What we collect, and why.

Growth Dept is the trading name of Holden Growth, LLC (“Growth Dept”, “we”, “us”). We run growthdept.ai, the Growth Dept Admin application at admin.growthdept.ai, and the AI growth department we install for each client brand. Questions about this policy, and requests to see or delete your data, go to hello@growthdept.ai.

• The public website at growthdept.ai.
• The Growth Dept Admin application, including the pages brands use to connect their accounts and the Growth Dept apps our staff sign in to it with.
• Data we receive from the Meta, Google and other business platforms a brand connects to us, and what our services do with it.

When we run services for a client brand, the brand decides what its accounts hold and who may see it, and we handle that data on the brand’s behalf under our written agreement with them.

• Website. Public pages do not require sign-in and the site runs no analytics or advertising trackers. Our hosting provider records standard request logs (IP address, browser, pages requested) to serve and secure the site.
• Online booking. We use the name, work email, mobile number, company, store URL, answers and time you submit to create a Google Calendar invitation and to follow up about the call. Kiki, our AI teammate, texts a confirmation and reminders to that mobile number; reply STOP to end them. If you open the booking page from a link in one of our emails, we record that the link was opened. Invited team members can connect Google accounts to manage availability. We keep their account details, selected calendar identifiers, working hours and a refresh token. Availability checks use free/busy times; visitors cannot see calendar event details.
• Sign-in. When you sign in to the Admin application with Google, we receive your email address and basic profile so we can recognise you. Sign-in stores no Google tokens.
• Calendars you link. When you link a Google account to the calendar feature, we receive the events on the calendars you select: titles, times, descriptions, locations, meeting links, organisers and attendees. We keep a refresh token for each linked account so the feature can keep working without asking you to sign in again.
• Staff Workspace connections. Growth Dept staff may connect a Google Workspace account for our own operations. Those connections use the Gmail, Calendar, Drive, Docs, Sheets, Slides, Contacts, Meet and Admin Directory access shown on Google’s consent screen at the time of consent.
• Business accounts a brand connects.A brand owner can connect the brand’s advertising, social, storefront, marketplace and email accounts through a private connection page. For each connection we receive an access token or API key, the name and account ID of the person who connected it, the accounts they selected, and the business data those accounts return, such as campaigns, spend and performance reports, products, orders and email results. Storefront and marketplace data can include the brand’s customer records; those stay in the brand’s own warehouse. Data from Meta is described in detail in the next section.

Brands connect Facebook and Instagram through Facebook Login on our connection page. The brand owner chooses which ad accounts, Facebook Pages and Instagram accounts to share, and we read only those. Our app asks for these permissions:

• ads_read and read_insights: read the selected ad accounts’ campaigns, ad sets, ads, creatives and performance reports, such as spend, reach, clicks and purchases, including the aggregated breakdowns Meta reports.
• ads_management: make the changes the brand approves to its own campaigns, such as budgets, bids, pausing or starting ads, and new ads built from the brand’s creative.
• business_management: list the ad accounts, Pages and Instagram accounts the brand’s business portfolio owns, so the owner can choose which ones to connect.
• pages_show_list and pages_read_engagement: list the owner’s Pages and read the selected Pages’ posts and their engagement.
• instagram_basic and instagram_manage_insights: read the selected Instagram business account’s profile, posts and insights.

We also receive the connecting person’s Facebook user ID and name. Post engagement can include comments, and a comment carries the public name of the person who wrote it.

How we use it.We use Meta data to report the brand’s ad and social performance to the brand, store it in the brand’s own warehouse, let the brand’s AI team analyse it and propose changes, and apply the changes the brand approves. Data from one brand’s accounts is used only for that brand.

What we never do with it.We do not sell or license Meta data or pass it to data brokers or ad networks. We do not use it to build profiles of individual people, to target ads outside the brand’s own accounts, to make decisions about anyone’s eligibility for housing, jobs, credit or insurance, or to train or improve AI models. We handle it under the Meta Platform Terms and Developer Policies.

• To sign you in and show you your own settings.
• To show available call times, prevent overlapping bookings, create meeting invitations and Google Meet links, text booking confirmations and reminders, and process a cancellation or time change you request.
• To copy events between calendars you own: each event on a linked calendar is copied to the hub calendar you choose, and a generic “Busy” block is written on your other linked calendars so nobody can double-book you. We never send invitations from the copies.
• To keep a brand’s warehouse current, prepare its reports, and let its AI team and Claude answer questions about its business.
• To make changes in a brand’s ad and commerce accounts that a named person on the brand’s team approved, or that fall inside limits the brand set.
• To run Growth Dept’s own internal automation for the staff account that connected it.
• To keep our services secure, investigate misuse and meet our legal obligations.

Growth Dept Admin’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, allow humans to read it except with your consent or for security and abuse handling, or use it to train or improve AI or machine-learning models.

The Admin application runs on servers Growth Dept manages. A brand’s business data is stored in that brand’s own warehouse, on a machine set up for the brand, not in a shared Growth Dept database. Access tokens and API keys are kept in files readable only by the service that uses them or in Google Cloud Secret Manager, connections use encrypted channels, and access is limited to the Growth Dept staff who operate the system and the people each brand authorises. Every change our software makes in an ad account is recorded with who approved it. Events we create are written only into calendars you own and are marked so the application can update or remove them later. Our calendar audit records hold counts and account emails, never event contents.

• Service providers that run the service for us: Vercel for the website; Google for calendar invitations, Workspace and Cloud services; Apple and mobile carriers to deliver texts; the hosting providers for the servers we manage; and AI model providers such as Anthropic, OpenAI and Google, which receive the figures a question needs when a brand’s AI team or Claude answers it. Each uses the data only to provide its service to us.
• The brand whose accounts the data came from, and the people that brand authorises.
• Anyone the law requires us to share it with, or where sharing is needed to stop fraud or abuse.
• A buyer or successor if Growth Dept is merged or sold, who must keep to this policy for the data it receives.

We do not sell personal data, and we do not share Google user data or Meta data with anyone else unless you ask us to. When you book a call, Google Calendar sends the invitation and its details to you and the selected Growth Dept teammates.

• A brand’s connection tokens and keys are kept until the brand disconnects that connection, the grant expires or is revoked, or our engagement ends.
• Business data in a brand’s warehouse belongs to the brand. It is kept for the length of the engagement and stays with the brand afterwards, unless the brand asks us to delete it.
• Tokens for a linked Google account are kept until you unlink the account in the application or revoke Growth Dept Admin’s access at myaccount.google.com/permissions. Unlinking an Admin calendar mirror deletes its tokens and removes its copied events. Disconnecting a booking calendar deletes its booking token; existing invitations remain until cancelled.
• Booking records retain the event identifier, time and status for reservation and retry handling, while the details you submit live in the calendar invitation and our sales records. Sign-in sessions expire after twelve hours.

You can remove our access to your Meta accounts at any time and ask us to delete what we hold.

1. Remove the app in Facebook.Open Settings & privacy, then Settings, then Apps and websites or Business integrations. Select the app you connected through Growth Dept and choose Remove. For a business portfolio, remove it under Business settings, Integrations, Connected apps. Meta stops sending us data for that account.
2. Disconnect it in Growth Dept.Use Disconnect next to Meta on your brand’s page in the Admin application, or email us. We delete the stored access token straight away, and your brand’s systems stop receiving it.
3. Ask us to delete the data. Email hello@growthdept.ai with the subject “Data deletion request” and name the business and accounts involved. We confirm the request with you, delete the Meta data we hold for those accounts within 30 days, including the copies in the brand warehouses we run, and tell you when it is done. Encrypted backups that contain it are overwritten as they age out. We keep only what the law requires us to keep.

If your data reached us through a brand’s account (for example, you commented on a brand’s post), email us and name the brand. We will remove it from the systems we run, working with that brand. The same address handles deletion of anything else we hold about you, and Google access can be revoked at any time at myaccount.google.com/permissions.

Wherever you live, you can ask us what personal data we hold about you, for a copy of it, to correct it, or to delete it. Email hello@growthdept.ai and we will answer within 30 days. We do not sell personal data or share it for cross-context behavioural advertising.

Our services are for businesses and are not directed to anyone under 16. When this policy changes we post the new version here with a new effective date.