What we collect, and why.

Growth Dept (“we”, “us”) operates growthdept.ai and the Growth Dept Admin application, an internal operations dashboard used by Growth Dept staff and the client accounts they work in. Questions about this policy go to hello@growthdept.ai.

This policy covers the public website at growthdept.ai and the Growth Dept Admin application, including the Google account data that application receives when a person signs in with Google or links a Google account to it.

• Website. Public pages do not require sign-in. Our hosting provider records standard request logs (IP address, browser, pages requested) to serve and secure the site.
• Online booking. We use the name, work email, company, store URL, answers and time you submit to create a Google Calendar invitation. Invited team members can connect Google accounts to manage availability. We keep their account details, selected calendar identifiers, working hours and a refresh token. Availability checks use free/busy times; visitors cannot see calendar event details.
• Sign-in. When you sign in to the Admin application with Google, we receive your email address and basic profile so we can recognise you. Sign-in stores no Google tokens.
• Calendars you link. When you link a Google account to the calendar feature, we receive the events on the calendars you select: titles, times, descriptions, locations, meeting links, organisers and attendees. We keep a refresh token for each linked account so the feature can keep working without asking you to sign in again.
• Staff Workspace connections. Growth Dept staff may connect a Google Workspace account for our own operations. Those connections use the Gmail, Calendar, Drive, Docs, Sheets, Slides, Contacts, Meet and Admin Directory access shown on Google’s consent screen at the time of consent.

• To sign you in and show you your own settings.
• To show available call times, prevent overlapping bookings, create meeting invitations and Google Meet links, and process a cancellation or time change you request.
• To copy events between calendars you own: each event on a linked calendar is copied to the hub calendar you choose, and a generic “Busy” block is written on your other linked calendars so nobody can double-book you. We never send invitations from the copies.
• To run Growth Dept’s own internal automation for the staff account that connected it.

Growth Dept Admin’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, allow humans to read it except with your consent or for security and abuse handling, or use it to train or improve AI or machine-learning models.

The Admin application runs on servers Growth Dept manages. OAuth tokens are kept in files readable only by the account that runs the application, connections use encrypted channels, and access is limited to the Growth Dept staff who operate the system. Events we create are written only into calendars you own and are marked so the application can update or remove them later. Our audit records hold counts and account emails, never event contents.

Only the service providers that host our infrastructure (Vercel for the website; the servers we manage for the application), and only to run the service. We do not sell personal data and we do not share Google user data with anyone else unless you request it or the law requires it. When you book a call, Google Calendar sends the invitation and its details to you and the selected Growth Dept teammates.

Tokens for a linked account are kept until you unlink the account in the application or revoke Growth Dept Admin’s access at myaccount.google.com/permissions. Unlinking an Admin calendar mirror deletes its tokens and removes its copied events. Disconnecting a booking calendar deletes its booking token; existing invitations remain until cancelled. Booking records retain the event identifier, time and status for reservation and retry handling, while the details you submit live in the calendar invitation. Sign-in sessions expire after twelve hours. Email us to delete anything else we hold about you.

Our services are for businesses and are not directed to anyone under 16. When this policy changes we post the new version here with a new effective date.