Privacy notice

What we collect

When you join the early-access list, through a form on our website or by entering an address that isn’t a member’s on the sign-in page: the email address you enter, the page you entered it on, and when. To stop repeated requests from one place, we also keep a keyed hash of your IP address, never the address itself.

When you’re a member of a workspace: your email address, your role, the businesses you can see, and when you last used Growfinch. Our sign-in provider also records when you signed in and from which IP address.

When you connect a social account: the account’s name, handle and ID, and the access tokens the platform issues to Growfinch. We encrypt the tokens (AES-256-GCM) before storing them.

What your workspace creates or sends: posts, captions, images, videos, schedules, approvals and campaign settings, whether added in Growfinch or sent by your own tools through its API or MCP server.

Results from the platforms: counts such as views, likes, comments and shares for posts published through Growfinch.

Activity records: who approved, changed or published what, and when.

How we use it

• To run Growfinch: sign you in, publish what your workspace approves or allows, and show how posts perform.
• To keep Growfinch secure and prevent abuse.
• To contact you about early access, if you joined the list.

We rely on providing the service you or your organisation asked for, on keeping it secure, and, for the early-access list, on your request to hear from us. We don’t sell personal information or use it for advertising. Growfinch shows no ads, and no third party serves content or ads in it.

Social platforms

Growfinch connects to each platform through its official API, with the permissions you grant when you connect an account:

• YouTube (Google): upload the videos you approve, update their details, and read channel and video statistics.
• Instagram (Meta): publish posts and read the account’s profile and post insights.
• X: publish posts with media and read the account’s profile and posts.
• LinkedIn: publish posts as you and read your basic profile.

Each platform’s own terms and privacy policy also apply to your account there.

YouTube and Google

Growfinch uses YouTube API Services. By using its YouTube features, you agree to the YouTube Terms of Service. The Google Privacy Policy explains how Google handles your information. You can remove Growfinch’s access to your Google account at any time on Google’s security settings page; disconnecting the channel in Growfinch removes it too.

Growfinch’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who processes it for us

These providers run parts of Growfinch and use your information only to do so:

• Vercel hosts the website and the workspace.
• Supabase provides the database, file storage and sign-in.
• Cloudflare runs our domain’s DNS and Turnstile, the check that a sign-in request comes from a person.
• Render runs scheduled publishing jobs.
• An email delivery provider sends sign-in codes.

During early access, Growfinch shares its sign-in service with GeoThen, another product of Mendios Technologies (WebMobi), so your sign-in code arrives from GeoThen.

When your workspace sets up webhooks, Growfinch sends post and campaign events to the addresses it chose. We’ll update this notice before any new provider processes your information.

Our providers store information in the United States and Singapore. If you live elsewhere, your information is transferred there under their data protection terms.

Cookies

Growfinch sets only the cookies it needs: those that keep you signed in, and one that remembers which business you’re viewing. It uses no analytics or advertising cookies. Turnstile processes technical details about your browser to tell people from bots, under Cloudflare’s privacy policy.

How long we keep it

• Early-access requests: until you ask us to remove them.
• Tokens for a connected account: until the account is disconnected. Disconnecting deletes them, and revokes them at Google and X.
• Member details, workspace content, results and activity records: while the workspace uses Growfinch, unless you ask us to delete them sooner.

Your choices and rights

You can ask to see, correct, export or delete your information, or object to how we use it. Write to support@growfinch.com; we answer within 30 days. You can also complain to your local data protection authority.

Deleting data from a connected account

A workspace owner can disconnect a social account in Growfinch, which deletes its tokens straight away. To delete everything else Growfinch holds about the account, such as its posts, media and results, email support@growfinch.com naming the account. We do so within 30 days and confirm by email.

Security

Connections to Growfinch are encrypted, and access tokens are encrypted before they’re stored. Each business’s data is kept apart in the database, and members see only the businesses they’re given. No system is perfectly secure; if a breach affects your information, we’ll tell you as the law requires.

Children

Growfinch is a tool for businesses. It isn’t meant for anyone under 18, and we don’t knowingly collect their information.

Changes

When we change this notice, we update the date at the top. If a change is significant, we email members before it takes effect.

Contact

Mendios Technologies (WebMobi), support@growfinch.com. The terms of service cover the rest of your use of Growfinch.