Privacy Notice

Who we are

Growx Era is the controller of the personal data described here. Contact us about privacy at hello@growxera.com.

What we collect

• Diagnostic answers: information about your business (model, market, revenue ranges, metrics). This describes the business, not you personally, and you can answer “I don't know” to any metric.
• Contact details you choose to give us: name, work email, company, and optionally phone/WhatsApp, job title and company website.
• Your account: if you create one or open the link in your report email, we keep your name, email, company, optional profile details, your saved diagnostics, and a record of sign-in links and sessions (stored as one-way hashes, never the link itself).
• Advisor requests: questions you send and review calls you book, with the time, your message and a reference to your report.
• Uploaded files: an orders export you upload is read in your browser and never sent to us. We receive only the figures you choose to use and a short summary (file name, row count, date range and column names).
• Attribution: the campaign parameters (UTM), referring site and landing page of your visit, stored in your browser and sent only with a diagnostic or form you submit.
• Analytics, only if you accept them: pseudonymous usage events (for example, which diagnostic step was completed) linked to a random identifier, and Google Analytics 4, which sets its own cookies and is provided by Google. We do not store your IP address with our own events and we do not use advertising cookies.

Why we use it, and on what basis

• To generate your diagnostic result: you request it by completing the diagnostic.
• To store your details, prepare your full report, email you a copy of it and contact you about it: based on your explicit consent, given on the form. Consent is recorded with the wording and policy version you agreed to.
• To keep your account, save your reports and show your progress over time: based on your consent when you create the account or open your report link.
• To answer your questions and hold the review calls you book, including reading your report beforehand: based on your request and consent.
• To send growth insights by email or WhatsApp: only if you separately opt in. You can opt out at any time.
• To understand and improve the diagnostic: only if you accept analytics.

We do not sell personal data, and we do not use your data for automated decisions with legal effect. The Growth Score is an indicative, preliminary estimate.

Who processes it

• Vercel Inc. (website hosting, and cookieless, aggregated visit statistics).
• Supabase Inc. (database), hosted in the United States (us-east-1) region.
• Resend (sending your report, sign-in links and booking emails).
• Google LLC (Google Analytics 4), only if you accept analytics.

Some of these providers may process data outside the Kingdom of Saudi Arabia. Where that happens we rely on the transfer conditions permitted under the PDPL and its Regulations on Personal Data Transfer Outside the Kingdom, and on contractual safeguards with each provider.

How long we keep it

• Diagnostics not linked to contact details: 180 days.
• Contact details and linked diagnostics: up to 2 years after our last interaction, unless you ask us to delete them sooner.
• Accounts and saved diagnostics: while your account is active, until you delete them or ask us to.
• Sign-in links: deleted a day after they expire. Sessions: deleted when they expire or you log out.
• Analytics events: 395 days.

Your rights

You can ask to be informed about how we process your data, to access or obtain a copy of it, to correct it, to have it deleted, and to withdraw your consent at any time (this does not affect processing already carried out). Email hello@growxera.com and we will reply within the period the law requires. You can also file a complaint with the Saudi Data & AI Authority (SDAIA) or your local data protection authority.

Delete it yourself. If you have an account, go to My account → My profile → Delete your data. It takes two steps: choose whether to delete your saved data (diagnostics, reports, progress history and advisor requests) or your whole account, then type DELETE to confirm. Deletion is immediate and permanent, and we email you a receipt. Without an account, email hello@growxera.com and we will delete it.

Cookies and browser storage

We use browser storage for essential functions: remembering your privacy choice, keeping your diagnostic progress while you complete it, and holding campaign attribution until you submit a form. When you log in we set two essential cookies: a secure session cookie that keeps you signed in for up to 30 days, and a cookie that only tells the menu to show “My account”. Analytics storage, including Google Analytics cookies, is used only after you accept it. You can change your choice at any time from “Privacy settings” in the footer.

Security

Data is encrypted in transit and stored in a database that is only accessible from our servers. There are no passwords to leak: you sign in with one-time links that expire after 20 minutes (48 hours for the link in your report email) and work only once. Access is limited to the Growx Era team members who need it.

Changes

We will update the version above when this notice changes, and ask for consent again where the change requires it.