Privacy Policy
Last updated: 18 October 2026
This policy explains what personal data Grow Checkup collects, why, and your rights. The data controller is Fikriform İletişim Hizmetleri ve Ticaret Limited Şirketi, Cevizli Mh. Zuhal Cd. A Blok No: 46 İç Kapı No: 50, Maltepe, İstanbul, Türkiye ("we", "us"). Contact us about privacy at hello@growcheckup.com.
1. What we collect
- Checkup answers: your answers to the Brand Health Check, your score and the recommendations we generate.
- Contact and business details: your email, business or brand name, and, if you choose to add them, your industry, Instagram handle, website and location.
- Content you upload: for example logos, photos, posts, captions and brand guides.
- Account and plan data: your plan, tasks, check-up history and how you use the service.
- Payment data: handled by Paddle. We receive your name, email, country, what you bought and payment status, but not your full card details.
- Technical data: device, browser, pages visited and the ad or link that brought you to us.
The service is not intended for people under 18, and we don't knowingly collect their data.
2. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Show your score, send your results, deliver reports and plans | Contract (to provide what you asked for) |
| Payments, invoices and tax records | Contract and legal obligation |
| Marketing emails with tips and offers | Your consent, given with a separate checkbox that is never pre-ticked |
| Improving our questions, scoring and content; security and fraud prevention | Legitimate interests |
| Anonymous industry benchmarks (for example, average scores by business type) | Legitimate interests; benchmarks contain no personal data |
| Ad measurement cookies and pixels | Your consent where the law requires it |
3. Marketing consent
We only send marketing emails if you tick the box that says "Send me practical brand tips and offers. Unsubscribe anytime." or a similar clearly labelled box. We record when and where you gave consent and the exact wording you saw. Buying from us does not by itself sign you up for marketing. You can unsubscribe at any time with one click in any marketing email, and we will still send the service emails you need, such as your report and receipts.
4. Who we share data with
We don't sell your personal data to third parties. We use these service providers, who process data on our behalf under contracts that protect it:
| Provider | What for | Location |
|---|---|---|
| Vercel | Website hosting | United States |
| Supabase | Database, login and file storage | United Kingdom (London region), with support access from other countries |
| Paddle | Payments, invoices, tax (Paddle is the Merchant of Record and an independent controller for payment data) | United Kingdom and other countries |
| Resend | Service emails such as your score and report | United States |
| Loops | Marketing emails, only if you opt in | United States |
| PostHog | Product analytics | European Union |
| Anthropic | Generating written explanations, captions and analysis from your answers and uploads | United States |
| Meta | Measuring our ads (Meta Pixel and Conversions API), only after you accept cookies | United States and other countries |
| Website analytics (Google Analytics 4), only after you accept cookies | United States and other countries |
We may also share data when the law requires it, or to protect our rights and users.
5. If the business changes hands
If Grow Checkup, or all or part of its business or assets, is sold, merged or transferred, your personal data may be transferred to the new owner as part of that transaction. The new owner may use it only for the purposes described in this policy, and your marketing preferences and consent records transfer with it. We will tell you before your data becomes subject to a different privacy policy.
6. International transfers
We are based in Türkiye and some providers are in other countries, including the United States. When data leaves the UK, the EU or Türkiye, we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses or the UK International Data Transfer Addendum, and on the transfer rules of Turkish data protection law (KVKK).
7. How long we keep data
- Checkup results for people who don't buy: 24 months after your last activity, then deleted or anonymised.
- Customer account data: while your account is active and up to 24 months after it closes.
- Invoices and tax records: as long as tax law requires.
- Consent records: as long as needed to prove consent, including after you unsubscribe.
8. Your rights
Depending on where you live (for example under the UK GDPR, the EU GDPR, Canadian, Australian or New Zealand privacy law, or KVKK), you can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent at any time. Email hello@growcheckup.com and we'll respond within one month. You can also complain to your local data protection authority, such as the UK Information Commissioner's Office.
9. Cookies
We use essential cookies to run the site and keep you logged in, and to remember your cookie choice. These don't need your consent.
Measurement tools load only after you choose "Accept" in our cookie banner. Until you choose, and if you choose "Reject", they don't load and nothing is sent to them:
| Tool | Provider | Purpose |
|---|---|---|
| Meta Pixel and Conversions API | Meta Platforms | Tells us which ads bring people to the site and whether they start or finish the checkup, see their score, leave their email or buy. With your consent our server also sends these events to Meta, together with your IP address, browser details and a one-way hash of your email (never the email itself), so Meta can match them to its ads. |
| Google Analytics 4 | Counts visits and shows how people use the site, so we can improve it. It sets cookies such as _ga. |
We keep your choice in a cookie and in your browser's local storage for about six months, then ask again. You can change your choice any time with "Cookie settings" at the bottom of every page. If you withdraw consent, the tools stop receiving data from that moment.
To count visits we use a simple counter that sets no cookies and stores nothing on your device. For each page view it records the page, where the visit came from (for example the link tags of an ad, or the referring website), how long the page was open on screen and how far it was scrolled, and a visitor code that changes every day. The code is made from a one-way hash of your IP address and browser, so we can count daily visitors without being able to identify you or follow you from one day to the next. We don't store your IP address.
10. Security
We use encryption in transit, access controls and row-level security in our database so each customer can only see their own data.
11. Changes
We'll post any changes here with a new date and email you about material changes.