Privacy Policy
Last updated: October 31, 2026
Who we are
GrowRockets and Turbo are operated by GrowRockets Consultoria em TI Ltda, CNPJ 67.546.427/0001-60, Rua Pais Leme, 215, conj. 1713, Pinheiros, São Paulo, SP, 05424-150, Brazil. We are the data controller for the data described in this policy, except where the WhatsApp and Conversion Radar sections below say otherwise.
We process personal data under Brazil's General Data Protection Law (LGPD, Law 13.709/2018). The legal basis is performance of a contract for delivering the service, and consent for analytics tracking.
What we collect
For your account, GrowRockets collects only the data needed to provide the service:
- Your email address (for authentication)
- If you join the Turbo early-access list: your name and WhatsApp number, so our team can contact you about access
- If you apply for an internship on /vagas: name, email, WhatsApp, course, school or bootcamp, current semester, portfolio and LinkedIn links, and your answer about how you use AI, to evaluate the application and contact you. The legal basis is your consent, given on the form
- API keys for connected integrations: PostHog, Amplitude (encrypted at rest with AES-256)
- OAuth tokens for Google Analytics 4 (encrypted at rest with AES-256)
- Aggregated analytics data fetched from your connected tools (funnel metrics, retention rates)
- Product metrics you enter manually or upload via CSV
Businesses that use Turbo also send us the WhatsApp conversations they have with their own customers. That data is covered in the next section.
Our Portuguese-language pages also have a survey, a waitlist, offer pages with a sign-up form and a free account to read our guide. What they collect, why, for how long and on what legal basis is described in the Portuguese version of this policy.
WhatsApp data (Turbo)
Turbo lets a business connect its WhatsApp number through the WhatsApp Business Platform (Cloud API) from Meta and answer its customers from one inbox. When that happens, the business is the controller of its customers' data and we act as its processor (operador, under the LGPD). We handle this data only to provide the service to that business, following its instructions.
What we receive
Meta sends us the following on behalf of the business:
- The phone number and WhatsApp profile name of each person who messages the business
- Messages sent and received: text, photos, audio, video and documents
- Delivery status of messages sent by the business (sent, delivered, read, failed) and their timestamps
- Technical identifiers from Meta, such as message IDs and the business's WhatsApp account and phone number IDs
- If the business connects the number it already uses in the WhatsApp Business app and approves it on the phone: the contacts saved in the app (name and phone number), conversations from the last 180 days, and the messages its team sends from the phone after connecting
How it is stored
Meta delivers messages to us by webhook, and we verify the signature of every call. Message text and contacts are stored in our database, separated by business. Photos, audio, video and documents are downloaded from Meta into private storage, in a folder per business, and only authenticated members of that business can open them. The access token Meta issues to the business is encrypted at rest with AES-256.
What we use it for
We use WhatsApp data only to show conversations in the business's inbox, let its team reply, link each conversation to the right contact and deal, and show whether messages were delivered and read. Within that same service:
- Voice messages customers send are transcribed automatically (OpenAI), so the team can read them in the conversation. The transcript is stored with the message and follows the same retention and deletion rules.
- When the business turns on Rocky, Turbo's AI assistant, the conversation is sent to Anthropic to suggest replies. Nothing goes to the customer without a click from the team, unless the business itself turns on automatic replies.
- New-message alerts on phones and computers are sent encrypted through the Apple, Google or Mozilla notification services, which cannot read their content.
We do not sell or rent this data, use it for advertising, combine it across businesses, or use it to train AI models.
Retention, deletion and export
- Messages, contacts and media are kept while the business's Turbo account is active.
- When the business cancels, we delete all of its WhatsApp data, including database records and media files, within 30 days of cancellation.
- The business can ask for a copy of its messages, contacts and media at any time by writing to privacidade@growrockets.com. We send it in a machine-readable format.
If you messaged a business that uses Turbo and want to access or delete your data, contact that business first. You can also write to us and we will pass your request on to the business.
What we do NOT store
- Raw event data or individual user events from any analytics tool
- API keys or OAuth tokens in plain text
Data encryption
All API keys (PostHog, Amplitude), OAuth tokens (Google Analytics 4) and WhatsApp access tokens are encrypted at rest using AES-256 encryption before being stored in our database. The encryption key is stored separately from the database.
Data retention
Growth review results, initiatives, and your product profile are retained for the duration of your account. When you delete your account, the account is removed at once. If you are the last owner of the company and confirm, the company's Radar totals and requests are also removed at once and the rest of its data within 7 days. Copies in our providers' backups follow their normal cycle.
- Active accounts: data retained as long as your account exists
- Cancelled paid plans: data retained, account reverts to free tier
- Account deletion: the account and the Radar totals and requests at once, the rest of the company within 7 days, backups on the providers' normal cycle
- Connected API keys: encrypted at rest, deleted immediately on disconnection
- Turbo WhatsApp data: deleted within 30 days of cancellation, as described above
- Internship applications: kept while we are hiring for that role or a similar one, and deleted when you ask at privacidade@growrockets.com
Sub-processors
We use the following third-party services to deliver GrowRockets:
- Meta Platforms (US and other countries): WhatsApp Business Platform, for sending and receiving messages
- Supabase (Brazil, São Paulo): database, authentication and media storage
- Vercel (Brazil and US): hosting and serverless functions
- Anthropic (US): AI analysis, Rocky in Turbo, and Rocky in the Conversion Radar demo, as described in the Radar subprocessors section (does not use the data to train its models)
- OpenAI (US): transcription of voice messages (does not use the data to train its models)
- Google (US): Gmail, when a business connects its email to the Turbo inbox
- Sentry (US): error monitoring
- Stripe (US/EU): payment processing
- Resend (US): transactional email delivery
- Cloudflare (US): Turnstile, which checks that a person, not a bot, is submitting a form
- SoWork: our team's internal chat, where new survey answers and sign-ups are announced
- BigDataCorp (Brazil): contact enrichment in Turbo, only when the business turns it on
Your rights
Under the LGPD (article 18) you can ask us to:
- Confirm whether we process your data and give you access to it
- Correct incomplete, inaccurate or outdated data
- Anonymize, block or delete data that is unnecessary or processed unlawfully
- Port your data to another provider
- Delete data processed on the basis of your consent, or withdraw that consent
- Tell you which third parties we share your data with
You can view your data in your settings, delete your account with one click, or write to privacidade@growrockets.com. You can also file a complaint with Brazil's data protection authority (ANPD) at gov.br/anpd.
Cookies and analytics
We use essential cookies to keep you signed in. With your consent, we also use analytics tools (PostHog, Google Analytics, Metricool and Vercel Speed Insights) to understand how the site and the product are used and improve them.
If you decline or don't answer the cookie banner, PostHog still counts visits and clicks in cookieless mode: nothing is stored on your device, sessions are not recorded, and you are counted through a daily anonymous hash that can't be linked to your name, email or phone.
We use Sentry to find errors on the site. Error reports reach Sentry for every visitor, without cookies. Only with your consent, when an error happens, Sentry also keeps a recording of the moments before it, with all text and form fields hidden.
We also use ad measurement cookies from Meta (the Meta Pixel) and Google (Google Ads). They tell us whether a visit, a sign-up or a purchase came from one of our ads. Meta and Google receive this information and handle it under their own privacy policies. We do not send them your name, email or phone number.
Apart from PostHog in the cookieless mode described above, none of these tools load before you accept cookies in the consent banner. If you decline, they stay off and only the essential cookies remain. You can change your choice at any time in , also linked in the footer.
Conversion Radar: who decides about the data
Conversion Radar is software for companies. The data the customer company puts in it (monthly totals by step of the path, the requests it makes and its team) belongs to the company. For that data the company is the controller and GrowRockets is the processor: we handle it only to provide the service, on the company's instructions, under the Data Processing Addendum (DPA) at /en/dpa.
We are the controller of the account data of the people who use Radar (email, name, role in the company), of the sales contacts left in the demo, of security records and of privacy requests. For those, this policy applies directly between you and GrowRockets.
Radar does not store personal data of your company's customers. It stores only totals (how many people signed up, started using it, paid and renewed each month). The spreadsheet is read in your browser and never uploaded to our servers.
What we use the data for and on which legal basis
Each use rests on a legal basis under Brazil's LGPD (art. 7) and, for people in the European Union or the United Kingdom, under the GDPR and UK GDPR (art. 6).
| Purpose | Data | LGPD | GDPR |
|---|---|---|---|
| Create the account, sign in and use Radar | Email, name, role in the company | Art. 7, V (contract) | Art. 6(1)(b) |
| Show where people get stuck and the fixes | Monthly totals by stage, requests | Art. 7, V (contract) | Art. 6(1)(b) |
| Invite colleagues and send service notices | Email of the invitee, text of the notice | Art. 7, V (contract) | Art. 6(1)(b) |
| Reply to people who asked to see Radar with their own company | Name, email, company, site, where they lose most | Art. 7, IX (legitimate interest, business-to-business contact) | Art. 6(1)(f) |
| Protect the service: usage limits, bot checks, error records | IP, browser signals, error messages without personal data | Art. 7, IX (legitimate interest) | Art. 6(1)(f) |
| Measure use of the app and the site | Clicks and screens viewed | Art. 7, I (consent) | Art. 6(1)(a) |
| Handle privacy requests and keep proof | Identifier hash, date, request type | Art. 7, II (legal obligation) and art. 37 | Art. 6(1)(c) and art. 5(2) |
| Keep invoices and accounting records, when there is billing | Billing data | Art. 7, II (legal obligation) | Art. 6(1)(c) |
We do not ask for sensitive personal data (LGPD art. 11, GDPR art. 9) and Radar has no field for it. If you type something like that into a free-text field, such as the note on a request, treat it as a mistake and tell us so we can delete it.
What Radar stores
A summary of what exists and where it comes from:
- Account: email, name (if you give one) and last sign-in date, in the Supabase login.
- Company: name, each person's role (owner, admin, manager, member, read-only) and Radar settings (notices, language, average ticket).
- Totals: the number of people per month and stage (signup, activation, payment, renewal). Numbers only.
- Requests: billing connection, approved mission and the starting point from the revenue scan (average ticket, range and confidence).
- Team invitations: email of the invitee, role and a 7-day validity.
- Demo contact: name, email, company, site and the text about where the company loses most.
- Notes you send through the feedback button, which reach our team as an email.
What Radar never stores
- Name, email, phone, tax ID or any identifier of your company's customers.
- The spreadsheet file: it is read in your browser and only the monthly totals go on to the server.
- Card numbers (they go straight to Stripe, when there is billing) and passwords in plain text.
- Raw analytics events from any tool.
How long we keep it
Radar retention periods. Other modules are covered in the sections above.
| Data | Period |
|---|---|
| Account (email and name) | While the account exists. Removed immediately when you delete the account |
| Monthly totals by stage, connection requests and missions of the company | While the company exists. When the last owner deletes the account and confirms, they go at once; the rest of the company goes within 7 days |
| Contact left in the demo (name, email, company) | Up to 24 months, deleted automatically every week. Sooner if you ask |
| Revenue scan (site, totals typed in, result and the email of whoever asked for the report) | 365 days retention; after that the data is deleted from our database. The IP is kept only as a hash (one-way code). The scan keeps no personal data beyond the email typed in and the numbers entered. When a paid reservation was made, the record stays as proof of payment, without the IP |
| Team invitations | An invitation is valid for 7 days. One that was not accepted is deleted 30 days after it expires |
| Log of privacy requests (export, correct, delete) | 5 years, to show the request was handled. It keeps only a one-way hash of your identifier, never email or name |
| Security questionnaire requests | Only in our team inbox, not in a database. We delete it if you ask |
| Error reports (Sentry) | For the provider plan default, which is 90 days today. No request body and no email |
Radar subprocessors
We use the services below to handle Radar data. The table shows what each one receives and where it sits.
| Company | Purpose | Data | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | Account, monthly totals, requests, invitations and sales contacts | Brazil (São Paulo) |
| Vercel | Hosting for the site and the server functions | Everything that passes through the app, in transit, and access logs | Functions in São Paulo; static pages through the global delivery network |
| Resend | Email delivery: team invitations and notices | Recipient email and name, and the text of the notice | United States |
| Sentry | Error monitoring | Error message and location. No request body, no cookies and no email (removed before sending) | United States |
| Cloudflare (Turnstile) | Checks that whoever submits a public form is a person | Browser signals and IP address, only on public forms | United States and global network |
| PostHog | Usage statistics for the app and the site | Clicks and screens viewed, only after your consent. Never in the demo | United States |
| Anthropic | Answers the questions asked to Rocky in the demo and reads the site in the revenue scan | Totals and public text: the question and the numbers on the demo screen; in the scan, the text of the site home page and the totals typed in. No name or email | United States |
| Stripe | Card payments, when the company buys a paid plan | Billing data. The card number goes straight to Stripe and never passes through our servers | United States and EU |
These three act only under certain conditions: PostHog after your consent, Anthropic when someone asks Rocky a question in the demo or runs the revenue scan, and Stripe when the company buys a paid plan.
What we send to an AI provider is company totals and public text, never personal data. Today that happens in two places, both with Anthropic (United States). In Rocky, the demo assistant, we send the question and the numbers on the screen: from the sample companies, which are fictional, or the ones the person typed in. We do not store the question or the answer; we only count how many questions were asked each day, without knowing who asked. In the revenue scan, we send the public text of the site home page and the totals typed in (signups, payers and average ticket); the email of whoever asks for the report is not sent. The totals of a company connected to Radar do not go to any AI provider. If that changes, only totals will go, with no personal data, and the company will be told beforehand, as the DPA says. Other GrowRockets modules (Turbo and Ignite) also use Anthropic, and OpenAI (United States) for audio transcription.
When a new subprocessor joins or an existing one leaves, we notify the customer company by email before the change. It may object in writing (see /en/dpa).
International transfers
Radar data is stored in São Paulo. Some subprocessors are in the United States and handle data there, such as Resend and Sentry. Those transfers follow each provider's data processing agreement and transfer clauses. Customers who need clauses signed with GrowRockets agree them in the proposal.
We do not claim that Brazil has an adequacy decision across the whole of the European Union. When a provider participates in the EU-US Data Privacy Framework we accept it as an addition to the clauses, not instead of them.
Security
What we do today to protect the data. The /en/seguranca page explains each item in plain language.
- Each company sees only its own data: the database enforces access per company on every table (row-level security), and we test that one company cannot read, change or delete another one's data
- Encrypted connection (HTTPS) across the site, with a 2-year HSTS policy, and data encrypted at rest by the database provider
- API keys and integration tokens encrypted with AES-256 before they reach the database, with the key kept outside the database
- Access by an emailed link or code, or a Google account, with roles inside the company (owner, admin, manager, member and read-only) checked on the server for every request
- Content security policy (CSP) with a fresh code per page, headers against clickjacking and content sniffing, and protection against requests from other sites on actions that change data
- Request limits per person and per network, bot verification and a honeypot field on public forms
- Error reports without request body, cookies, email or code variables, removed before they leave the server
- Secrets only on the server: no secret key reaches the browser, and automated tests check that
We do not hold SOC 2 or ISO 27001 certification. Our controls follow the same line as those standards, and we claim no certification.
Your rights and how to use them
Under the LGPD (art. 18), the GDPR and UK GDPR (arts. 15 to 22), and as a principle also under the LFPDPPP (Mexico, ARCO rights), you can:
- Find out whether we process data about you and get a copy, in a file any program can open (JSON).
- Correct data that is wrong or out of date.
- Delete your account and your data, or ask to block or anonymize what is excessive.
- Take your data to another service.
- Object to use based on legitimate interest and withdraw consent at any time.
- Not be treated differently for exercising a right. We do not sell personal data. If you accept cookies on the site, the Meta pixel and Google Ads measure visits that came from our ads. To turn it off, decline in the cookie banner or in the "Cookies" link in the footer.
- In the product, right away: in Radar Settings, under "Privacy and data", you download your data, correct your name and delete your account. Owners and admins also download company data.
- By email: privacidade@growrockets.com. We answer within 15 days, sooner when we can.
- If the request comes from your company about its customers' data, the company is the controller and reaches us through the DPA.
You may complain to Brazil's National Data Protection Authority (ANPD, gov.br/anpd) or, in the European Union, to the data protection authority in your country.
Data protection officer (DPO)
The data protection officer is Rony Lussari. Reach the DPO at privacidade@growrockets.com (or rony@growrockets.com). Customers in the European Union that need a local representative can write to the same address.
Security incidents
If an incident affects personal data, we tell the customer company without undue delay and, when we are the controller, we notify the ANPD and the people affected within the period the law sets (the ANPD currently sets 3 business days; the GDPR asks for notice to the authority within 72 hours of us becoming aware). The notice says what happened, which data, what we have already done and what the person can do.
Children
Radar is for professional use and is not aimed at anyone under 18. We do not collect children's data on purpose. If we find any, we delete it.
Radar cookies and local storage
Radar uses only what it needs to work and to remember your choices. No advertising cookies.
| Name | Purpose | Duration | Type |
|---|---|---|---|
sb-…-auth-token | Session: keeps you signed in after the sign-in link (Supabase) | While the session lasts; renews on each visit | Essential |
turbo_org | Remembers which company you are viewing when you belong to more than one. Only the server reads it; access is always checked in the database | 180 days | Essential |
gr_demo_senha | Remembers that you typed the password for the demo with your company numbers. It holds only a signature, nothing about you | 30 days | Essential |
radar_locale | Language and currency you chose (Portuguese, English or Spanish) | 1 year | Preference |
gr-theme (armazenamento local) | Light or dark theme. It stays in your browser and is not sent anywhere | Until you clear your browser | Preference |
cookie-consent (armazenamento local) | Stores whether you accepted or declined measurement cookies, so we do not ask again | Until you clear your browser | Essential |
The demo (/demo and /exemplos/radar) opens through your account, like the rest of the app, and the same cookie notice applies. Usage measurement starts only after you accept in the cookie banner.
Contact
GrowRockets Consultoria em TI Ltda · CNPJ 67.546.427/0001-60
Rua Pais Leme, 215, conj. 1713, Pinheiros, São Paulo, SP, 05424-150, Brazil
Privacy questions: privacidade@growrockets.com
Data protection officer (encarregado): Rony Lussari, rony@growrockets.com