PRIVACY POLICY

1. DEFINITIONS

A business or organization that uses Growthifi’s Services.

Personal information processed by Growthifi solely on behalf of a Client.

Information that identifies, relates to, describes, or can reasonably be linked to an individual.

Information defined as sensitive under applicable U.S. state laws and GDPR.

Any operation performed on personal information (e.g., collecting, storing, using, disclosing).

An individual whose information is processed on behalf of a Client.

Growthifi’s platform, applications, tools, messaging systems, APIs, websites, and professional/agency services.

2. SCOPE OF THIS POLICY

This policy applies to:

• Growthifi-owned websites, subdomains, and portals
• CRM, messaging, automation, AI tools, and APIs
• Support, onboarding, agency, and consulting activities
• Data processed across SMS, MMS, RCS, WhatsApp, email, voice, and other channels
• Data processed for Clients and administrative users

This policy does not apply to:

• Third-party websites or platforms not controlled by Growthifi
• Data processed where the Client acts as the controller
• Aggregated, de-identified, or anonymized information
• Job applicant or employee data

3. OUR ROLE: CONTROLLER VS. PROCESSOR

Growthifi processes Client Data solely on documented instructions. Client Data may include:

• Contact lists, numbers, email addresses
• SMS/MMS, RCS, WhatsApp, or email message content
• Consent and opt-in/opt-out records
• Tags, custom fields, workflows, CRM metadata
• Delivery logs, timestamps, routing data
• API events and integrations data

Client obligations:

• Obtain and maintain all required consents (TCPA, CTIA, GDPR, etc.)
• Provide accurate disclosures to their contacts
• Ensure lawful data collection and contact permissions
• Manage End User rights requests

Growthifi is not responsible for misuse, misconfiguration, or unlawful Client processing of Client Data. A separate Data Processing Addendum (DPA) governs controller–processor responsibilities.

Growthifi acts as the controller for:

• Website visitor information
• User accounts
• Billing and transactional data
• Security logs and system analytics
• Marketing preferences and communications
• Product usage statistics

4. INFORMATION WE COLLECT

• Name, email, mobile number, business information
• Login credentials and authentication data
• CRM entries and uploaded content
• Billing / subscription details (processed by third-party payment processors)
• Support inquiries and correspondence

• Phone numbers and email addresses
• Message content and attachments
• Delivery logs, routing details, timestamps
• Opt-in, opt-out, and double opt-in records
• Conversation history, tags, custom fields, automation activity

• IP address, approximate geolocation
• Browser, device, OS, and network metadata
• Session identifiers, cookies, and tracking technologies
• API usage logs
• Security, fraud, and diagnostic logs

When Clients connect integrations, we may process:

• Contacts, events, and activity data
• Tags and custom fields
• Conversation logs or triggers

We may generate anonymized or aggregated data that cannot reasonably identify a person. This is not personal information.

5. CONSENT & TELECOMMUNICATION REGULATIONS (TCPA / CTIA)

Growthifi enforces strict first-party consent requirements.

Clients may not upload or contact:

• Purchased, rented, scraped, or third-party lists
• Individuals without verifiable opt-in
• High-risk or restricted content categories (including SHAFT content)

Clients must:

• Maintain proof of prior express written consent
• Provide STOP/HELP mechanisms
• Honor opt-outs immediately
• Include required TCPA/CTIA disclosures
• Ensure “Message and data rates may apply” is communicated

Carrier violations may result in suspension or termination.

6. HOW WE USE PERSONAL INFORMATION

• Authentication and account management
• CRM operation, workflows, and automation
• Message routing, deliverability optimization, and carrier compliance
• Logging, monitoring, diagnostics, and fraud prevention

• Account updates
• Security alerts and system notifications
• Technical and customer support

We use information to:

• Improve functionality, performance, and reliability
• Detect anomalies, fraud, and abuse
• Train and enhance internal AI systems using anonymized data only

We do not use identifiable Client Data to train AI without explicit authorization. If pseudonymized data is used internally for quality assurance, it is never used to identify an individual. AI outputs may require human review.

• Email and SMS marketing
• Retargeting (with consent where required)
• Webinars, events, and newsletters

You may opt out of marketing communications at any time.

• Telecommunications laws
• Carrier audits
• Fraud investigations
• Court orders or government requests

7. HOW WE DISCLOSE PERSONAL INFORMATION

We do not sell personal information.

We may share information with:

For SMS, MMS, RCS, WhatsApp, email, and voice delivery.

For storage, encryption, monitoring, logging, and high availability.

Based on Client-approved configurations.

For billing, analytics, authentication, support, and other operational functions. A list is maintained on our Sub-Processor Disclosure page.

Information may be disclosed as part of a merger, acquisition, financing, or sale of assets.

If required by law, subpoena, court order, carrier audit, or fraud investigation.

Data may be included in encrypted backups and disaster-recovery systems.

8. DATA SECURITY

Security measures include:

• Encryption at rest and in transit (TLS)
• Role-based access control
• Multi-factor authentication
• Network and log monitoring
• Intrusion detection and threat analysis
• Vulnerability scanning and penetration testing
• Principle of least privilege

No system can guarantee absolute security.

9. DATA RETENTION

Unless required otherwise by law or carrier policy:

Retention may be extended for ongoing investigations or legal obligations.

10. COOKIES & TRACKING TECHNOLOGIES

We use:

• Essential cookies
• Analytics cookies (opt-in where required)
• Advertising/retargeting pixels
• Session identifiers

A cookie consent management tool is used where required under GDPR/UK GDPR. Users may manage cookie preferences via browser settings.

11. U.S. STATE PRIVACY RIGHTS (INCLUDING CCPA/CPRA)

(CPRA-compliant format)

You may:

• Request to know categories or specific pieces of personal information
• Request correction or deletion
• Opt out of “sale” or “sharing” (Growthifi does neither)
• Limit use of Sensitive Personal Information
• Submit a privacy rights request through our dedicated portal
• Appeal any denied request
• Exercise rights without discrimination

Verification Procedures. We verify requests by matching identifying information (e.g., email, phone, account data).

Appeals Process. If your request is denied, you may file an appeal by contacting [email protected]. For Client Data, requests must be directed to the Client.

12. GDPR / UK GDPR RIGHTS

EU/UK residents may:

• Access, correct, or delete data
• Restrict or object to processing
• Withdraw consent at any time
• Request data portability
• Lodge complaints with local Data Protection Authorities
• Request information about automated decision-making

Lawful bases include: Contract, Legitimate Interests, Legal Obligations, and Consent.

13. INTERNATIONAL TRANSFERS

Data may be processed in the U.S. or other countries. Safeguards include:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions
• Additional technical and organizational measures
• Sub-processor contractual obligations
• Participation of certain sub-processors in the EU-U.S. Data Privacy Framework (DPF) where applicable

14. AI SYSTEMS & AUTOMATED DECISION-MAKING

Growthifi uses AI for:

• Workflow automation
• Message classification
• Lead scoring
• Fraud/spam detection
• Support tools
• Performance optimization

We do not use AI for automated decision-making that produces legal or similarly significant effects on individuals.

15. HIPAA & MEDICAL DATA

Growthifi is not HIPAA-compliant and does not sign BAAs. Clients may not transmit:

• PHI
• Medical records
• Patient data

Any discovered PHI will be deleted.

16. CHILDREN’S PRIVACY

Our Services are not intended for individuals under 18. We do not knowingly collect information from children under 13 (COPPA). If discovered, data will be deleted promptly.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Policy periodically. Material changes will be communicated via:

• Email
• Website banners
• In-platform notices

18. CONTACT INFORMATION

Growthifi LLC
129 East Maple St
Hegins, PA 17938
Email: [email protected]