Privacy policy

Who we are

This policy explains how Growth Labs s.r.o. ("Growth Labs", "we", "us") handles personal data. We are the controller of the personal data described here.

For anything about your personal data, email hello@growthlabs.work.

Visiting this website

Technical data

The site runs on Cloudflare. To deliver and protect it, Cloudflare processes your IP address, browser and device details, the pages you request and when. We keep request logs for a limited period, to keep the site secure and to fix faults. The legal basis is our legitimate interest in running a secure website.

Our own analytics

• We measure how the site is used with our own first-party analytics. In the EU, the European Economic Area, the United Kingdom, Brazil and similar regions it runs only after you accept analytics in the cookie banner; elsewhere it runs by default. You can change your choice at any time from the banner's settings or by clearing this site's cookies.
• It records a random visitor ID and session ID (kept in cookies), the pages you view, the page you came from and any campaign tags in the link, your country (worked out from your IP address, which it does not store), your device type, browser and operating system, page loading performance, and the steps you take towards an order or an enquiry.
• The visitor cookie expires after 13 months. We keep analytics records only as long as they help us understand how the site is used.

Google Analytics

With your consent, and only then, we also use Google Analytics 4, provided by Google Ireland Limited. It sets cookies (named_ga and _ga_…) and receives the same kind of usage data, plus events such as starting a checkout, completing an order or copying our email address. We run it with IP anonymisation, with Google signals and ad personalisation switched off, and keep its data for 14 months. When you complete an order, our server also tells Google Analytics about the purchase (an order reference, value and currency), again only if you have consented.

Cloudflare Web Analytics

We use Cloudflare Web Analytics to measure page speed and visit counts. It sets no cookies and does not track you across sites or visits, so it runs without consent. The legal basis is our legitimate interest in a fast, working website.

Cookies and local storage

• a cookie that remembers your cookie choice;
• our analytics cookies, only where analytics is allowed;
• Google Analytics cookies, only with your consent.

Buying hosting

• Checkout is run by Stripe. Stripe collects your name, email address, billing address, any VAT ID and your payment details, and shares them with us except for your full card number, which we never see. Stripe Payments Europe, Ltd. is the controller of the payment data it needs for its own legal duties; see Stripe's privacy policy.
• We keep your order, contact and billing details, any website address you give, and whether you asked us to start within the withdrawal period, to provide the service, bill for it and meet our accounting and tax obligations. The legal basis is the contract and our legal obligations.
• When you order, we email the order details to Grant so he can contact you about setup.

Withdrawing from a contract

If you use our withdrawal form, we process your name, email address, the contract details and any note you add, to handle the withdrawal and to send you an acknowledgement. We keep this as a record of the contract for as long as we keep the contract itself. The legal basis is our legal obligation.

The Growth Labs account

The Growth Labs account lets you sign in to Growth Labs tools at auth.growthlabs.work. You can sign in with a one-time code sent to your email address, or with your Google account.

What we collect

• Email sign-in: your email address, and the one-time code we email you, which expires shortly after it is sent.
• Google sign-in: with your permission, Google shares your name, email address, whether that address is verified, and a link to your profile picture. We ask only for these basic profile scopes (openid,email and profile) and never for access to your Gmail, Drive, contacts or anything else in your Google account.
• We store your email address, name, profile picture link and when your account was created and last updated, plus the sign-in sessions and tokens that keep you signed in.
• Like the website, the sign-in service keeps technical request logs for security and fault-finding.

How we use it

We use this data only to sign you in, keep you signed in, protect your account and tell the Growth Labs tool you are using who you are. The legal basis is providing the account you asked for and our legitimate interest in keeping it secure.

Google user data

Growth Labs' use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements. In particular:

• we use the data Google shares only to provide and secure sign-in;
• we do not sell it, and we do not use or share it for advertising;
• we do not use it to develop, improve or train AI or machine-learning models;
• we share it with no one except the service providers that run sign-in for us (Cloudflare), when required by law, or with your consent;
• no person reads it except where needed for security, to comply with law, or with your consent.

You can remove Growth Labs' access at any time from your Google account'sthird-party connections page.

How long we keep it

We keep your account until you ask us to delete it. Sessions expire on their own. To delete your account and its data, email hello@growthlabs.work.

Hosting clients

• Your website, its content and its data, including personal data about your own visitors or customers, sit on servers we run or rent. We process that data on your behalf, as your processor, only to host, back up, support and secure your site.
• We keep client records for as long as you are a client, and invoices and accounting records for as long as Czech accounting and tax law requires (currently up to 10 years).

Email

When you email us, we keep the correspondence for as long as we need it to answer you and to keep a record of our dealings with you. The legal basis is our legitimate interest in replying, or taking steps towards a contract you asked about.

AI tools

We use AI tools from providers such as Anthropic, OpenAI and Z.ai to build and run our services. When one of those tools works on a task that involves personal data, for example an error log containing an IP address or an email you sent us, the provider processes that data to carry out the task. We do not use AI to make decisions about you that have legal or similarly significant effects.

Who else handles your data

We do not sell personal data. We share it only with providers that help us run our services:

• Cloudflare: website and sign-in hosting, content delivery, security, Web Analytics and our transactional email;
• Google: Google Analytics (only with your consent) and Google sign-in (if you choose it);
• Stripe: checkout and payments;
• Fastmail: our email;
• server and data-centre providers that host client websites;
• the AI providers described above.

We may also disclose data where the law requires it, or to protect our rights or someone's safety.

Some of these providers are outside the European Economic Area, including in the United States and Australia. Those transfers are covered by the EU–US Data Privacy Framework where the provider is certified under it, or by the European Commission's standard contractual clauses in the provider's data processing terms.

Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it;
• delete it;
• restrict how we use it;
• give it to you, or to someone else, in a portable format.

You can also object to processing based on our legitimate interests, and withdraw consent at any time without affecting what happened before. Email hello@growthlabs.work; we answer within one month.

If you are unhappy with how we handle your data, you can complain to the Czech data protection authority, the Úřad pro ochranu osobních údajů (uoou.gov.cz), or to the authority where you live.

Children

Our services are not intended for children under 16, and we do not knowingly collect their data.

Changes to this policy

We will update this page when our practices change and show the date of the latest version at the top. If a change significantly affects account holders or hosting clients, we will also tell them by email.