Privacy policy

GrowTroop is a service of AGByte, Amsterdam, the Netherlands (‘AGByte’, ‘we’, ‘us’ or ‘our’). Where this policy says we decide why and how personal data is used, AGByte is the controller of that data under the General Data Protection Regulation (GDPR).

We have not appointed a data protection officer. Every question about this policy or about your personal data goes to [email protected], and a person on our team answers it.

This policy covers the website at https://growtroop.com, the GrowTroop service and the way we communicate with you. Customers also agree to our Terms of service at https://growtroop.com/en/terms, which include our data processing terms. Cookies are described in the Cookie policy at https://growtroop.com/en/cookies.

The GDPR gives a company one of two roles for each kind of personal data it handles. We hold both, depending on the data.

• Controller. We decide how data is used for the website, for accounts and sign-in, for billing, for support, for security and for keeping track of how the service is used. This policy explains that processing in full.
• Processor. What an organization puts into GrowTroop, or has the troop create, is processed on that organization's behalf and on its instructions. That includes brand material, uploaded media, posts, chat threads and anything in them about the organization's own staff, customers or audience. The organization is the controller of that data, and its own privacy notice applies to it.

If your personal data appears in content that a GrowTroop customer manages, please contact that organization first. We help it answer your request, and if you write to us, we pass your request on to it.

This website has no forms and no accounts, and it never asks you for personal data.

Our hosting and network providers process technical data from each visit, such as your IP address, browser type and the page you asked for, to deliver the site and protect it against attacks and abuse. Legal basis: our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR). These records are kept only as long as security requires.

We see which pages are read through analytics that sets no cookie and stores no personal identifiers. Google Analytics runs only if you accept analytics cookies. Your consent is the legal basis (Article 6(1)(a)), and you can withdraw it at any time through Cookie settings in the footer of every page. One necessary cookie, gt_consent, remembers your choice. The full list is in the Cookie policy at https://growtroop.com/en/cookies.

You reach us by email: when you click one of our addresses, your own mail program sends the message. We then hold your name, email address, company and whatever you wrote, together with our replies.

We use this to answer you, to arrange a demo or brand session and to prepare an offer. Legal basis: steps you asked us to take before entering into a contract (Article 6(1)(b)), or our legitimate interest in answering questions about our business (Article 6(1)(f)).

We keep the correspondence as long as the conversation needs it and for up to two years after the last contact. If it becomes part of a customer relationship, the customer retention rules in How long we keep data apply instead.

To use GrowTroop you need an account in an organization. For your account we process:

• your name, email address and profile settings;
• your password, which we store only in hashed form and never in plain text;
• your multi-factor authentication settings, if you switch them on;
• if you sign in through a third-party identity provider, the name, email address and account identifier that provider shares with us;
• your organization membership, role and teams, and the invitations you send or receive;
• your active sessions and devices, and sign-in and security events such as failed attempts and password changes.

We use this to create and run your account, sign you in, keep the account secure and let organization owners and admins manage who has access.

Legal basis: for the person who signs the organization up, performance of our contract (Article 6(1)(b)). For members invited by an organization, our and that organization's legitimate interest in giving its team access to the service it uses (Article 6(1)(f)). For security events, our legitimate interest in protecting accounts and the service against misuse (Article 6(1)(f)).

Account data is kept while the account exists and deleted within 30 days after the account is closed, except what we must keep as described in How long we keep data.

When your organization uses the service, we process the following on its behalf:

• brand details such as the name, website, logo, colours, voice, audience, products and competitors, and the brand card with its versions;
• images, video, audio and other files that members upload;
• prompts, and the text, images, video and voice the troop generates;
• chat threads with the marketing director, on the dashboard and in Telegram, including voice notes and their transcripts;
• posts, captions, schedules and approvals, and the publication record of what was published where and when, including attempts that failed;
• pictures a member deleted, which stay in Recently deleted for 30 days so they can be restored and are then removed for good.

When a member asks the troop to research a brand or its market, the service fetches publicly available web pages and search results, such as the brand's own website and those of its competitors. Personal data that appears on those public pages, such as a named founder or a public review, may be processed as part of that research and kept with the brand's material.

We process this content only to provide the service the organization asked for, on its instructions and under the data processing terms in our Terms of service. The organization decides what goes in and when it is deleted. We do not sell this content, we do not use it to build advertising profiles and we do not train AI models on it.

GrowTroop's marketers are AI personas. To plan, write, design, transcribe and edit, the service sends the prompts, brand material and media that a task needs to AI model providers, which process them to produce the result and return it to us.

We do not use your content to train AI models.

AI output is produced by software. It can be wrong or incomplete, and it can resemble material that already exists elsewhere. That is why nothing is published without a person's approval or an explicit publish action from a member of the organization.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you, as meant in Article 22 GDPR.

Members can connect accounts on Instagram, Facebook, LinkedIn, TikTok, X and YouTube so the troop can publish to them. You connect through the network's own sign-in screen and choose there what to allow. We never see your password for that network.

From a connected account we receive only what publishing needs: account, page or channel identifiers, names and profile pictures, access and refresh tokens, and the identifiers, links and status of the posts we publish. We do not read your private messages. We publish only what a member approved or explicitly asked to publish. Legal basis: performance of the contract (Article 6(1)(b)), on your organization's instructions.

Once a post is published, the network is an independent controller of it, and that network's own terms and privacy policy apply. TikTok, Meta for Facebook and Instagram, LinkedIn and X each apply their own policies to your account and to what is published there.

You can disconnect a channel at any time in your organization's settings in GrowTroop. You can also revoke GrowTroop's access in the network's own settings, usually under connected apps, apps and websites, or security. How to do both, step by step, is in How to delete your data.

YouTube. GrowTroop uses YouTube API Services. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service at https://www.youtube.com/t/terms. How Google handles data is described in the Google Privacy Policy at https://policies.google.com/privacy. You can revoke GrowTroop's access to your Google account at any time on the Google security settings page at https://security.google.com/settings/security/permissions. If you ask us to delete data we received from YouTube, we delete it within 7 days.

GrowTroop's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. That policy is published at https://developers.google.com/terms/api-services-user-data-policy.

If you link Telegram to talk to your marketing director there, we receive your Telegram user ID, username and display name, and the messages and voice notes you send to the GrowTroop bot, together with its replies. We use them to carry your conversation between Telegram and the dashboard.

Legal basis: performance of the contract (Article 6(1)(b)) or, for invited members, the legitimate interest described in Your account. Telegram's own privacy policy applies to Telegram's side of the conversation. You can unlink Telegram at any time in GrowTroop.

GrowTroop offers Free, Essential, Pro, Scale and Custom plans, billed monthly or yearly, and a credits wallet for AI usage. For paid plans and credit purchases we process the billing contact's name and email address, the company name, billing address and VAT number, the plan and credits bought, invoices and payment status.

You enter card and other payment details with our payment provider. We do not receive or store full card numbers.

Legal basis: performance of the contract (Article 6(1)(b)) and our legal obligation to keep financial records (Article 6(1)(c)). Dutch tax law requires us to keep invoices and the records behind them for 7 years.

To run the service fairly and safely, we keep records of how it is used: which features and AI tasks ran for which organization, the credits each one used, errors and security events. We use these records to meter credits and plan limits, show organizations their usage, help you when something goes wrong, detect and stop abuse, and improve the service.

Legal basis: performance of the contract for metering and billing (Article 6(1)(b)), and our legitimate interest in a secure, reliable and improving service (Article 6(1)(f)). When we analyse usage to improve GrowTroop, we use aggregated or de-identified data wherever we can.

Authorized AGByte staff access an organization's account only when they need to for support, security, billing, abuse handling or a legal obligation, and only as far as that need goes.

We share personal data only as far as needed to run GrowTroop, and we never sell it. Recipients fall into these categories:

• cloud hosting and database providers, which run the service and store its data;
• storage and content delivery providers, which hold and serve media files;
• background processing providers, which run longer tasks such as generating images and video;
• AI model providers, which produce text, images, video, voice and transcripts;
• a publishing service that connects to the social networks you link, and those networks themselves when a post is published;
• our payment provider, for paid plans and credit purchases;
• an email delivery provider, for account, security and service emails;
• analytics providers for this website, only with your consent;
• Telegram, if you choose to use it;
• professional advisers such as accountants, auditors and lawyers, who are bound to confidentiality;
• courts, regulators, police and other authorities, when the law requires it or when it is needed to protect rights, safety or the service;
• a buyer or successor if AGByte or GrowTroop is reorganized, merged or sold, in which case we tell you before your data becomes subject to a different privacy policy.

Providers that process personal data for us may use it only to provide their service to us. Customers can ask for our current list of sub-processors at [email protected].

Some of our providers process personal data outside the European Economic Area, including in the United States. When they do, we rely on a safeguard the GDPR recognises: an adequacy decision of the European Commission, including the EU–U.S. Data Privacy Framework where the provider is certified under it, or the European Commission's Standard Contractual Clauses, with supplementary measures where needed.

You can ask for a copy or a summary of the safeguards that apply at [email protected].

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires.

• Account data: while the account exists, then deleted within 30 days after the account is closed.
• Organization content: while the organization uses GrowTroop. When the organization is closed, or when its owner asks, it is deleted within 30 days.
• Pictures in Recently deleted: 30 days, then removed for good.
• Publication records: while the organization exists, because they are its record of what was published.
• Data received from connected networks: until the channel is disconnected or deletion is requested. On a deletion request, it is deleted within 7 days.
• Invoices and financial records: 7 years, as Dutch tax law requires.
• Email correspondence with us: up to 2 years after the last contact, unless it becomes part of a customer relationship.
• Security logs: as long as needed to protect the service and investigate incidents.
• Website analytics: as described in the Cookie policy.
• Backups: deleted data can remain in backups until those backups expire on their regular schedule. Backups are kept secure and used only to restore the service.

We may keep specific data longer when we need it to establish, exercise or defend a legal claim, and only for as long as that need lasts.

We protect personal data with technical and organizational measures suited to the risk, including:

• encryption of data in transit;
• passwords stored only in hashed form;
• multi-factor authentication, available for every account;
• strict separation between organizations, so one organization cannot see another's data;
• staff access limited to the people who need it, and only to what they need;
• monitoring for misuse and security events;
• regular backups.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we notify the Dutch Data Protection Authority within 72 hours of becoming aware of it, and we tell the people affected without undue delay when the risk to them is high. Where we act for a customer organization, we inform that organization without undue delay so it can meet its own duties.

If you find a security problem in GrowTroop, please tell us at [email protected].

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased;
• restrict how we process it;
• receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another company where that is technically possible;
• object to processing based on our legitimate interests, and object at any time, without giving a reason, to the use of your data for direct marketing;
• withdraw your consent at any time, without affecting processing that took place before you withdrew it.

To use a right, email [email protected]. It is free. We answer within one month. For complex or numerous requests we may extend that by two further months, and if we do, we tell you why within the first month. We may ask you to confirm your identity before we act, so that we never hand your data to someone else.

Some rights have limits. For example, we cannot erase invoices that the law requires us to keep. When a limit applies, we explain it.

If your data is part of content a customer organization manages, send your request to that organization. We help it respond.

You can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at https://autoriteitpersoonsgegevens.nl, or to the data protection authority in the EU country where you live or work. We would appreciate the chance to solve the problem with you first.

You can ask us at any time to delete your account, your organization or the data we received from a connected network. Here is how:

• Email [email protected] from the email address of your GrowTroop account. Use the subject ‘Delete my account’ to delete your own account, or ‘Delete my organization’ if you own an organization and want the whole organization and its content deleted.
• We confirm that we received your request. We may ask you to confirm that the request really comes from you.
• We delete the account or organization within 30 days. Data we received from connected networks, including YouTube, is deleted within 7 days.
• We email you when the deletion is complete.

Deleting an organization removes its members' access, brand material, media, generated content, chats, schedules, publication records and connected-network tokens. Deleting your own account removes your profile and sign-in details. Content you created inside an organization belongs to that organization and stays with it unless its owner deletes it. If you own an organization, we first agree with you whether to delete it or transfer it to another member.

We keep only what the law or a legal claim requires: invoices and financial records for 7 years, and records needed to establish, exercise or defend legal claims. Deleted data can remain in backups until they expire on their regular schedule.

To stop publishing to a single channel, disconnect it in your organization's settings in GrowTroop. To also revoke GrowTroop's access on the network's side:

• Facebook, and Instagram accounts connected through Facebook: in Facebook, open Settings and privacy, then Settings, then Apps and websites, and remove GrowTroop.
• Instagram accounts connected directly: in Instagram, open Settings and activity, then Website permissions, then Apps and websites, and remove GrowTroop.
• YouTube and Google: remove GrowTroop at https://security.google.com/settings/security/permissions.
• LinkedIn, TikTok and X: remove GrowTroop from the connected or authorized apps in that network's settings.

Revoking access on a network stops any new access, but it does not by itself erase what we already hold. To have that data deleted as well, email [email protected].

We send the service emails your account needs, such as sign-in and security messages, invitations, billing notices and important changes to the service or to these documents. You cannot opt out of these while you have an account, because the service cannot run safely without them.

We send marketing emails, such as product news and offers, only if you agreed to receive them or, if you are a customer, about our own similar products and services as Dutch law allows. Every marketing email has an unsubscribe link, and you can also unsubscribe by writing to [email protected]. Legal basis: your consent (Article 6(1)(a)) or our legitimate interest in telling customers about similar services (Article 6(1)(f)).

GrowTroop is a service for businesses and is not directed at children. Our Terms of service require users to be at least 18 years old. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to [email protected] and we will delete it.

We update this policy when our service or the law changes, and the date at the top always shows the current version. When a change materially affects how we process personal data, we tell organization owners by email or in the app at least 30 days before it takes effect, unless the law requires the change sooner.

If this policy is ever offered in another language, the English version prevails.

• Privacy questions, requests about your data and requests to delete your account: [email protected].
• Abuse of the service, illegal content and reports about published material: [email protected].
• Sales questions: [email protected].

If you are not satisfied with our answer, you can complain to the Autoriteit Persoonsgegevens or to the data protection authority where you live or work, as described in Your rights.