Privacy Policy

Effective: 27 July 2026

Who we are

GrowthForceOS is a customer-relationship platform operated by GrowthFather Private Limited, a company incorporated in India (for customers and data principals in India), and GrowthFather LLC(for customers everywhere else). In this policy, “we” refers to the entity that contracts with your workspace. For most data in the product, the business that owns your workspace is the data controller/data fiduciary and we act as its processor; for your account and billing data we act as controller.

Data we process

Account data (name, work email, role, sign-in records); lead data your workspace captures (name, phone, email, city, deal value, notes); communications and activity (calls logged, messages, follow-ups, timeline events) and consent records; device data for the mobile app (push token, platform); and usage/audit logs.

Data received from connected platforms

When a workspace owner connects an integration, we receive lead data from that platform on the workspace’s behalf: Meta Platforms (Facebook Lead Ads form submissions and related ad/campaign identifiers), Google (Google Ads lead form submissions), IndiaMART (buyer enquiries), and services connected through Zapier, Pabbly Connect or webhooks. Platform data is used solely to create and manage leads inside that workspace’s CRM, is never sold, and is handled in line with each platform’s terms (including Meta’s Platform Terms). Where a workspace enables lead-quality sync, we send lead outcome signals (e.g. qualified, converted) back to the originating ad platform to improve that workspace’s campaigns.

Purpose & lawful basis

We process lead and communication data to provide the CRM and outreach features each workspace configures — on the basis of the consent captured at lead capture and recorded in our consent ledger, and to perform our contract with the workspace. Marketing/outreach channels (calls, WhatsApp, SMS, email) are gated on recorded consent and honour opt-outs.

Sharing & sub-processors

We do not sell personal data. We share it only with the infrastructure providers needed to run the service (cloud hosting, managed database, email and messaging delivery, payment processing), each bound by data-protection agreements, and where the law requires disclosure. A current sub-processor list is available on request.

International transfers

Data may be stored or processed in regions where our infrastructure providers operate. Where data leaves its origin jurisdiction we rely on appropriate safeguards (contractual protections consistent with the DPDP Act and GDPR).

Retention

We retain personal data for as long as needed to provide the service. Erased records are removed from the product immediately and hard-deleted after the configured retention window; consent records are retained (without lead linkage) as an audit trail.

Security

Data is isolated per workspace (enforced with row-level security), encrypted in transit, and sensitive fields and integration credentials are encrypted at rest. Access is authenticated, role-gated, and audited.

Your rights (data principals)

You may request access to, correction of, or erasure of your personal data, and may withdraw consent at any time, by contacting the business you shared your details with or by writing to us directly at the address below.

Data deletion

To delete your data: (1) if you are a lead or customer of a business using GrowthForceOS, ask that business to erase your record — owners can erase any record from within the app, which removes it immediately; (2) if you are a GrowthForceOS user, your workspace owner can remove your account, or you can email us; (3) if you connected a Facebook account or Page and want that connection and its data removed, disconnect the integration in Owner → Integrations, or email us. For any deletion request, write to hello@growthfather.com with the phone number or email the record was created under — we action requests within 30 days and confirm when complete.

What is deleted: the record and everything attached to it — name, phone, email, city, deal value, notes, call and message history, tasks, follow-ups and timeline events. For a GrowthForceOS user account: the name, work email, role, sign-in records and any mobile push token registered by the app.

What is kept, and for how long: erased records leave the product immediately and are permanently removed from our systems within 30 days. After that we keep only (a) consent and opt-out records, stripped of any link to the deleted person, so we can prove a withdrawal was honoured, and (b) invoices and payment records, which Indian tax law requires us to retain for eight years. Neither can be used to reconstruct the deleted record. Encrypted backups are cycled out within 30 days.

Grievance officer & contact

For privacy questions, complaints, or to exercise your rights, contact our Grievance Officer at hello@growthfather.com (GrowthFather Private Limited for Indian data principals; GrowthFather LLC elsewhere). We respond within the timelines required by applicable law.

Changes

We may update this policy as the product and the law evolve; material changes are notified in-app and the effective date above is revised.