Privacy Policy

Privacy Policy

We are committed to protecting your personal information in accordance with the Digital Personal Data Protection Act, 2023.

6 min read·Updated October 2026

1. Information We Collect

We collect information you provide directly to us, including:

  • Name, email address, and contact information
  • Company name and business website URL
  • Payment information (processed by Cashfree, not stored by us)
  • Business credentials for platforms your agent manages

We also automatically collect certain technical information when you use our Service, including IP addresses, browser type, and pages visited. If you accept analytics cookies, we use Google Analytics and PostHog to understand website usage patterns.

By submitting your information through our forms, you consent to the collection and processing of your personal data as described in this policy, in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act). For users in the European Economic Area (EEA), processing is also governed by the General Data Protection Regulation (GDPR).

2. How We Use Information

We use your information to:

  • Configure and operate your dedicated AI agent
  • Process payments and send billing communications
  • Send service notifications and updates
  • Provide customer support
  • Improve our Service through aggregated analytics

We will only send marketing communications if you have provided explicit consent. You may withdraw consent at any time by emailing [email protected].

3. Lawful Basis for Processing (GDPR)

For users in the EEA, we process personal data under the following lawful bases:

  • Contract performance — processing necessary to deliver the AgentGrow Service you subscribed to (agent configuration, content generation, CRM management)
  • Consent — for marketing communications, cookies, and analytics. You may withdraw consent at any time.
  • Legitimate interests — for security monitoring, fraud prevention, and service improvement, where these interests do not override your rights
  • Legal obligation — where required by applicable law (tax records, regulatory compliance)

4. Information Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. We may share information with:

  • Cashfree Payments (payment processing)
  • AWS SES (transactional email delivery)
  • Top-performing AI models that we run on our own infrastructure in India, for the text your agent writes (no third-party AI service processes that text; data you choose to send to your own AI assistant is covered in section 5)
  • Google (Gemini image generation for blog and social images, which receives the image description only; Search Console and YouTube when you connect them)
  • ElevenLabs and Twilio (AI voice calls and phone numbers, Enterprise Voice Outreach only)
  • Apify (web research to find leads, Growth and Enterprise Prospector only)
  • GitHub (hosts your agent’s blog on GitHub Pages)
  • Meta and LinkedIn (posting to the accounts you connect)
  • Telegram (the group you use to talk to your agent)
  • Cloudflare (networking and security)
  • Google Analytics and PostHog (website usage analytics, only if you accept analytics cookies)
  • Legal authorities when required by law
  • Successors in case of a business transfer

5. AI Assistant Connectors

You can choose to connect an AI assistant, such as Claude, ChatGPT or Perplexity, to your AgentGrow account. Nothing is connected unless you, or an active member of your team, sign in and allow it. When the assistant asks, AgentGrow sends it the account data its tools return:

  • Counts: pending approvals, prospects by status, this week’s agent activity by category, and your agent’s status
  • Approvals: the drafts your agent is waiting to publish, with their title, category, description, full text, preview link, target platforms, status and dates
  • Prospects: name, company, stage, status, score and last contact date (no email address, phone number or email body)
  • Prospect timelines: for each email, reply, call or meeting, its date, channel and direction with a one-line subject or outcome, plus the next follow-up date (never full emails)

That provider processes this data under its own terms and privacy policy. AgentGrow does not control it, and the provider is not our sub-processor: the transfer happens because you chose to connect it and asked it a question.

For each connection we store the assistant’s name and the addresses it registered, the permissions you granted, who connected it, when it was created, last used and revoked, and its access and refresh tokens as one-way hashes, never the tokens themselves. Access tokens expire after 1 hour and refresh tokens after 30 days without use. We keep these records, including revoked connections, for as long as your account exists, and delete them with your account data when you ask us in writing.

For each tool call we log the tool name, your masked email address, the assistant’s client id and the outcome. We never log what the assistant asked for or what was returned. If you allow the assistant to approve or reject drafts, each decision is recorded as “<your name> via <assistant name>”.

You can revoke any connection at any time on the Connected apps page of your portal; it stops working on its next call. Removing a team member also ends their connections. More detail is in our AI assistants help page.

6. Cross-Border Data Transfer

Some of the service providers listed above (for example AWS, Cloudflare, Google, ElevenLabs, Twilio, Apify, GitHub and PostHog) may process data outside India. By using our Service, you consent to the transfer of your data to jurisdictions that may have different data protection standards, as permitted under the DPDP Act, 2023. For EEA users, transfers to countries outside the EEA are made pursuant to the service providers' standard contractual clauses (SCCs) or other appropriate safeguards under GDPR Article 46. We ensure that all service providers maintain adequate security measures.

7. Data Security

We implement security measures including isolated Kubernetes namespaces per client, encrypted secrets management, network policy enforcement, and TLS encryption for all data in transit. Credentials are stored as Kubernetes Secrets and never logged.

8. Data Retention

We retain your data for as long as your subscription is active. When you cancel, your agent is paused at the end of the period you have paid for, and your data is kept. We delete it when you ask us in writing at [email protected]. You can export your leads and activity as CSV files from your portal at any time. Lead capture data from website forms is retained for 2 years unless you request earlier deletion.

9. Your Rights

Under the DPDP Act, 2023 and applicable laws, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request deletion (erasure) of your data
  • Withdraw consent for data processing
  • Data portability (export your leads and activity as CSV files from your portal)
  • Nominate another person to exercise your rights on your behalf

To exercise these rights, contact us at [email protected]. We will respond within 7 business days.

10. Cookies

Analytics cookies (Google Analytics and PostHog) are set only after you click Accept on our cookie banner. If you reject them, they are never loaded. Your portal login is kept in your browser’s storage for 24 hours, not in a cookie. We do not use advertising or retargeting cookies.

11. Grievance Officer

In accordance with the Information Technology Act, 2000 and DPDP Act, 2023, for any privacy concerns or complaints, contact:

gheWARE uniGPS Solutions LLP, 2146 Sunscape, Sobha Hillview, Kanakapura Road, Bengaluru, Karnataka, INDIA 560109.

Grievances will be acknowledged within 24 hours and resolved within 15 days of receipt.