Privacy Policy

Who we are

GrowRockets and Turbo are operated by GrowRockets Consultoria em TI Ltda, CNPJ 67.546.427/0001-60, Rua Pais Leme, 215, conj. 1713, Pinheiros, São Paulo, SP, 05424-150, Brazil. We are the data controller for the data described in this policy, except where the WhatsApp section below says otherwise.

We process personal data under Brazil's General Data Protection Law (LGPD, Law 13.709/2018). The legal basis is performance of a contract for delivering the service, and consent for analytics tracking.

What we collect

For your account, GrowRockets collects only the data needed to provide the service:

• Your email address (for authentication)
• If you join the Turbo early-access list: your name and WhatsApp number, so our team can contact you about access
• If you apply for an internship on /vagas: name, email, WhatsApp, course, school or bootcamp, current semester, portfolio and LinkedIn links, and your answer about how you use AI, to evaluate the application and contact you. The legal basis is your consent, given on the form
• API keys for connected integrations: PostHog, Amplitude (encrypted at rest with AES-256)
• OAuth tokens for Google Analytics 4 (encrypted at rest with AES-256)
• Aggregated analytics data fetched from your connected tools (funnel metrics, retention rates)
• Product metrics you enter manually or upload via CSV

Businesses that use Turbo also send us the WhatsApp conversations they have with their own customers. That data is covered in the next section.

WhatsApp data (Turbo)

Turbo lets a business connect its WhatsApp number through the WhatsApp Business Platform (Cloud API) from Meta and answer its customers from one inbox. When that happens, the business is the controller of its customers' data and we act as its processor (operador, under the LGPD). We handle this data only to provide the service to that business, following its instructions.

What we receive

Meta sends us the following on behalf of the business:

• The phone number and WhatsApp profile name of each person who messages the business
• Messages sent and received: text, photos, audio, video and documents
• Delivery status of messages sent by the business (sent, delivered, read, failed) and their timestamps
• Technical identifiers from Meta, such as message IDs and the business's WhatsApp account and phone number IDs

How it is stored

Meta delivers messages to us by webhook, and we verify the signature of every call. Message text and contacts are stored in our database, separated by business. Photos, audio, video and documents are downloaded from Meta into private storage, in a folder per business, and only authenticated members of that business can open them. The access token Meta issues to the business is encrypted at rest with AES-256.

What we use it for

We use WhatsApp data only to show conversations in the business's inbox, let its team reply, link each conversation to the right contact and deal, and show whether messages were delivered and read.

We do not sell or rent this data, use it for advertising, combine it across businesses, or use it to train AI models.

Retention, deletion and export

• Messages, contacts and media are kept while the business's Turbo account is active.
• When the business cancels, we delete all of its WhatsApp data, including database records and media files, within 30 days of cancellation.
• The business can ask for a copy of its messages, contacts and media at any time by writing to privacidade@growrockets.com. We send it in a machine-readable format.

If you messaged a business that uses Turbo and want to access or delete your data, contact that business first. You can also write to us and we will pass your request on to the business.

What we do NOT store

• Raw event data or individual user events from any analytics tool
• API keys or OAuth tokens in plain text

Data encryption

All API keys (PostHog, Amplitude), OAuth tokens (Google Analytics 4) and WhatsApp access tokens are encrypted at rest using AES-256 encryption before being stored in our database. The encryption key is stored separately from the database.

Data retention

Growth review results, initiatives, and your product profile are retained for the duration of your account. When you delete your account, all data is permanently and immediately removed.

• Active accounts: data retained as long as your account exists
• Cancelled paid plans: data retained, account reverts to free tier
• Account deletion: all data permanently deleted immediately
• Connected API keys: encrypted at rest, deleted immediately on disconnection
• Turbo WhatsApp data: deleted within 30 days of cancellation, as described above
• Internship applications: kept for up to 12 months after you apply, and deleted sooner if you ask at privacidade@growrockets.com

Sub-processors

We use the following third-party services to deliver GrowRockets:

• Meta Platforms (US and other countries): WhatsApp Business Platform, for sending and receiving messages
• Supabase (EU, Frankfurt): database, authentication and media storage
• Vercel (US/EU): hosting and serverless functions
• Anthropic (US): AI analysis engine (no customer data is stored by Anthropic)
• Stripe (US/EU): payment processing
• Resend (US): transactional email delivery

Your rights

Under the LGPD (article 18) you can ask us to:

• Confirm whether we process your data and give you access to it
• Correct incomplete, inaccurate or outdated data
• Anonymize, block or delete data that is unnecessary or processed unlawfully
• Port your data to another provider
• Delete data processed on the basis of your consent, or withdraw that consent
• Tell you which third parties we share your data with

You can view your data in your settings, delete your account with one click, or write to privacidade@growrockets.com. You can also file a complaint with Brazil's data protection authority (ANPD) at gov.br/anpd.

Cookies and analytics

We use essential cookies for authentication. We also use analytics tools (PostHog, Amplitude) to understand how the product is used and improve it.

Analytics tracking only activates after you accept cookies via the consent banner. If you decline, no analytics data is collected. We do not use advertising cookies or share analytics data with third parties.

Contact

GrowRockets Consultoria em TI Ltda · CNPJ 67.546.427/0001-60
Rua Pais Leme, 215, conj. 1713, Pinheiros, São Paulo, SP, 05424-150, Brazil

Privacy questions: privacidade@growrockets.com
Data protection officer (encarregado): Rony Lussari, ron@growrockets.com