The Growth Fix logoThe Growth FixGrowth diagnosis + execution

Privacy Notice

Effective date: 16 October 2026

This notice explains how we handle personal data when you visit www.thegrowthfix.io, use the Marketing Priority AI app at app.thegrowthfix.io (the "Service"), or contact us.

1. WHO WE ARE

Romualdo Pereira da Silva Junior, a sole trader trading as The Growth Fix ("we", "us", "our"), is the controller of the personal data described in this notice, except as explained in section 2.

Address: Duleek, Co. Meath, Ireland

Privacy contact: romualdo@thegrowthfix.io

Support: support@thegrowthfix.io

Telephone: +353 89 950 4799

We have not appointed a Data Protection Officer because we are not required to. Please send any privacy question to romualdo@thegrowthfix.io.

2. OUR TWO ROLES

We act as controller for: your account and sign-in details, billing, support, security, and our website analytics.

We act as processor for our business customers for: data in the accounts they connect (for example Google Analytics, Search Console, Google Ads, Business Profile, Facebook, Instagram and TikTok) and content they upload. For that data, our customer decides how it is used, and our Data Processing Terms (Schedule 1 of our Terms of Service) apply. If you are a customer's own client, follower or website visitor, please contact that business about your data; we will help them respond.

3. THE PERSONAL DATA WE PROCESS AND WHERE IT COMES FROM

From you:

  • Account data: name, business email address, business name, sign-in details and the organisation you belong to.
  • Billing data: plan, subscription status, invoice amounts and Stripe payment references. Stripe collects your card details directly; we do not receive or store your full card number.
  • Support data: messages you send us and our replies.
  • Content you upload: text, images and video, which may include people.

From the accounts you connect (only those you choose to connect and select):

  • Identifiers for the accounts, properties, pages and profiles you select, and the permissions you grant.
  • Connection credentials (access tokens), which we store encrypted on our servers.
  • Marketing data from those accounts: website analytics, search performance, advertising performance, page and post information and engagement figures. This is mostly aggregated business data, but it can include names, usernames and online identifiers.

Created by the Service:

  • Recommendations, reports and generated content; records of the actions you approve and their outcome.
  • Security and operational records: sign-in events, IP addresses, device and browser information, and error logs.

From our website:

  • If you accept statistics cookies, Google Analytics data about your visit (see section 11).

4. WHY WE USE PERSONAL DATA AND OUR LEGAL BASIS

  • To provide the Service, create and manage your account, connect your chosen accounts, produce reports and content, and carry out actions you approve.

Legal basis: performance of our contract with you (Article 6(1)(b) GDPR) where you are the customer; where you use the Service on behalf of a business customer, our legitimate interest in providing the Service that business has bought (Article 6(1)(f)).

  • To bill you and keep accounting records.

Legal basis: contract (Article 6(1)(b)) and our legal obligation to keep tax records (Article 6(1)(c); section 886 of the Taxes Consolidation Act 1997).

  • To provide support and send you service messages (such as billing notices, security alerts and changes to our terms).

Legal basis: contract (Article 6(1)(b)) or legitimate interests in running the Service (Article 6(1)(f)).

  • To keep the Service secure, prevent fraud and misuse, and fix faults.

Legal basis: our legitimate interests in protecting our customers and the Service (Article 6(1)(f)).

  • To understand how visitors use our website.

Legal basis: your consent (Article 6(1)(a)), which you give or refuse in our cookie banner.

  • To comply with the law and to establish, exercise or defend legal claims.

Legal basis: legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)).

You can ask us for details of how we balanced our legitimate interests against your rights.

We do not sell personal data. We do not use connected-account data or your content for advertising, or for any purpose other than providing the Service to you. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Our recommendations are about marketing activity, not decisions about individuals.

You need to give us your account details and accept our Terms to use the Service; without them we cannot provide it. Connecting third-party accounts is optional, but some features will not work without them.

5. GOOGLE USER DATA

When you connect a Google account, we ask only for the permissions needed for the features you choose:

  • Google Analytics (analytics.readonly): reads your selected GA4 property to explain traffic and performance changes.
  • Search Console (webmasters.readonly): reads your selected site's search performance.
  • Google Ads (adwords): reads your selected Google Ads account's performance and, only when you approve a specific change, makes that change. This permission allows changes to your account.
  • Business Profile (business.manage): reads your selected Business Profile and, only when you approve a specific action, carries it out. This permission allows changes to your profile.

We use Google user data only to provide and improve the user-facing features of Marketing Priority AI that you can see in the app. We do not transfer it to others except as needed to provide those features, for security, or to comply with the law. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train generalised artificial intelligence or machine learning models. People do not read it unless you ask us to (for example, for support), it is needed for security or to comply with the law, or it is aggregated and anonymised for internal operations.

Marketing Priority AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can remove our access at any time in Connections in the app or at https://myaccount.google.com/permissions.

6. META (FACEBOOK AND INSTAGRAM) AND TIKTOK DATA

Meta: when you connect Facebook or Instagram, we use pages_show_list to list the Pages you manage so you can choose one; pages_manage_posts to publish content you approve to that Page; pages_read_engagement and instagram_basic to identify the selected Page and its linked Instagram professional account; instagram_content_publish to publish content you approve to that Instagram account; and, for advertising features, ads_read to read performance of the ad accounts you select, business_management to find the business assets you authorise, and ads_management to make advertising changes only when you approve each one.

TikTok: when you connect TikTok, we use user.info.basic to show you which TikTok account is connected, and video.publish to upload a video to that account only when you approve the post.

We use data from Meta and TikTok only to provide these features to you. We do not sell it or use it for advertising. Connecting an account does not by itself publish anything: every post needs your approval.

You can remove our access at any time in Connections in the app, and in your Facebook, Instagram or TikTok settings. See section 12 for how to ask us to delete your data.

7. WHO WE SHARE PERSONAL DATA WITH

We use these service providers to run the Service. They process personal data on our instructions under contracts that require them to protect it:

  • Netlify — website and app hosting
  • Supabase — database, sign-in and file storage (our main database is hosted in Frankfurt, Germany; a small number of records for earlier pilot customers are held in a Supabase database in Ireland)
  • DigitalOcean — background processing servers
  • Resend — sending service emails
  • Google — website analytics, only if you accept statistics cookies
  • Anthropic — drafting social-post captions, only when this feature is switched on for your organisation. We send Anthropic only the brief you write for the post (such as your business name, message and call to action), not data from your connected accounts.

Stripe processes payments. Stripe also acts as an independent controller for some payment data under its own privacy policy (https://stripe.com/privacy).

When you approve an action, we send the relevant content and data to the platform you chose (for example Google, Meta or TikTok). That platform then handles it under its own terms and privacy policy.

We may also disclose personal data where the law requires, or to a buyer of our business, who would have to keep to this notice.

8. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Some of our service providers process personal data outside the European Economic Area (EEA). Where they do, we protect the transfer with the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards at romualdo@thegrowthfix.io.

9. HOW LONG WE KEEP PERSONAL DATA

  • Generated video files: deleted at the earliest of 24 hours after creation, confirmed successful posting, or your confirmation that you have finished downloading. A short record of the outcome is kept with your account data.
  • Account data, connected-account data, content, reports and action records: kept while your subscription is active, then deleted 30 days after your paid access ends. You can ask us to delete them sooner (section 12).
  • Connection credentials: deleted when you disconnect the account, or with your account data, whichever is first.
  • Billing and accounting records: 6 years after the transaction they relate to, as Irish tax law requires.
  • Support messages: 2 years after your account closes.
  • Security and error logs: 30 days.
  • Website analytics: Google Analytics keeps event data for 2 months and user-level data for 14 months, reset each time the same visitor returns.
  • Backups: kept for up to 30 days and then overwritten. Data deleted from the live system disappears from backups within 30 days.

10. SECURITY

We protect personal data with measures that include encryption of connection credentials, database rules that keep each customer's data separate, limited access for our systems and staff, and secure service providers. No system is completely secure, but we will tell you and the Data Protection Commission about a personal data breach where the law requires.

11. COOKIES AND ANALYTICS

Our website (www.thegrowthfix.io) uses a cookie banner. We use only strictly necessary cookies unless you choose otherwise. If you accept statistics cookies, we use Google Analytics (measurement ID G-P5G2Q1195H), which sets these cookies:

  • _ga — distinguishes visitors — 2 years
  • _ga_P5G2Q1195H — keeps the state of your visit — 2 years

We also set one strictly necessary cookie, CookieConsent, to remember your cookie choice.

Google Analytics is not loaded until you accept. You can change or withdraw your choice at any time using the cookie settings link at the bottom of every page. Our full cookie list is in the cookie declaration on our website.

The app (app.thegrowthfix.io) uses only strictly necessary cookies and similar storage to keep you signed in and secure. These do not need your consent.

12. YOUR RIGHTS AND HOW TO DELETE YOUR DATA

You have the right to:

  • access your personal data;
  • correct inaccurate data;
  • have your data erased;
  • restrict how we use it;
  • object to our use based on legitimate interests;
  • receive data you gave us in a portable format; and
  • withdraw consent at any time, where we rely on consent (this does not affect earlier use).

To use any right, email support@thegrowthfix.io from the email address on your account. We reply without undue delay and in any event within one month. We may ask for information to confirm your identity. Some rights have legal limits; for example, we must keep billing records for 6 years.

You can complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland — www.dataprotection.ie. We would like the chance to resolve your concern first.

How to delete your data

1. To disconnect an account: open Connections in Marketing Priority AI and choose Disconnect. This deletes the stored connection credentials for that account and stops our access. You can also remove our access in your Google, Facebook, Instagram or TikTok account settings.

2. To ask us to delete your data: email support@thegrowthfix.io from the email address registered on your account, with the subject "Data deletion request". Tell us your organisation name and whether you want all your data deleted or only data from a particular connected account. Never send a password, access token, API key or card details.

3. We may ask for information to confirm that you are authorised to make the request. We complete the deletion and confirm it to you in writing within 30 days. We tell you what we deleted and anything we must keep by law (such as billing records, kept for 6 years) and why. Deleted data is removed from our backups within a further 30 days.

4. Disconnecting or deleting data with us does not delete data held by Google, Meta, TikTok or other platforms. Use each platform's own settings for that.

5. If you cancel your subscription and do not ask for deletion, your data is deleted 30 days after your paid access ends, except records we must keep by law. Generated videos are always deleted within 24 hours.

13. CHANGES TO THIS NOTICE

We will update this notice when our processing changes and show the new effective date at the top. If a change materially affects you, we will tell you by email or in the app before it takes effect.