Privacy Policy

Last updated: 31 August 2026

This policy explains what data Growvya ("we", "us") collects, why, and how we handle it. Growvya is operated from India; contact us anytime at support@growvya.co.in. There are two kinds of people this policy covers, and we treat them differently: our customers (businesses that sign up for Growvya) and their customers (the people on contact lists our customers upload).

1. Data about you, our customer

When you sign up we collect your name, email address, business name and profile, and — through our payment provider — billing details. We also collect usage information (campaigns created, features used, log data) to run and improve the Service. We never see or store your card, UPI, or bank details: payments are processed entirely by Razorpay, a PCI-DSS-compliant Indian payment gateway.

2. Data your business uploads (your customers' data)

Contact lists you import — names, phone numbers, email addresses, tags, and consent records — belong to you. For this data we act as a processor on your behalf:

• We use it only to provide the Service to you: sending your approved campaigns, tracking delivery, and enforcing opt-outs.
• We never sell it, share it with other Growvya customers, use it for advertising, or contact your customers ourselves.
• Consent is tracked per contact and defaults to "no" — the platform will not email or message a contact recorded as non-consented, unsubscribed, or suppressed.
• Every marketing email carries a one-click unsubscribe; WhatsApp recipients can reply STOP. Both are honoured automatically and permanently for your business.

If you are a recipient of a message sent through Growvya and want your details removed from a business's list, use the unsubscribe link or reply STOP — or write to us at support@growvya.co.in and we will act on it.

3. Who we share data with (sub-processors)

We use a small number of infrastructure providers, chosen for security and, where possible, Indian data residency:

When you use the AI Campaign Writer, the campaign brief you type is sent to our AI provider to generate the draft; we do not send your full contact list to the AI provider. Each provider receives only what it needs to perform its function.

4. Cookies and analytics

The app uses essential cookies for login sessions. Our marketing website uses minimal, privacy-respecting measurement of page visits; we do not run third-party advertising trackers.

5. Retention and deletion

We keep your account and campaign data while your account is active. If you close your account, you may request an export of your contact data within 30 days, after which we delete personal data from live systems within 60 days (backups expire on their own schedule shortly after). You can delete individual contacts anytime from within the app. Suppression records (unsubscribes and opt-outs) may be retained longer because deleting them could cause someone who opted out to be contacted again.

6. Security

Data is encrypted in transit (TLS) and at rest; access is restricted by row-level security so one business can never see another's data; API credentials are stored in encrypted secret stores and rotated; webhooks are authenticated. No system is perfectly secure, but security is a core design requirement of the platform, not an afterthought.

7. Your rights

Under India's Digital Personal Data Protection Act, 2023, you can request access to, correction of, or deletion of your personal data, and raise grievances. Write to support@growvya.co.in — we respond to data requests within 30 days. If you are an end recipient, we will coordinate with the business that uploaded your details.

8. Changes

If we make material changes to this policy we will notify account holders by email or in-app before the changes take effect.