Privacy Policy

We collect information you provide directly, information collected automatically, and data from third-party services.

• Account information: name, email address, phone number, and profile details.
• Payment information: payment card details and billing address, processed securely by Stripe. We do not store full card numbers on our servers.
• Session data: coaching session bookings, messages, notes, and video session metadata.
• Usage data: pages visited, features used, device information, and IP address.
• Communications: emails, support tickets, and feedback you send us.

We use the information we collect to operate, improve, and protect our platform.

• Provide coaching services: matching you with coaches, scheduling sessions, and enabling communication.
• Process payments: billing, commission payouts to coaches, and fraud prevention.
• Improve the platform: analyzing usage patterns, fixing bugs, and developing new features.
• Communicate with you: sending booking confirmations, session reminders, and service updates.
• Ensure security: detecting and preventing unauthorized access or abuse.
• Legal compliance: meeting regulatory obligations and responding to lawful requests.

We process your personal data on the following legal bases:

• Contract: providing coaching services, scheduling, and payment processing — necessary to perform our agreement with you.
• Legitimate interest: platform improvement, security, and fraud prevention — balanced against your rights and expectations.
• Consent: marketing communications and non-essential cookies — you may withdraw consent at any time.
• Legal obligation: compliance with regulatory and tax requirements.

We take the security of your personal data seriously and employ industry-standard measures to protect it.

• Encryption: all data is encrypted in transit (TLS 1.3) and at rest using AES-256.
• Infrastructure: our backend runs on Supabase, which provides enterprise-grade security, automated backups, and SOC 2 compliance.
• Access controls: role-based access limits who can view sensitive data internally.
• Payment security: all payment processing is handled by Stripe, certified to PCI-DSS Level 1 standards.
• Retention: we retain account and session data for the duration of your active account plus 3 years thereafter, to meet contractual and legal obligations. Payment and accounting records are retained for 10 years, in line with Portuguese Commercial Code recordkeeping requirements. Data no longer needed is securely deleted or anonymized.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will inform affected users without undue delay where required by law.

We rely on trusted third-party providers to deliver our services. Each provider is vetted for security and privacy practices.

• Stripe — payment processing and billing.
• Daily.co — video calling infrastructure for coaching sessions.
• Lovable Cloud — backend database, authentication, and file storage.
• Pipecat — real-time audio/video pipeline management.
• Tavus — AI-powered video generation features (where applicable). Where these features process facial or voice data to generate video content, this may constitute biometric data under applicable law. We only process such data with your explicit, separately obtained consent, and you may withdraw this consent at any time without affecting other services.

These providers may process personal data on our behalf under strict data-processing agreements that comply with GDPR and other applicable regulations.

Some of our third-party service providers (including Stripe, Daily.co, Tavus, and Lovable Cloud) process data outside the European Economic Area, including in the United States. Where this occurs, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or an applicable adequacy decision to ensure your data receives an equivalent level of protection. You may request a copy of the relevant safeguards by contacting us at info@growo.me.

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: request that we delete your personal data, subject to legal obligations.
• Export: receive your data in a structured, machine-readable format.
• Objection: object to certain types of processing, such as direct marketing.
• Restriction: request limited processing in specific circumstances.

To exercise any of these rights, please contact us at info@growo.me. We will respond within 30 days.

Growo uses cookies and similar technologies to enhance your experience and analyze platform usage.

• Essential cookies: required for the platform to function (e.g., authentication, session management).
• Analytics cookies: help us understand how visitors interact with the site so we can improve it.
• Preference cookies: remember your settings and choices for a smoother experience.

You can manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect platform functionality.

Growo is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected such data, please contact us immediately at info@growo.me and we will promptly delete it.

This Privacy Policy and any disputes arising from it shall be governed by and construed in accordance with the laws of the Portuguese Republic. Any legal action shall be brought exclusively in the courts of Lisbon, Portugal.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us at info@growo.me. We aim to respond to all privacy-related inquiries within 48 hours.