Privacy Policy

Last updated: 18 October 2026

1. Who we are

GrowthOS is a growth and retention platform for hair, beauty and wellness businesses. It connects to a business's booking system, Google Business Profile, Instagram and advertising accounts, shows the owner who booked, who came in and who has not come back, drafts replies to Google reviews, sends booking reminders, review requests and win-back messages, and suggests actions that the owner approves.

GrowthOS is operated by Growth OS Technology Ltd, a company registered in England and Wales, whose registered office is at 3rd Floor, 207 Regent Street, London W1B 3HH. Company number: 17530012.

In this policy, "you" means a business that uses GrowthOS and the people who sign in to it, and "clients" means the customers of that business. For any question about this policy, or to exercise your rights, email privacy@growthosaas.com.

2. Our role: controller and processor

  • Your account and your business. For information about you as our customer (your sign-in details, your business and your billing), we are the controller.
  • Your clients. For information about your clients that we receive from your booking system or through the booking pages we host for you, you are the controller and we act as your processor. We process it only on your instructions, to provide GrowthOS to you, and we do not use it for our own purposes or combine it with another business's data.

3. Information we collect

About you and your business

  • Account information. The name, email address and role of each person who signs in, and your business name, sites and settings.
  • Billing. Your plan and subscription status. Card details are entered on Stripe's own checkout page and are never sent to us.
  • Connected accounts. The access tokens and account identifiers for each service you connect (sections 4 and 5).
  • Usage and security data. Server logs, including IP address, browser type, the pages requested and the time, used to keep the service secure and to fix faults.

About your clients (processed on your behalf)

  • Client records from your booking system: name, email address, phone number, gender and age where your booking system holds them, signup date, first and last appointment, visit count, total spend, last site and team member, referral source, and the client's own consent choices for marketing and for notifications by email, SMS and WhatsApp.
  • Appointment history: service, site, team member, date and time, duration, price, status (booked, attended, cancelled, no-show) and how the booking was made. Contact details on appointment records are stored only as one-way SHA-256 hashes.
  • Booking requests and enquiries made through a booking page we host for you: name, email, phone, the service and time requested, and any note the client adds.
  • Website chat enquiries, if your website uses the tawk.to chat widget and you connect it to GrowthOS: the name, email address and phone number the visitor gives, whether they said they are a new customer or would like offers, and the chat itself. tawk.to sends these to us and we send nothing back to it. We match each enquiry to an existing client where we can, so it can be tied to what that client goes on to book, and we keep it until you or the visitor ask us to delete it or your account is closed (section 9).
  • Visit and campaign data from those pages: which page was visited, the advertising click identifiers and campaign tags in the link (such as UTM tags, the Meta click id and the Google click id), the browser type, and hashed contact details once a booking is made.
  • Messaging records: which reminders, review requests and marketing messages were sent, delivered or refused, and opt-out requests, including SMS STOP replies.
  • Team members: the names of your staff as your booking system lists them, and the revenue attributed to each.

4. Google user data

4.1 Google Business Profile (Google sign-in and consent)

When you choose to connect your Google Business Profile, Google asks you, on Google's own consent screen, to allow GrowthOS one permission (OAuth scope):

https://www.googleapis.com/auth/business.manage (see, edit, create and delete your Google business listings)

This is the only Google OAuth scope GrowthOS requests from customers. We only access a profile that an owner or manager of that profile has granted us, and each customer's profile is accessed separately with that customer's own permission.

With that permission, GrowthOS:

  • reads your business accounts and locations (account and location names, identifiers and Google place id), to know which profile to work with;
  • reads the reviews of your business (the reviewer's public display name and profile photo link, star rating, review text, date and any existing reply), including your review history and new reviews as Google notifies us of them, so you can see and answer them in one place;
  • publishes replies to reviews, either ones you approve or, only if you switch it on in Settings, replies drafted for you under the rules you set;
  • publishes posts and offers to your profile when you or an action you approve asks it to;
  • reads daily performance metrics for your profile (views on Search and Maps, calls, website clicks, direction requests, bookings and conversations), so the dashboard can show how your profile is performing;
  • sets the booking link on your profile, at your instruction.

We do not change your opening hours, services, attributes or other business information.

Where it is stored. Reviews, replies, performance metrics and the account and location identifiers are stored in our database (Supabase, section 6). The Google refresh token that keeps the connection working is encrypted by our application before it is stored, and is used only by our servers.

How long we keep it. For as long as your Google Business Profile stays connected and your account is open. If you revoke our access, we can no longer read or change anything on your profile; the data already stored is deleted when you ask us to delete it or when your account is closed (section 9).

How to revoke access. At any time, from your Google Account at myaccount.google.com/permissions (remove GrowthOS), or by emailing privacy@growthosaas.com and asking us to disconnect it and delete the data.

4.2 Google Analytics and Search Console (access you grant to our service account)

You can also choose to show your website and Google search figures in GrowthOS. This does not use Google sign-in: you add the Google Analytics 4 property id or Search Console site in Settings, and add our service account's email address as a user with read-only access inside Google Analytics or Search Console. We then read, with read-only access, aggregated reports: sessions and key events by channel, top landing pages, new and returning users, and search clicks, impressions, click-through rate, average position, top search queries and pages. These reports are counts, not information about individual visitors. They are stored in our database while the connection is in place. To stop it, remove the service account from your property or site, or clear the field in Settings.

4.3 Limited Use

GrowthOS's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

In particular:

  • we use Google user data only to provide and improve the user-facing features of GrowthOS described above;
  • we do not use it for advertising, we do not sell it, and we do not use it to determine credit-worthiness or for lending;
  • we do not transfer it to anyone except as necessary to provide or improve those features (the sub-processors in section 6, under contract), to comply with applicable law, or as part of a merger, acquisition or sale of assets after notice to you;
  • no person reads it unless you have given us your consent for specific items, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or it has been aggregated and anonymised for internal operations;
  • we do not use Google user data to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models, ours or anyone else's.

4.4 Google data and AI

Two features send a limited part of your Google data to Anthropic (section 6), solely to produce output shown to you:

  • Review reply drafts: the reviewer's display name, star rating and review text, with your business name, are sent to Anthropic's Claude model to draft a reply, which you can edit or reject.
  • The GrowthOS assistant: when you ask it a question or it prepares its weekly suggestions, it can read summaries of your profile performance, review counts and recent low-rated review text, and your aggregated website and search figures.

Anthropic processes this under its commercial API terms, which do not allow data sent through its API to be used to train its models. We do not send Google user data to any other AI provider, and we do not use it to train any model.

5. Instagram and Meta

Instagram. When you connect an Instagram Business or Creator account through Instagram's own login, we request instagram_business_basic and instagram_business_manage_insights. These let us read your account name, your list of posts and each post's performance (reach, impressions, likes, comments, saves, plays). We do not post on your behalf, read your messages, or read follower data. When you disconnect Instagram in GrowthOS, or remove GrowthOS in your Instagram settings under Apps and Websites, the access token and every post record synced through it are deleted. A deletion request made through Instagram can be checked at /instagram-data-deletion.

Meta advertising. If your business advertises on Facebook or Instagram and connects its Meta dataset, we report bookings and visits back to Meta through the Conversions API so you can see which ads brought clients in. Each report carries the event, its value, and the client's email, phone and name only as SHA-256 hashes, with the Meta browser and click identifiers, IP address and browser type where available. We may also read your ad accounts' spend and results to show return on ad spend.

6. Who we share data with (sub-processors)

We do not sell personal data. We share it only with these providers, each only what it needs to provide its part of the service:

  • Supabase (database and sign-in). Stores everything described in this policy, and handles passwords and sign-in links.
  • Vercel (application hosting). Runs the application and receives every web request, with the IP address and browser information that come with it, and keeps server logs.
  • Anthropic (AI). Receives what is described in section 4.4, and for the assistant, aggregated booking, client, Instagram and advertising figures. The assistant is given counts and totals, not lists of your clients, and its tools refuse to pass on an individual client's identifiers.
  • Brevo (email and SMS delivery). Receives the recipient's email address or phone number and the message content for sign-in and account emails, and for the reminders, review requests and marketing messages a business sends to its clients.
  • Stripe (billing). Receives the business name and billing email, and takes card payments directly.
  • Meta (Instagram and advertising). Receives what is described in section 5, and visit events from your booking pages if you add a Meta Pixel to them.
  • Google (Business Profile, Analytics, Search Console and Ads). Receives the replies, posts and booking link you publish (section 4). Where a business has linked Google Ads, a booking that came from a Google ad is reported back to Google Ads with the Google click id and a SHA-256 hash of the client's email address. We also read public rating and review counts for your locations from Google Places.
  • Fresha (booking system). If you connect Fresha, we read your client, appointment, sales and team data from Fresha's data connector, which Fresha delivers through Snowflake. The connection is read-only: we never change anything in Fresha.
  • SimplyBook.me (booking system). If you connect SimplyBook.me, it sends us booking notifications and we read the booking and client details for them.

Some of these providers process data outside the United Kingdom, including in the United States and the European Economic Area. Where they do, the transfer is protected by the safeguards the law requires, such as the UK International Data Transfer Addendum or standard contractual clauses, or an adequacy decision.

7. Messages to your clients and consent

  • Every message GrowthOS sends to a client passes one consent check first. A marketing message (such as a win-back offer) is sent only if that client gave marketing consent for that channel in your booking system; a client with no record is treated as not having consented.
  • Service messages (such as a reminder about a booking the client made) respect the client's notification preferences.
  • An opt-out always wins. Marketing messages include a way to opt out, SMS STOP replies are honoured, and anyone who has asked to stop is not contacted again, whatever the booking system says.
  • As the controller, you are responsible for having a lawful basis to contact your clients and for the consent records held in your booking system.

8. Cookies and similar technologies

  • Our homepage, this policy and the terms set no analytics or advertising cookies.
  • Signing in sets the cookies Supabase needs to keep you signed in, and a short-lived cookie that protects the Google and Instagram connection steps. These are strictly necessary.
  • Booking pages we host for a business (/s/...) ask before setting anything that is not essential. If you choose Accept, they set a first-party cookie, gos_anon, holding a random identifier for up to 13 months, so a visit and the booking that follows it can be linked to the advert that brought you, and they load the business's own Meta Pixel or Google tag if it has added one, which set their own cookies under that business's control and Meta's or Google's policies. If you choose Reject, none of these are set and you can still book. Either way we store your choice in a cookie named gos_consent_ followed by the page's name, for 6 months, and you can change it at any time from Cookie settings at the bottom of the page. When you book, your request goes to the business whichever you choose.

9. How long we keep data, and deletion

  • We keep your account data and the data synced from your connected services for as long as your account is open.
  • Disconnecting a service stops all further access to it. For Instagram, disconnecting also deletes the token and the synced posts at once. For Fresha, disconnecting deletes the stored credentials; for Google, revoking access stops the connection. Data already synced from those is deleted on request or when your account is closed.
  • Closing your account. Email privacy@growthosaas.com from the address on the account. We delete your account and all the data held for your business, including your clients' data and the Google data in section 4, within one month, and confirm when it is done. Data you have already published, such as review replies and posts on Google, stays on Google until you remove it there.
  • A client of a business who wants their data erased should ask that business, or email us. When we erase a client, we keep only a one-way hash of their contact details, so a later sync from the booking system or a later website chat cannot bring their record back and they are never messaged again.
  • Copies held in our providers' backups and logs are removed on those providers' normal cycles.

10. Security

All data is encrypted in transit using TLS, and our database encrypts stored data. Access tokens for connected services are additionally encrypted by our application and are usable only by our servers; they are never shown in your dashboard or to other customers. Each business can see only its own data. Client contact details that are only needed for matching are stored as one-way hashes.

No system is perfectly secure. If we become aware of a breach affecting personal data we will notify the affected business without undue delay and, where required, the Information Commissioner's Office.

11. Our lawful basis

For our customers' data: performance of our contract with you to provide the service, and our legitimate interest in keeping it secure and improving it. Where we send you marketing, the basis is consent, which you can withdraw at any time. For clients' data we act on the business's instructions as its processor, and the business decides its own lawful basis.

12. Your rights

Under UK data protection law you have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. To use any of them, email privacy@growthosaas.com. We respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

13. Children

GrowthOS is a tool for businesses and is not intended for anyone under 18 to sign in to.

14. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your data, we tell account owners by email or in the app before it takes effect.