Privacy Policy

GrowdioAI is a trading name of Reshma Ghosh, a sole trader (enskild firma) registered in Sweden and approved for F-skatt. Reshma Ghosh is the data controller for personal data collected through www.growdioai.com.

Address:  Lund, Sweden Email: hello@growdioai.com We comply with the EU General Data Protection Regulation (GDPR) and applicable Swedish data protection law.

We collect personal data in three ways: information you give us directly, information collected automatically when you use our site, and information received from third-party tools we use to deliver our services.

We do not collect sensitive personal data (such as health, financial, or biometric data) and we do not ask for it.

We use the data we collect for the following purposes:

• To respond to your enquiry and book a strategy call. Legal basis: steps taken at your request before entering into a contract (GDPR Article 6(1)(b)).
• To deliver the services you have purchased. Legal basis: performance of a contract (Article 6(1)(b)).
• To send invoices and keep accounting records. Legal basis: legal obligation under the Swedish Bookkeeping Act (Bokföringslagen) (Article 6(1)(c)).
• To follow up on enquiries and improve our website and services. Legal basis: our legitimate interest in running and developing our business (Article 6(1)(f)).

We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

Where GDPR or equivalent data protection law applies to you (for example if you are located in the European Economic Area or the United Kingdom), we rely on the following legal bases:

• Contract performance: processing necessary to deliver a service you have requested or entered into a contract with us to receive.
• Legitimate interests: improving our website, responding to unsolicited enquiries, and maintaining security, where these interests are not overridden by your rights.
• Legal obligation: complying with applicable law, tax requirements, or regulatory demands.
• Consent: where you have explicitly opted in, for example to receive marketing emails. You may withdraw consent at any time by contacting us.

We do not sell, rent, or trade your personal data. We share it only with the following categories of trusted service providers, and only to the extent necessary to deliver our services:

• Infrastructure and hosting: Supabase (database and form-intake functions), used to store enquiry submissions securely.
• Calendar and scheduling tools: Cal.com or Calendly (depending on your region) to manage strategy call bookings.
• Communication tools: WhatsApp Business API providers who facilitate our AI lead qualification conversations.
• Email delivery: Transactional email services used to send confirmation and follow-up messages.
• Zoho Sign:contract signing
• Stripe:payments
• Analytics: Aggregated, anonymised analytics tools to understand site usage. We do not share identifiable data with analytics providers.

Each provider is bound by a data processing agreement and is required to handle your data in accordance with applicable law. We review our providers regularly to ensure they maintain appropriate standards.

We may also share data with law enforcement or regulators where required by law, or to protect the rights, property, or safety of GrowdioAI, our clients, or others.

GrowdioAI operates with clients and team members across multiple countries including Sweden, the UAE, India, and the United States. As a result, your personal data may be processed or stored in countries outside the European Economic Area.

Where we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Transfers to countries recognised by the European Commission as providing an adequate level of data protection.
• Data processing agreements with all third-party providers that include appropriate transfer mechanisms.

If you have questions about specific transfer mechanisms, please contact us using the details in section 12.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our general retention periods are:

• Enquiry data (no contract): 12 months from the date of last contact, after which it is deleted unless you have become a client.
• Client data: for the duration of the engagement and up to 6 years after completion, to comply with tax and legal record-keeping requirements.
• Marketing consent records: until you withdraw consent, plus a further 12 months to maintain proof of consent.
• Website usage and analytics data: aggregated and anonymised; retained for up to 24 months for trend analysis.

When data is no longer required, we delete or anonymise it securely. You may request earlier deletion of your data subject to our legal obligations (see section 9).

Our website uses a small number of cookies to ensure it functions correctly and to help us understand how visitors use it. We do not use advertising or behavioural tracking cookies.

You can control cookies through your browser settings. Disabling cookies may affect the functionality of some parts of the site. No consent banner is currently deployed; if we add non-essential cookies in future, we will update this policy and display a banner accordingly.

Depending on where you are located, you may have the following rights regarding your personal data. We will respond to all valid requests within 30 days.

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: ask us to delete your data, subject to our legal obligations to retain certain records.
• Right to restrict processing: ask us to pause processing while a dispute is resolved.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, please contact us at the address in section 12. If you believe we have not handled your data correctly, you have the right to lodge a complaint with a supervisory authority. In Sweden, that is Integritetsskyddsmyndigheten (IMY); in the UK, the Information Commissioner's Office (ICO).

Our website and services are directed at business professionals and are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or best practice. When we make material changes, we will update the "last updated" date at the top of this page. We encourage you to review this policy periodically.

Continued use of our website or services after a policy update constitutes acceptance of the revised terms. Where required by law, we will notify affected individuals directly.

If you have any questions about this Privacy Policy, want to exercise your data rights, or wish to raise a concern, please reach out to us: