Privacy Policy

Version 2.0 · Effective October 2, 2026 · Last updated October 2, 2026

This Privacy Policy explains how Shopinzip Inc, a New Jersey corporation ("we," "us"), collects, uses, shares and protects personal information through GrowingWhale (the "Service"). Our address is 222 Highview Drive, Clifton, NJ 07013, USA. For privacy questions, email privacy@growingwhale.com.

1. Scope and our role

This policy covers growingwhale.ai, our website for the Service, and its subdomains, including studio.growingwhale.ai and mcp.growingwhale.ai; growingwhale.app, where Member websites are hosted; any other domain we operate that redirects to them; and our apps, APIs and MCP server.

• We are the controller for information about our account holders ("Members"), the people they authorize ("Users"), visitors to our own websites, and prospects who contact us.
• Members are the controller for personal data they collect about their own customers, leads, site visitors and message recipients ("End Users"). We process it as their processor or service provider under our Data Processing Addendum. Section 18 explains what this means for End Users.
• Our affiliate Shopinzip Pvt Ltd (India) helps us build, support and operate the Service under an intra-group data agreement.

2. Information we collect

Sensitive information. We don't seek sensitive personal information. You must not upload protected health information, payment card or bank account numbers, government ID numbers, biometric data, precise geolocation, or data from children under 13, unless a feature expressly supports it. If such data is uploaded, the Member who uploaded it is responsible for it, and we delete it when we learn of it where we can.

3. How we use information

• Provide, operate, maintain and secure the Service
• Authenticate users and prevent fraud, abuse, spam and security incidents
• Process payments and subscriptions
• Perform actions you request in connected apps, such as publishing a post, replying to a review or syncing leads
• Provide support and send service, billing, security and legal notices
• Market GrowingWhale to Members and prospects where permitted, including by email and, with consent, by text
• Measure and target our own advertising on other sites, as described in Section 4
• Analyze usage in aggregated or de-identified form to improve the Service
• Comply with legal obligations and enforce our Terms

Automated decisions. We don't make decisions based solely on automated processing that produce legal or similarly significant effects on you. We use automated tools to detect fraud, spam and abuse; a flagged account is reviewed by a person before it is closed.

4. Selling, sharing and advertising

We don't sell personal information for money.

Advertising on our own websites. Our marketing websites (not the Studio app, not Member sites) use advertising tags from Meta and Google to measure and target ads for GrowingWhale. These tags collect identifiers such as cookie IDs and IP address, and the pages you visit. Under California law this may be "sharing" for cross-context behavioral advertising, and under New Jersey and other state laws it is "targeted advertising." These tags never receive Member Data, End-User data, or data we receive from Google, Meta or other connected-account APIs.

Your choices.

• Use the Your Privacy Choices link in our website footer to turn off advertising tags.
• We honor Global Privacy Control (GPC) signals from every US visitor as an opt-out of advertising tags on that browser.
• Account-level opt-out requests sent to privacy@growingwhale.com are processed within 15 days.
• Do Not Track. Browsers' Do Not Track signals have no agreed standard, so we don't respond to them. We do honor GPC.

Who we disclose information to.

• Service providers and subprocessors that host, process or support the Service under contracts requiring confidentiality and security (see the subprocessor list in the DPA).
• Our affiliate, Shopinzip Pvt Ltd, to build, support and operate the Service.
• Third-Party Services you connect, at your direction.
• Advertising partners (Meta, Google), only through the tags described above.
• Professional advisers (lawyers, auditors, insurers), under confidentiality.
• Authorities and others, when required by law or to protect rights, safety and security.
• Business transfers, in a merger, acquisition, financing or sale of assets, with notice to you and subject to this policy.
• Anyone else with your consent.

By category (US state notice).

We don't use sensitive personal information to infer characteristics about you.

5. Legal bases (EEA, UK and Switzerland)

6. Google user data

This section applies when you sign in with Google or connect Google services.

Scopes we request. We request only the scopes needed for the features you turn on.

We request each scope only when you turn on the feature that needs it, and some of these features may not be available yet. Before requesting any scope not listed here, we update this table and ask for your consent. Data from restricted scopes, such as Gmail, is handled under the additional security requirements Google sets for them.

How we use Google user data. Only to provide and improve the user-facing features you requested, such as signing you in, showing your business locations, publishing posts or review replies you approve, syncing appointments, and displaying insights.

Google data and AI. When you use an AI Feature on Google data, such as drafting a review reply, we send only the data that feature needs (for example, the review text and your business name) to our AI provider, Anthropic, under terms that prohibit using it for training. We never send Google user data to AI providers for any other purpose. If you connect an AI client through our MCP server and ask it about data in your workspace, Google-derived data may be returned to that AI client at your request, where its provider handles it under its own terms.

Limited Use disclosure. GrowingWhale's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• do not transfer Google user data to others except as necessary to provide or improve user-facing features, for security, to comply with law, or as part of a merger or acquisition with notice to you;
• do not use or transfer Google user data for serving advertisements, including retargeting or personalized ads;
• do not sell Google user data, or use it to determine creditworthiness or for lending;
• do not allow humans to read Google user data except with your affirmative consent for specific data, for security purposes, to comply with law, or when aggregated and anonymized for internal operations;
• do not use Google user data to develop, improve or train generalized or non-personalized AI or ML models.

Storage and protection. We use safeguards designed to protect OAuth tokens, including encryption, and restrict access to authorized systems and personnel.

Revoking access. You can revoke access anytime at myaccount.google.com/permissions or by disconnecting Google in GrowingWhale settings. We then delete the tokens and cached Google data within 30 days, except data you chose to keep in your own records, such as an appointment you created.

Team members and clients. When a Member invites team members or clients to connect their own Google accounts, each person authorizes their own account, and we act only within the scopes that person grants.

7. Meta user data (Facebook, Instagram, WhatsApp)

Permissions we request. We request only the permissions needed for the features you turn on.

We request each permission only when you turn on the feature that needs it.

Custom Audiences. If you upload a customer list to build a Meta audience, you instruct us to send it to Meta for that purpose only. You must have the right and any consent needed to do so, and Meta's Custom Audiences Terms apply.

Use. We use Meta Platform Data only to provide the features you use.

Restrictions. We comply with the Meta Platform Terms and Developer Policies. We don't sell Meta Platform Data; don't use it for surveillance, discrimination or eligibility decisions; don't build profiles outside the Service; don't transfer it to data brokers or ad networks; and don't use it to train generalized AI models.

Retention and deletion. We keep Meta Platform Data only while your Meta account is connected and only as long as needed for the feature. We delete it within 30 days of disconnection, a deletion request, or a request from Meta. See the Data Deletion Instructions.

8. Other connected accounts

When you connect any other account, such as Microsoft Outlook (once available), Zoho, HubSpot, Shopify or Slack, the same rules apply as for Google and Meta: we request only the access the feature needs, use the data only to provide that feature, don't use it for advertising, don't sell it, and don't use it to train generalized AI models. Revoke access in that service's connected-apps settings or in GrowingWhale settings; we delete the tokens and cached data within 30 days. Before launching a new integration, we add its details to this section when its provider requires it.

9. Payments (Stripe)

Stripe processes payments for GrowingWhale subscriptions. Stripe collects card and bank details directly and may use them for fraud prevention under the Stripe Privacy Policy. We receive only limited billing information: name, email, card brand, last four digits, expiry, country and payment status. If a Member accepts payments from its own customers through Stripe, Stripe and that Member are responsible for those customers' payment data.

10. AI features and our MCP server

• AI Features are powered by third-party models, including Anthropic's Claude and other AI model providers we may use from time to time, named in our subprocessor list.
• When you use them, the relevant prompt and the account context the feature needs are sent to the AI provider to generate a response.
• Our AI providers' terms prohibit training their models on these inputs and outputs. They may keep them for a limited period to monitor for abuse, then delete them.
• Our MCP server (mcp.growingwhale.ai) lets you connect Claude or another MCP-compatible AI client to your workspace through OAuth with scoped permissions. We log the client name, scopes, tool calls and timestamps to run and secure it (Section 13). Revoke access anytime in GrowingWhale settings or in your AI client.
• AI clients you connect are run by their providers under their own privacy policies; we don't control how they store conversations.
• GrowingWhale is not affiliated with or endorsed by Anthropic.

11. Automations and connectors

• Workflows may run on n8n infrastructure hosted by us or our providers. They move data between GrowingWhale and apps you choose, such as CRMs, email and messaging tools, spreadsheets, storage and webhooks.
• We process data in workflows only to run the automations you configure or approve. We use safeguards designed to protect credentials, including encryption, and keep them separate for each Member.
• If you connect your own n8n instance, AI keys, API keys or webhooks, data sent there is governed by your setup and that provider's terms.

12. Text messages and marketing communications

• Our texts to you. We text Members and prospects only with consent. Message frequency varies; message and data rates may apply. Reply STOP to opt out or HELP for help.
• No sharing of mobile data. We do not share or sell mobile phone numbers or text-message opt-in data with third parties or affiliates for their marketing. We share them only with service providers that help us deliver messages.
• Email. Every marketing email has an unsubscribe link. Service, billing and security emails are part of the Service and can't be turned off while your account is active.
• Messages Members send. Texts, calls and emails a Member sends to its End Users through GrowingWhale are governed by that Member's privacy policy.

13. Retention

We may keep de-identified or aggregated data, and data needed for legal claims, legal holds or compliance.

14. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete or port your personal information; restrict or object to processing; withdraw consent; opt out of targeted advertising, sale or profiling; and appeal our decision on your request.

United States. We extend these rights to residents of every US state, including California, New Jersey, Virginia, Colorado, Connecticut, Texas and Oregon. We don't discriminate against you for using them.

How to make a request.

1. Email privacy@growingwhale.com with the subject "Privacy Request".
2. We verify your identity by confirming control of your account email, and may ask for more information if the request concerns sensitive data.
3. We respond within 45 days (30 days for EEA and UK requests), and may extend once where the law allows, telling you why.
4. An authorized agent must provide your signed permission, and we may ask you to confirm your identity directly.

Appeals. If we deny your request, you may appeal within 60 days by emailing privacy@growingwhale.com with the subject "Privacy Appeal." We respond within 45 days and explain our reasons. If you're not satisfied, you may contact your state Attorney General.

EEA, UK and Switzerland. We don't currently direct the Service to people in the EEA, UK or Switzerland. If the GDPR, UK GDPR or Swiss law applies to our processing of your data, you have the rights listed above and may complain to your data protection authority. Contact privacy@growingwhale.com.

India. Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, you may access a summary of your data, correct, complete, update or erase it, withdraw consent as easily as you gave it (in settings, by unsubscribing, or by email), nominate someone to exercise your rights, and seek grievance redressal. Our Grievance Officer is Area, Founder, Shopinzip Inc, 222 Highview Drive, Clifton, NJ 07013, USA, privacy@growingwhale.com. We respond within the period the DPDP Rules set. If you're not satisfied, you may complain to the Data Protection Board of India.

15. International transfers

We are based in the US. Our affiliate and providers process data in the US, India, the EU and other countries listed in the DPA. For transfers from the EEA, UK and Switzerland, we use the EU Standard Contractual Clauses, with the UK Addendum and Swiss adjustments, including in our intra-group agreement with Shopinzip Pvt Ltd.

16. Security and breaches

We use administrative, technical and physical safeguards, described on our Security page. No system is completely secure, and we can't guarantee information will never be accessed, disclosed, altered or destroyed. You are responsible for securing your credentials and devices. If a security incident affects your personal information, we notify you and regulators as required by law, including N.J.S.A. 56:8-163, without unreasonable delay.

17. Children

The Service is for businesses and is not directed to anyone under 18. We don't knowingly collect their data. If you believe we have, contact privacy@growingwhale.com and we will delete it. Members must not direct their GrowingWhale sites to children under 13.

18. If a business that uses GrowingWhale has your data

If you're a customer, lead or visitor of a business that uses GrowingWhale, that business controls your data and its privacy policy applies. Please contact it first. If you contact us, we forward your request to the business within 10 days. If you can't tell which business holds your data, email privacy@growingwhale.com and we will help.

When a business uses our chat, AI chat, call tracking, forms or pixels on its website, we process the data only as that business's service provider, to provide those tools to it. We don't use it for our own advertising, don't sell it, and don't combine it with other businesses' data except in de-identified form to secure and operate the Service.

19. Changes

We post updates here and change the "Last updated" date. For material changes, we notify Members by email or in the app before they take effect. Where the law or a platform requires consent (for example, before we access a new type of Google user data), we ask for it first.

20. Contact

Shopinzip Inc · 222 Highview Drive, Clifton, NJ 07013, USA · privacy@growingwhale.com