Privacy Policy

This policy covers data processed when you use GrowthOS and our marketing website.

Each product may process different categories of data depending on how you use it. Workspace owners and admins control most team data inside the product.

Information you provide

• Name, email, phone, company name, and role when you register, book a demo, or submit a form
• GSTIN and billing details when you subscribe to a paid plan
• Messages you send us (support tickets, demo requests, productivity audit submissions)
• Content you create in our products (tasks, deals, candidates, sequences, files you upload)

Information collected automatically

• Device and browser type, approximate location (country/region), pages viewed, and referral source
• Product usage events (e.g. feature usage, errors) to keep the service reliable
• Session and authentication tokens required to keep you signed in
• IP address and timestamps for security and fraud prevention

Information from third parties

• Payment confirmation from Razorpay (we do not store full card numbers)
• Profile data from integrations you connect (Slack, GitHub, Notion, etc.) — only with your permission
• Product data you create in GrowthOS (ideas, PRDs, backlog items, sprint plans)
• Business profile data from enrichment providers (e.g. Apollo) when you submit a work email on a form — title, company, LinkedIn URL, and firmographics used so our sales team can respond relevantly. Free personal email domains are not enriched.

We use personal data to:

• Provide, maintain, and secure our website and products
• Create and manage your account and workspace
• Process subscriptions, invoices, and GST-compliant billing
• Respond to demo requests, support questions, and productivity audit submissions
• Enrich submitted work emails with business profile data so sales can follow up with relevant context
• Send transactional emails (receipts, security alerts, product notifications you enable)
• Send marketing emails only when you opt in — unsubscribe anytime
• Run AI features you request (sprint planning, standups, lead scoring, etc.) using your workspace context
• Analyse aggregated, anonymised usage to improve performance and UX
• Comply with law and enforce our Terms of Service

We do not use your private workspace content to train public AI models. AI processing is scoped to delivering features within your account.

We process personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (DPDP Act) where it applies. Depending on context, we rely on:

• Consent — e.g. marketing emails, optional cookies, connecting third-party integrations
• Contract — providing the service you signed up for
• Legitimate interests — security, fraud prevention, and product improvement (balanced against your rights)
• Legal obligation — tax records, lawful requests from authorities

Where consent is required, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

We use a minimal cookie set:

• Essential cookies — authentication, session security, load balancing (required for the service)
• Analytics — privacy-friendly analytics (Plausible) that does not use cross-site tracking or sell data to ad networks.
• First-party attribution — we store a visitor id and first-touch campaign parameters (UTMs) in local storage so we can understand which channels bring customers. This is not sold to ad networks.
• B2B visitor identification — when enabled, we may use a service such as RB2B to identify companies or professionals visiting the site so our sales team can follow up. This runs only when configured for a deployment.
• Advertising cookies — optional Meta Pixel and LinkedIn Insight Tag, loaded only after you accept cookies on the banner. Used to measure paid campaigns. You can reject these at any time by clearing site data and choosing Reject on the banner.

You can control cookies through your browser settings. Blocking essential cookies may prevent you from signing in.

We share personal data only when necessary:

• Infrastructure — AWS (ap-south-1, Mumbai) for hosting and storage
• Payments — Razorpay for subscription billing
• AI providers — e.g. Anthropic/AWS Bedrock to power AI features you use (data processed under our agreements)
• Communications — email and notification providers to deliver transactional messages
• Scheduling — Cal.com (or similar) when you book a demo through our site
• Lead enrichment — Apollo (or similar) to look up business profile data for work emails you submit on forms, so we can respond with relevant context
• Integrations you enable — Slack, GitHub, Notion, WhatsApp, etc., per your workspace settings

All subprocessors are bound by confidentiality and data-processing terms. We do not sell or rent your personal data to third parties for their marketing.

• Account data — kept while your account is active and for a reasonable period after closure to handle disputes and legal obligations
• Billing records — retained as required under Indian tax and accounting law (typically 7 years)
• Marketing leads — until you unsubscribe or ask us to delete your details
• Support logs — typically up to 24 months, unless needed longer for security investigations

Workspace admins may export or delete workspace data subject to product capabilities and their own compliance requirements.

We protect data using measures appropriate to a B2B SaaS platform, including:

• Encryption in transit (TLS) and encryption at rest for stored data
• Role-based access controls and audit logging on enterprise tiers
• Regular backups and monitoring in AWS ap-south-1
• Security reviews for authentication, API access, and payment flows

No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact support@salesshuru.com immediately.

Depending on applicable law, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (subject to legal retention requirements)
• Withdraw consent for optional processing (e.g. marketing)
• Export your data in a portable format where the product supports it
• Nominate a person to exercise rights on your behalf in certain circumstances (DPDP Act)

To exercise these rights, email privacy@salesshuru.com. We respond within 30 days for most requests.

Grievance officer (DPDP Act): For complaints under Indian data protection law, contact our Grievance Officer at grievance@salesshuru.com. We will acknowledge complaints within the timelines prescribed by applicable regulations.

Our services are intended for businesses and professionals. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact privacy@salesshuru.com and we will delete it promptly.

Primary data storage is in India (AWS ap-south-1). Some subprocessors (e.g. AI or email providers) may process data in other countries. Where data leaves India, we ensure appropriate safeguards through contractual protections and vendor assessments.

We may update this Privacy Policy when we launch new products, change subprocessors, or when law requires it. We will post the revised policy on this page and update the "Last updated" date. Material changes affecting existing customers will be communicated by email or in-product notice where appropriate.