Privacy Policy

Information we collect

• Account information such as your name, email address, authentication status, and account preferences.
• Purchase and billing records, including product purchased, subscription status, payment status, refund status, and Stripe customer or checkout identifiers. We do not store full card numbers.
• Product usage information such as submitted URLs, SEO audit requests, generated reports, tool activity, visitor identifiers, device information, IP address, and event logs.
• Support and communication information, including messages you send us and transactional email delivery data.
• Standard server request logs record the request path, the time, and your IP address. We use them for security and abuse prevention.

Contact information found on public web pages

Our SEO audit tool analyzes web pages that a user submits. While analyzing a page's public content, the tool may automatically detect and extract contact details published on that page, such as business and personal email addresses and telephone numbers, together with the associated domain and the web address (source URL) where each was found. This information comes from publicly accessible sources, the public web pages themselves, and not from you directly.

We process this data to produce SEO and contact-discovery reports for the user who requested the audit, and to operate and improve that tool. Our legal basis is our legitimate interests and those of our users under Article 6(1)(f) of the GDPR / UK GDPR, specifically providing SEO diagnostics and lawful business contact-discovery, balanced against the rights and freedoms of the individuals concerned. Reports are shown to the user who ran the audit, and publicly shareable report links are automatically stripped of personal emails and phone numbers before publication. We keep harvested contact data only as long as needed to deliver and support the report and to operate and improve that tool, and we delete it on request or when it is no longer needed for those purposes.

If your contact details were collected this way, you have the right to object to this processing and to ask us to remove them. Because we rely on legitimate interests, you can object at any time on grounds relating to your particular situation, and we will stop processing your data unless we can show compelling legitimate grounds that override your interests. To object or request removal, email support@growthvector.io with the email address or phone number you want removed. We will suppress it from future analysis, delete existing copies, and confirm when done. You do not need an account.

How we use information

• Provide the website, tools, digital products, account features, Pro access, and customer support.
• Process payments, refunds, subscriptions, checkout recovery, disputes, and billing events through Stripe.
• Authenticate users, protect accounts, prevent abuse, troubleshoot errors, and maintain service reliability.
• Apply usage limits to GrowthVector tools and MCP. Each limit counts by account ID or by a keyed hash of your IP address, not the raw address.
• Send transactional messages such as account, purchase, subscription, and security notices through SendGrid.
• Understand product performance and improve GrowthVector content, tools, and user experience.

Legal basis for processing (EU/UK)

For visitors in the EU, UK, and other regions with similar laws, we rely on the following legal bases under the GDPR / UK GDPR to process personal information:

• Consent (Art. 6(1)(a)): for analytics cookies and Google Analytics in the EU, UK, and other regions that require prior consent. In those regions, Google Analytics runs in a limited, cookieless mode (no analytics cookies or client identifiers) until you accept, and you can withdraw consent at any time using the “Cookie Settings” link in the footer. Withdrawal does not affect processing carried out before you withdrew.
• Performance of a contract (Art. 6(1)(b)): to create and operate your account, provide the tools, digital products, and Pro access you request, and process your purchases and subscriptions.
• Legitimate interests (Art. 6(1)(f)): to secure accounts, prevent fraud and abuse, maintain and troubleshoot the service, and improve our content and tools, balanced against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): to keep tax, accounting, and transaction records and to respond to lawful requests.

Service providers

We use trusted service providers to operate GrowthVector. Supabase supports account, database, and authentication infrastructure. Google Cloud supports hosting, application infrastructure, security, logs, and deployment. Stripe processes checkout, payments, subscriptions, refunds, invoices, and billing events. SendGrid sends transactional email. Google Analytics provides aggregate product and traffic analytics.

OpenRouter provides embedding services for site search and MCP knowledge search. When you search, GrowthVector may send your search text to OpenRouter or another embedding provider, such as Cloudflare, DeepInfra, or Hugging Face, to create the search vector. A search already in our cache is not sent again.

These providers process information for the purposes described in this policy and under their own security, privacy, and compliance controls.

Sharing and sale

We do not sell personal information. We also do not share personal information for cross-context behavioral advertising.

We may share information with service providers, when required by law, to protect GrowthVector or users, during a business transfer, or with your direction or consent.

Cookies and local storage

We use cookies, local storage, and similar technologies for authentication, sessions, security, preferences, checkout recovery, and basic product operation.

We also use Google Analytics 4 to understand aggregate product and traffic performance and to improve GrowthVector. Where you live in a region that requires prior consent (such as the EU, UK, or Switzerland), it runs in a limited, cookieless mode until you accept analytics cookies. Elsewhere, it sets analytics cookies and processes data such as pageviews, events, approximate location, IP address, and device and visitor identifiers. We do not use this data for cross-context behavioral advertising.

You can opt out of analytics at any time using the “Cookie Settings” link in the footer, by enabling the Global Privacy Control (GPC) signal in your browser, which we honor and which disables analytics, or by blocking or clearing cookies in your browser settings.

International data transfers

GrowthVector is operated from the United States, and our service providers (including Google, Stripe, Supabase, SendGrid, and Google Cloud) may process personal information in the United States and other countries.

Where information is transferred from the EU or UK to the United States, we rely on the EU-US Data Privacy Framework, and its UK Extension, for providers that are certified under it (Google LLC is certified), and on the European Commission's Standard Contractual Clauses or equivalent safeguards for any provider that is not. You can ask us for more detail about the safeguards that apply to a specific transfer.

How long we keep information

We keep personal information only as long as needed for the purposes described in this policy. Account information is kept while your account is active and for a reasonable period afterward. Purchase, billing, and tax records are kept for the period required by law, generally up to six to ten years depending on jurisdiction. Analytics data is retained according to the data-retention window set in Google Analytics. Support messages are kept as long as needed to handle your request and our records.

A cache of search embeddings keeps a hash of each search, not the search text, for 30 days. Data Extraction results from MCP are kept for 7 days. After that, they can no longer be read. We delete them when the next extraction starts.

When information is no longer needed, we delete or anonymize it, unless a longer period is required for security, legal compliance, accounting, dispute handling, or fraud prevention.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal information, to receive a copy in a portable format, and to withdraw consent where processing is based on consent. To withdraw consent for analytics at any time, use the “Cookie Settings” link in the footer or enable the Global Privacy Control (GPC) signal in your browser, which we honor and which disables analytics. You can also unsubscribe from non-transactional messages if we send them.

You have the right to lodge a complaint with a data protection supervisory authority. In the EU, this is your local Data Protection Authority; in the UK, it is the Information Commissioner's Office (ICO). We would appreciate the chance to address your concern first, so please consider contacting us before you do.

California residents may exercise the rights to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising, and we honor the Global Privacy Control signal as an opt-out. To exercise any right, contact support@growthvector.io.

Contact

For privacy requests or questions, contact support@growthvector.io