Privacy Policy

1. Introduction

Growdex Social (“Growdex Social”, “we”, “us” or “our”) is a social media management service operated by Growdex Technology Solutions Limited. Our website, application, integrations and related services (“Services”) help creators, businesses, teams and agencies plan, create, schedule, publish and analyse social media content. This policy explains what personal data we handle, why we handle it, with whom we share it and the choices available to you. This notice does not itself constitute consent; where consent is legally required, we request it separately.

2. Personal information we collect

Account and workspace data: name, email, profile image, login identifiers, organisation, team memberships, permissions, preferences and subscription records.

Connected social accounts: account and page identifiers, usernames, profile details, OAuth tokens, granted permissions, publishing metadata and analytics made available by the relevant platform. We do not ask for social media passwords through OAuth connections.

Content: uploaded photos and videos, captions, drafts, scheduled posts, calendars, comments, approvals, prompts and AI-generated outputs.

Technical data: IP address, device and browser information, session records, usage events, diagnostic logs and approximate IP-based location.

Payments and communications: billing identity, payment and subscription status, transaction references, support requests and messages. Full card numbers are handled by payment providers rather than intentionally stored in our application.

3. How and why we use information

We use information to register and authenticate users; administer workspaces; connect social accounts; store, schedule and publish content; retrieve authorised analytics; deliver AI assistance; process subscriptions; send service emails; provide support; secure the Services; prevent abuse; troubleshoot errors; comply with legal duties; and improve our products where law and platform rules permit. We may send optional marketing messages where permitted, with an unsubscribe option.

4. Legal grounds for processing

Depending on applicable law, our processing relies on contract performance, consent, legitimate interests (including security and reliable operations), compliance with legal obligations or another legally recognised basis. Where we rely on legitimate interests, we consider individuals’ rights. You may withdraw consent where consent is the basis without affecting earlier lawful processing.

5. Social platform connections

Growdex Social may integrate with Meta (Facebook and Instagram), TikTok, LinkedIn, X, Google (YouTube), Pinterest and other platforms as functionality becomes available. Available connections and permissions vary by platform. When you authorise a connection, the provider supplies approved account data or access credentials. We use that access only for features you request, such as account selection, publishing, scheduling, status checks and authorised analytics. We comply with applicable developer terms and do not use restricted platform data for unrelated ad targeting or unauthorised profiling. You may disconnect an account in the app where available or revoke access through the social platform. Revocation does not delete content already published on that platform; associated data is deleted as required by law and platform terms.

6. AI features

AI tools may assist with captions, ideas, rewriting, calendars, content recommendations and related tasks. Prompts, selected content and necessary context may be sent to an enabled AI provider to generate a response. Potential providers include OpenAI (https://openai.com) and Anthropic/Claude (https://www.anthropic.com). Only providers actually configured for the feature receive the relevant data. We do not sell prompts or social account data to AI providers, and we do not authorise restricted platform data for general-purpose model training where prohibited by platform rules. Provider retention and training arrangements depend on the applicable product and contract; users should avoid submitting unnecessary sensitive information. AI output should be reviewed before publishing.

7. Third-party providers and subprocessors

We use third parties to deliver technical and business functionality. A provider’s inclusion below does not mean it receives every user’s data.

Confirmed infrastructure

• Neon (https://neon.com): managed PostgreSQL database for account, workspace, scheduling, connection metadata and other application records.
• Neon Object Storage (https://neon.com/docs/storage/overview): S3-compatible object storage, hosted on Amazon Web Services infrastructure, for uploaded images, videos and other media assets.
• Neon Auth (https://neon.com/docs/auth/overview): sign-in, email verification, password reset and session management.
• Vercel (https://vercel.com): website and application hosting, deployment, request execution and scheduled jobs; may process IP addresses, requests, logs and session-related data.
• Resend (https://resend.com): transactional email delivery, including verification, notifications and service messages; may process email addresses, email content and delivery logs.

Additional product providers, subject to enabled production integrations

• Bachs (https://bachs.io): subscription billing, payment status and transaction processing.
• OpenAI (https://openai.com): AI-powered writing and content generation.
• Anthropic (https://www.anthropic.com): AI-powered writing and content generation.
• Inngest (https://www.inngest.com): scheduled jobs, background processing, publishing workflows and operational event metadata.

Social platform providers

Meta, TikTok, LinkedIn, X, Google/YouTube and Pinterest may receive content and related information when you authorise and request their services. They may act as independent controllers under their own notices.

We engage providers under applicable service agreements and seek appropriate confidentiality, security and data protection safeguards. We may update this list as our Services change.

8. Sharing and disclosures

We share information with providers as needed to operate the Services; with connected social platforms when users request publishing or analytics; with authorised workspace members under their permissions; and with advisers, authorities or counterparties where lawful and necessary for legal compliance, dispute handling or a business transaction. We do not sell personal information. We assess government and legal requests before disclosure.

9. Security

We use risk-appropriate organisational and technical measures such as restricted access, authentication, secure handling of API tokens, encryption in transit where supported, logging and storage permissions. No system is completely secure. We investigate suspected breaches and notify individuals, regulators and relevant platforms when required.

10. Retention

Account records are generally held while the account is active; drafts, scheduled posts and media while needed for requested functions; social platform data only while authorised and necessary subject to platform deletion requirements; transaction records for applicable tax, accounting and dispute obligations; and logs for proportionate security and diagnostic periods. When no longer needed, information is deleted, anonymised or securely disposed of, except for legally permitted retention and temporary backup copies.

11. Deletion and disconnection

You may request account or personal-data deletion using the in-app controls where available or the privacy contact below. Deletion instructions are published at https://www.growdexsocial.xyz/data-deletion. After verifying a request, we assess and delete applicable account data, revoke integrations, remove stored media where required, notify processors when necessary and retain only records lawfully required. Requests are handled within applicable legal and platform deadlines. Deleting Growdex Social data does not automatically remove posts already published to third-party social networks.

12. Your rights

Subject to applicable law, you may request access, correction, erasure, restriction, portability, or object to certain processing; withdraw consent; opt out of marketing; and complain to a supervisory authority. We may verify identity before acting. In Nigeria, the relevant regulator is the Nigeria Data Protection Commission (NDPC).

13. Cookies

We may use essential cookies for authentication, sessions and security, and optional analytics cookies where enabled. Where required, we seek consent before non-essential cookies. Browser and available preference controls can manage cookies, although disabling essential cookies may impair the Services.

14. International transfers

Providers including Neon, Vercel and Resend, and where enabled OpenAI, Anthropic, Inngest and Bachs, may process information outside Nigeria or your country. Where cross-border transfer rules apply, we seek suitable safeguards such as applicable contractual terms, transfer assessments or other recognised mechanisms. Platform data transfers also remain subject to the originating platform’s rules.

15. Teams, agencies and client accounts

Workspace administrators may manage team access and view shared workspace content according to assigned permissions. Businesses and agencies must have authority to connect client accounts and handle client information. Where we process data for a business customer as its processor, the respective roles and obligations may be addressed in a separate data processing agreement.

16. Children

The Services are intended for adults aged 18 or older. We do not knowingly register children under 18. Contact us if you believe a child has supplied information through an account so that we can take appropriate action.

17. External services

Links and integrations may lead to third-party services with independent privacy practices. Review their notices before using those services.

18. Changes

We may revise this policy as features, vendors or legal obligations change. We will update the “Last updated” date and provide additional notice or seek consent where legally required.

19. Applicable law

We seek to comply with the Nigeria Data Protection Act 2023 and, where applicable, the EU GDPR, UK GDPR and other relevant data protection laws and platform developer requirements.

20. Contact