Privacy Policy

Effective: September 23, 2026

This Privacy Policy explains how Shopinzip Inc ("we," "us"), operator of GrowingWhale (the "Service"), collects, uses, shares and protects personal information. Our address is 222 Highview Drive, Clifton, NJ 07013, USA, and our contact email is hello@growingwhale.com.

1. Who this covers and our role

• Members and visitors. For information about our account holders ("Members"), their team users and website visitors, we are the controller.
• Member customer data. For personal data that Members collect about their own customers, leads and audiences through the Service, the Member is the controller and we act as a processor/service provider under our Data Processing Addendum. Questions about that data should go to the relevant Member.

2. Information we collect

We do not knowingly collect sensitive personal information (e.g. health, biometric, precise geolocation, government IDs). You must not upload it unless a feature explicitly supports it.

3. How we use information

• Provide, operate, maintain and secure the Service
• Authenticate users and prevent fraud, abuse and security incidents
• Process payments and subscriptions
• Perform the actions you request in connected apps (e.g. publish a post, reply to a review, sync leads)
• Provide customer support and send service, billing and security notices
• Send marketing about GrowingWhale, only where permitted. You can opt out anytime.
• Analyze usage in aggregated or de-identified form to improve the Service
• Comply with legal obligations and enforce our Terms

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.

4. Legal bases (EEA/UK users)

We rely on the following legal bases:

• contract, to provide the Service
• legitimate interests, for security, improvement and B2B marketing
• consent, for non-essential cookies and certain marketing, which you can withdraw anytime
• legal obligation

5. How we share information

We share information only with:

• Service providers / subprocessors that host, process or support the Service under contracts requiring confidentiality and security. See the Subprocessor List.
• Third-Party Services you connect, at your direction.
• Professional advisers (lawyers, auditors), under confidentiality.
• Authorities, when required by law or to protect rights, safety and security.
• Business transfers, meaning a merger, acquisition, financing or sale of assets, subject to this Policy.
• With your consent.

6. Google user data (Google Sign-In, Google APIs and Google Business Profile)

Scopes. When you sign in with Google or connect Google services, we request only the scopes needed for the features you enable. These may include:

• basic profile and email (sign-in)
• Google Business Profile management, for locations, posts, reviews, replies and insights
• (future) Google Ads, Analytics or Search Console

Use. We use Google user data only to provide and improve the user-facing features you requested. Examples:

• signing you in
• showing your business locations
• publishing posts or review replies you approve
• displaying performance insights

Limited Use disclosure. GrowingWhale's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• do not transfer Google user data to others except as necessary to provide or improve user-facing features, for security, to comply with law, or as part of a merger/acquisition with notice
• do not use or transfer Google user data for serving advertisements, including retargeting or personalized ads
• do not sell Google user data, or use it to determine creditworthiness or for lending
• do not allow humans to read Google user data except:
  • with your affirmative consent for specific data
  • for security purposes
  • to comply with law
  • when aggregated and anonymized for internal operations
• do not use Google user data to develop, improve or train generalized/non-personalized AI or ML models

Storage and protection. OAuth tokens are encrypted at rest (AES-256) and in transit (TLS 1.2+). Access is restricted to authorized systems and personnel.

Revoking access. You can revoke access anytime at myaccount.google.com/permissions or by disconnecting in GrowingWhale settings. We then delete associated tokens and cached Google data within 30 days, except data you asked us to keep as part of your own records.

Future team members. When a Member invites team members or clients to connect their own Google Business Profiles, each person authorizes their own account. We act only within the scopes that person grants.

7. Meta user data (Facebook, Instagram, WhatsApp)

Permissions. When you connect Meta assets, we request permissions such as:

• pages_show_list, pages_manage_posts, pages_read_engagement, pages_manage_metadata
• instagram_basic, instagram_content_publish, instagram_manage_comments
• business_management, ads_read
• WhatsApp Business messaging permissions

We request only those needed for the features you enable.

Use. We use Meta Platform Data only to provide the features you use, for example:

• publishing and scheduling posts
• reading comments and messages to show in your inbox
• showing page and ad insights
• capturing leads you are entitled to receive
• sending messages you initiate

Restrictions. We comply with the Meta Platform Terms and Developer Policies. We:

• do not sell Meta Platform Data
• do not use it for surveillance, discrimination or eligibility decisions
• do not use it to build user profiles outside the Service
• do not transfer it to data brokers or ad networks

Deletion. You can disconnect Meta at any time in settings or in your Facebook settings under Apps and Websites. For deletion requests, follow our Data Deletion Instructions. Meta data is deleted within 30 days of disconnection or request.

8. Payments (Stripe)

Stripe processes payments for GrowingWhale subscriptions. Stripe collects card and bank details directly and may use them for fraud prevention, under the Stripe Privacy Policy. We receive only limited billing information from Stripe: name, email, last four digits, card brand, expiry, country and payment status.

If a Member connects their own Stripe account to accept payments, Stripe and that Member are responsible for their customers' payment data.

9. AI features and Claude MCP

• The Service uses AI providers, including Anthropic (Claude), to power assistants, content generation and our Model Context Protocol (MCP) server (mcp.growingwhale.ai). The MCP server lets you connect Claude or other AI clients to your GrowingWhale account.
• When you use these features, relevant prompts and account context are sent to the AI provider to generate a response. We use provider plans under which customer inputs and outputs are not used to train their models.
• MCP access is authorized through OAuth with scoped permissions. You can revoke it anytime in GrowingWhale settings or in your AI client.
• AI clients you connect (e.g. Claude apps) are operated by their providers under their own privacy policies. We are not responsible for how they store conversations.
• See the AI & Integrations Terms.

10. Automations (n8n) and third-party connectors

• Workflows may run on n8n infrastructure hosted by us or our providers. They move data between GrowingWhale and apps you choose. Examples include:
  • CRMs such as Zoho or HubSpot
  • email and messaging tools
  • spreadsheets and storage
  • webhooks
• We process data in workflows only to execute the automations you configure or approve. Credentials are encrypted and scoped per Member, and workflow logs are retained only as described in Section 12.
• If you connect your own n8n instance, API keys or webhooks, data sent there is governed by your setup and that provider's terms. We are not responsible for it.

11. Security

We use administrative, technical and physical safeguards, including:

• encryption in transit (TLS 1.2+) and at rest
• encrypted secrets and token vaulting
• role-based, least-privilege access
• tenant data isolation
• multi-factor authentication for staff
• logging and monitoring
• vendor due diligence
• an incident response plan

No system is completely secure. We cannot guarantee that information will never be accessed, disclosed, altered or destroyed through a breach of our safeguards. You are responsible for securing your credentials and devices.

Breach notification. If a security incident affects your personal information, we will notify you and regulators as required by applicable law, including N.J.S.A. 56:8-163. We will do so without undue delay.

12. Retention

We may keep de-identified or aggregated data, and data required for legal claims or compliance.

13. Your privacy rights

Depending on where you live, you may have the right to:

• access your personal information
• correct it
• delete it
• port it
• restrict or object to processing
• withdraw consent
• opt out of targeted advertising, sale or profiling
• appeal a decision on your request

US state residents. This applies under the laws of California (CCPA/CPRA), New Jersey (NJDPA), Virginia, Colorado, Connecticut, Texas, Oregon and other states. We honor these rights and do not discriminate against you for exercising them. We honor Global Privacy Control signals as an opt-out where required.

EEA/UK residents. You have GDPR/UK GDPR rights and may complain to your supervisory authority. EU/UK Representative: [to be appointed].

India residents. You have rights under the Digital Personal Data Protection Act, 2023, including access, correction, erasure, grievance redressal and nomination. Grievance Officer: [to be appointed], reachable at hello@growingwhale.com.

How to exercise your rights:

1. Email hello@growingwhale.com with the subject "Privacy Request".
2. We will verify your identity and respond within 30 days (45 days where US law allows, extendable as permitted).
3. Authorized agents must provide proof of authority.

If your request concerns data a Member controls, we will forward it to that Member or direct you to them.

14. International transfers

We are based in the US, and our providers may process data in the US, India and other countries. Where required, we use appropriate safeguards such as Standard Contractual Clauses.

15. Children

The Service is not directed to individuals under 18. We do not knowingly collect their data. If you believe we have, contact us and we will delete it.

16. Changes

We will post updates here and change the "Last updated" date. For material changes, we will notify Members by email or in-app.

17. Contact

Shopinzip Inc · 222 Highview Drive, Clifton, NJ 07013, USA · hello@growingwhale.com