Privacy Policy

This Privacy Policy explains how Growlift (“Growlift,” “we,” “us,” or “our”) collects, uses, shares, protects, and deletes information when you visit growlift.io or use the Growlift SEO automation service (the “Service”). By using the Service, you acknowledge the practices described here.

1. Information we collect

Information you provide

• Account details, such as your name, email address, organization, and workspace role.
• Website, brand, audience, content, and publishing information you submit.
• Support messages, survey responses, and other communications with us.
• Billing contact and subscription information. Stripe processes payment-card details; Growlift does not store complete card numbers.

Information collected through the Service

• Website crawl data, page content, technical metadata, links, search keywords, and publishing results needed to analyze and improve your connected website.
• Product usage and diagnostic information, such as features used, browser and device information, approximate location derived from IP address, and error logs.
• Cookies and similar technologies used for authentication, security, preferences, and, where you consent, product analytics. See the cookie controls presented on our site.

2. Google user data

If you connect Google Search Console, Google asks you to authorize read-only access. We receive an OAuth refresh token, the Search Console properties available to your Google account, and Search Console performance data for the property you connect. This may include search queries, pages, countries, devices, dates, clicks, impressions, click-through rate, and average search position. Growlift does not request permission to change your Search Console property or Google Account.

We use Google user data only to provide user-facing features that you request, including:

• showing your website’s search performance and changes over time;
• identifying pages and queries that may benefit from SEO work;
• prioritizing, measuring, and adapting Growlift recommendations and actions; and
• producing reports and alerts for your connected workspace.

We do not sell Google user data, use it for advertising, use it to determine creditworthiness, or allow people to read it unless needed to provide support or protect the Service and only with appropriate access controls. We do not transfer Google user data to third parties except service providers acting on our behalf, when you direct us to do so, as part of a business transfer subject to this Policy, or when required for security or by law. Service providers may process only the data needed to perform their contracted function and may not use it for their own purposes.

Growlift’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use information

• Provide, operate, secure, troubleshoot, and improve the Service.
• Authenticate users and enforce workspace permissions.
• Analyze websites, generate recommendations and content, and perform approved actions.
• Process subscriptions and send service, security, billing, and support communications.
• Prevent fraud, abuse, and violations of our Terms of Service.
• Meet legal obligations and establish, exercise, or defend legal claims.

Where applicable, our legal bases include performing our contract with you, your consent, compliance with law, and our legitimate interests in operating and securing the Service.

4. How we share information

We share information only as needed with:

• Service providers. Hosting, database, authentication, billing, email, analytics, error monitoring, search-data, and AI infrastructure providers listed on our sub-processor page.
• Your workspace. Other authorized members can access workspace data according to their role.
• Legal and safety recipients. Authorities or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or enforce agreements.
• Business transaction recipients. Parties to a merger, financing, acquisition, reorganization, or sale, subject to confidentiality and this Policy.

We do not sell or rent personal information.

5. AI processing

Growlift may send prompts derived from your website, keywords, and instructions to model providers through Vercel AI Gateway to generate and review content. We minimize the data sent and do not intentionally send Google OAuth tokens or payment credentials to model providers. See our AI Disclosure and sub-processor list.

6. Security

We use safeguards appropriate to the nature of the data, including encryption in transit, encryption of integration credentials at rest, role-based access controls, workspace isolation, audit logging, secret management, and monitoring. No system is completely secure, so we cannot guarantee absolute security. See our Security Overview.

7. Retention and deletion

We keep information only as long as needed to provide the Service, meet legal obligations, resolve disputes, and enforce agreements. Search Console metrics are retained according to the published window in our Data Retention Policy. OAuth tokens are retained while the integration remains connected and are deleted or made unusable when the integration or workspace is deleted, subject to short-lived encrypted backup retention.

You can disconnect Search Console in Growlift, revoke Growlift in your Google Account connections, or request deletion at privacy@growlift.com. You can delete your workspace from the Service; after the displayed recovery period, its data is permanently deleted under our retention schedule.

8. Your choices and privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or export personal information; object to or withdraw consent for certain processing; and complain to a data-protection authority. To exercise a right, email privacy@growlift.com. We may verify your identity and authority before acting on a request. You may also manage cookies through our consent controls and browser settings.

9. International transfers

Growlift and its providers may process information in Canada, the United States, and other countries. Where required, we use recognized safeguards such as contractual protections for international transfers. Business customers may request our Data Processing Addendum.

10. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information to us.

11. Changes to this Policy

We may update this Policy as the Service or law changes. We will post the updated version and effective date here and provide additional notice when a change materially affects your rights.

12. Contact

Questions, requests, or complaints may be sent to privacy@growlift.com. For product support, email support@growlift.com.