Privacy Policy

1. Information We Collect

Depending on how you interact with Growzamp—as a content creator, a mobile app founder, or a pre-launch visitor—we may collect the following categories of information:

• Waitlist & Contact Information: Your full name, email address, company or channel name, primary social media handles, audience size bracket, and app store listings (for founders).
• Account & Authentication Data: If you register or authenticate via our secure authentication provider (Supabase Auth), we store unique user identifiers (UUIDs), authentication timestamps, and session tokens.
• Attribution & Referral Telemetry: When users interact with verified campaign distribution links, we collect non-reversible cryptographic hashes (SHA-256) of client IP addresses combined with daily rotating salts, user agent signatures, and referral timestamps. We never store raw IP addresses in tracking records.
• Support & Communication Inquiries: Transcripts of emails, help tickets, or inquiries submitted through our support desk.

2. How We Use Your Information

We process collected data exclusively for genuine business purposes, including:

• Administering early access queues and issuing waitlist onboarding invitations.
• Matching creators with relevant mobile application campaigns based on niche and audience fit.
• Validating performance metrics, attribution fidelity, and preventing fraudulent clicks or bot activity.
• Processing payouts, verifying tax documentation, and maintaining audit logs.
• Responding to support tickets, user feedback, and security alerts.

3. Information Sharing and Disclosure

We do not sell, rent, or monetize your personal information to third parties or advertising networks. We share data only under the following limited conditions:

• Between Matched Creators and Founders: Aggregate campaign performance data (e.g., total installs generated, conversion rates) is visible between participating parties. Private personal contact information is never disclosed without consent.
• Infrastructure Providers: Trusted cloud and database providers (such as Supabase PostgreSQL for encrypted storage) operating under strict data processing agreements.
• Legal & Safety Requirements: If compelled by lawful subpoena, court order, or to prevent imminent fraud or platform abuse.

4. Data Protection & Security

We implement comprehensive technical and organizational safeguards designed to protect your data against unauthorized access, destruction, or alteration:

• All web traffic is enforced over TLS 1.3 encryption in transit.
• Databases are hosted in SOC 2 Type II compliant facilities with encrypted storage at rest (AES-256).
• Row-Level Security (RLS) policies isolate tenant records directly at the PostgreSQL engine level.
• Strict least-privilege administrative access controls and multi-factor authentication (MFA) requirements for staff.

5. Your Rights and Choices

Regardless of your jurisdiction (including GDPR in Europe and CCPA in California), you have explicit rights concerning your personal information:

• Right of Access & Correction: You can request a copy of the personal data we hold about you or ask us to update outdated details.
• Right to Erasure (Right to Be Forgotten): You may request complete deletion of your waitlist submission or user profile at any time.
• Marketing Opt-Out: Every email notification includes a one-click unsubscribe mechanism.

6. Contacting Us

If you have any questions, privacy requests, or wish to exercise your rights, please reach out to our privacy compliance team: