Data Processing Addendum (DPA)
October 31, 2026
This addendum applies between the customer company (the "Customer", the controller of the data) and GrowRockets Consultoria em TI Ltda ("GrowRockets", the processor) when GrowRockets processes personal data on the Customer's behalf in Conversion Radar. It is part of the Terms of Service and applies on its own when the Customer accepts the Terms. If you need a copy countersigned, write to privacidade@growrockets.com.
It meets article 28 of the GDPR and UK GDPR, articles 39 and 42 to 46 of Brazil's LGPD and, for Mexico, the contract requirement between data controller and processor under the LFPDPPP.
1. Subject matter, nature and duration
GrowRockets processes the personal data needed for the Customer to use Radar: storing monthly totals by stage, showing where people get stuck, recording requests and fixes, managing the Customer's team and sending it notices. Processing lasts as long as the Customer uses the service and ends as clause 9 says.
Data subjects: the Customer's team members who use Radar (invitees or account owners). Data: email, name, role in the company, last sign-in date, and the content of the requests and notes they write. Radar is built not to receive personal data of the Customer's customers: it stores only totals. The Customer agrees not to send such data, not even in a free-text field.
Artificial intelligence: what GrowRockets sends to an AI provider is company totals and public text, never personal data of a data subject. Today the totals of a Customer connected to Radar do not go to AI. If they start to, they will still be totals only, and GrowRockets will tell the Customer beforehand, the same way as in clause 5.
2. Customer instructions
GrowRockets processes the data only on the Customer's documented instructions: the Terms, this addendum and the Customer's use of product features. If an instruction seems to breach data protection law, GrowRockets tells the Customer and may pause carrying it out until the Customer confirms or corrects it.
3. Confidentiality
People at GrowRockets who access the Customer's data are bound by a duty of confidentiality and access only what the work requires.
4. Security
GrowRockets keeps technical and organizational measures suited to the risk (GDPR art. 32, LGPD art. 46), described at /en/security. They include: isolation per company in the database, tested; encryption in transit and at rest; separate encryption of keys and tokens; role-based access control; usage limits; error logging without personal data; and fixing known flaws. We may update the measures, never to a lower level of protection.
5. Subprocessors
The Customer gives general authorization for the subprocessors in the table below. With each one, GrowRockets uses the data processing agreement that the provider itself offers, and it is liable to the Customer for their acts.
To add or replace a subprocessor, GrowRockets notifies the Customer by email, at the account owner's address, before the change. The Customer may object in writing on reasonable data protection grounds. If no solution is found, the Customer may end only the affected service and get back what it paid for the remaining period. A fixed notice period, when the Customer needs one, goes in the proposal.
| Company | Purpose | Data | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | Account, monthly totals, requests, invitations and sales contacts | Brazil (São Paulo) |
| Vercel | Hosting for the site and the server functions | Everything that passes through the app, in transit, and access logs | Functions in São Paulo; static pages through the global delivery network |
| Resend | Email delivery: team invitations and notices | Recipient email and name, and the text of the notice | United States |
| Sentry | Error monitoring | Error message and location. No request body, no cookies and no email (removed before sending) | United States |
| Cloudflare (Turnstile) | Checks that whoever submits a public form is a person | Browser signals and IP address, only on public forms | United States and global network |
| PostHog | Usage statistics for the app and the site | Clicks and screens viewed, only after your consent. Never in the demo | United States |
| Anthropic | Answers the questions asked to Rocky in the demo and reads the site in the revenue scan | Totals and public text: the question and the numbers on the demo screen; in the scan, the text of the site home page and the totals typed in. No name or email | United States |
| Stripe | Card payments, when the company buys a paid plan | Billing data. The card number goes straight to Stripe and never passes through our servers | United States and EU |
What we send to an AI provider is company totals and public text, never personal data. Today that happens in two places, both with Anthropic (United States). In Rocky, the demo assistant, we send the question and the numbers on the screen: from the sample companies, which are fictional, or the ones the person typed in. We do not store the question or the answer; we only count how many questions were asked each day, without knowing who asked. In the revenue scan, we send the public text of the site home page and the totals typed in (signups, payers and average ticket); the email of whoever asks for the report is not sent. The totals of a company connected to Radar do not go to any AI provider. If that changes, only totals will go, with no personal data, and the company will be told beforehand, as the DPA says. Other GrowRockets modules (Turbo and Ignite) also use Anthropic, and OpenAI (United States) for audio transcription.
6. Data subject rights
If a data subject asks GrowRockets for something about data it processes for the Customer, GrowRockets forwards the request to the Customer without delay and does not answer on its own, unless the law requires it. Radar includes tools in Settings to download, correct and delete data, and GrowRockets helps the Customer with anything missing, within a reasonable time.
7. Help with the Customer's compliance
Within the information it has, GrowRockets helps the Customer with data protection impact assessments, prior consultation with the authority, and the security and breach notification duties.
8. Personal data breach
If GrowRockets learns of a breach affecting the Customer's personal data, it notifies the Customer without undue delay. The notice says, as far as known: what happened, which data and how many people, the likely consequences and what is being done. GrowRockets cooperates on the investigation and on telling authorities and data subjects, which is the Customer's decision.
9. Return and deletion
The Customer can download the data at any time (Settings, Privacy and data). When the Customer closes the account, or the contract ends, GrowRockets deletes the data: Radar totals and requests at once, the rest of the company within 7 days, and what sits in providers' backups in their normal cycle. GrowRockets keeps only what the law requires it to keep, such as billing records, and names the law if the Customer asks.
10. Audits and information
GrowRockets gives the Customer the information needed to show compliance with this addendum by answering the security questionnaire (request it at /en/security). An audit beyond that, when the Customer needs one, is agreed in the proposal, at the Customer's cost and under confidentiality. GrowRockets does not hold SOC 2 or ISO 27001 certification today.
11. International transfers
Radar data is stored in São Paulo. Subprocessors outside Brazil handle data under the data processing agreements and transfer clauses they themselves offer.
If the Customer is in the European Union, the European Economic Area, Switzerland or the United Kingdom and needs standard contractual clauses signed with GrowRockets, they go in the proposal.
12. Liability, term and order of precedence
Each party's liability follows the limits in the Terms of Service, without removing what data protection law does not allow to be limited. This addendum lasts as long as GrowRockets processes the Customer's data. In a conflict on personal data, this addendum prevails and, above it, any standard clauses signed in the proposal.
Contact
Data protection officer (DPO): Rony Lussari, privacidade@growrockets.com. Last updated: October 31, 2026.
See also the Privacy Policy, the Terms of Service and the Security page. Privacy Policy · Terms of Service · Security