short memory per chat (the last few messages and any order details the customer gave, such as name, need, budget and area) so replies make sense, keeps a log of messages and replies for 30 days so you can see what the bot said, and saves leads and questions it could not answer in your account. What you teach the bot (text, links, menus, price lists, photos and exported chats) is turned into your business fact sheet; exported chats have names, phone numbers and email addresses removed before they are used. Replies are written by Claude (Anthropic, PBC, USA) as described in the next section. This data is visible only to you and to our team, who may help set up or teach your bot, and is deleted when you delete your account. WhatsApp is a service of WhatsApp LLC; Growth CRM is not made or endorsed by WhatsApp or Meta, and WhatsApp's terms limit automated use of its apps, so you choose whether to use the bot on your number.

AI features in Growth CRM

Caption writing, post ideas, "what to post next" suggestions, reply drafts, the chat assistant and the WhatsApp bot are powered by Claude, an AI service provided by Anthropic, PBC (USA). The app asks your permission the first time you use an AI feature, and you can turn AI data sharing off at any time in the app under Account. When you use one of these features, we send Anthropic only what is needed to answer: the text you type or ask (for example a post brief, a chat message or a customer comment you want to answer), your business name and business profile, the captions and like and comment counts of your recent posts, and, for the chat only, your income, expense and unpaid invoice totals for the current month. For the WhatsApp bot we also send your fact sheet and rules, what you teach it, and the customer messages it answers with the sender's saved name and recent chat. Apart from that, we never send your password, email address, phone number, payment details or your customers' contact details. Anthropic processes this data only to return the answer, under terms that do not allow it to train its models on it, and protects it to the same standard we do. If you do not use AI features, nothing is sent.

Deleting your data

You can remove a connected Facebook Page or Instagram account at any time in the Growth CRM app under Account, Connected accounts: we immediately delete its access token and stop publishing to it. You can also remove Growth CRM from Facebook under Settings, Business integrations. To delete your whole account, open the app and choose Account, Delete account: your login, connected accounts, tokens, scheduled posts, all business records (income, expenses, invoices, customers, reminders, leads and profile), your phones' push tokens and your account record in Firebase are removed, and you will get no more offers. You can also email info@growthasteroid.com from your account address and we will delete everything we hold about you within 30 days and confirm by email.

Cookies and analytics

This site uses Google Analytics to understand, in aggregate, which pages are useful and where visitors come from. It sets analytics cookies; it does not set advertising cookies, and we do not use it to identify you. You can opt out with your browser settings or Google's opt-out add-on.

Third parties

If you contact us through WhatsApp, email or a social platform, that provider's own privacy policy applies to the conversation. Fonts on this site are served by Google Fonts.

Retention and your rights

We keep enquiry details for as long as needed to handle your request and any resulting work. You can ask us to access, correct or delete your information at any time by emailing info@growthasteroid.com.