Privacy Policy
We collect only what we need to run GROWBZ, keep it secure, never sell it, and give you full control over your personal data. This policy explains exactly what we collect, why, and your rights under India's DPDP Act.
What data we collect and where it goes
A plain-language map of how information moves through GROWBZ.
Information We Collect
We collect account details you give us, the catering data you enter, and basic usage info to keep the app working.
We collect information you provide directly, information generated as you use the Service, and a limited amount of technical data automatically.
- Account information: your name, business name, email, phone number and billing details.
- Customer Data: leads, quotes, events, menus, invoices and staff records you enter into GROWBZ.
- Usage & device data: log-in times, feature usage, IP address, browser and device type, collected to secure and improve the Service.
How We Use It
We use your data to run GROWBZ, bill you, provide support, keep things secure, and — only with consent — send product updates.
We use personal data only for clearly defined, lawful purposes:
- To provide, maintain and improve the Service and your account.
- To process payments, issue GST invoices and prevent fraud.
- To provide customer support and respond to your requests.
- To send service-related notices, and — where you have consented — product news.
We do not use your Customer Data to train advertising models, and we never sell personal data to third parties.
Data Storage & Security
Your data is encrypted and stored on secure servers in India, with strict access controls and regular backups.
Customer Data is stored on infrastructure located in India. We encrypt data in transit (TLS 1.2+) and at rest (AES-256), and apply role-based access controls so staff can only reach data they need to support you.
No method of transmission or storage is 100% secure. While we use industry-standard safeguards, we cannot guarantee absolute security and encourage you to enable two-factor authentication.
Third-Party Services
We rely on a few trusted providers — like Stripe for payments and Google for sign-in — who process data only on our instructions.
We share data with a small set of sub-processors strictly to operate the Service. Each is bound by contract to protect your data and use it only as we direct.
- Stripe — processes card and UPI payments; receives billing details but not your Customer Data.
- Google — provides OAuth sign-in and, if you connect it, calendar sync.
- Cloud hosting & email providers — store data and deliver transactional email on our behalf.
A current list of sub-processors is available on request from privacy@growbzcrm.com. We give notice before adding a new sub-processor that handles personal data.
Your data rights at a glance
Six rights you can exercise at any time under India's DPDP Act.
Access
Get a copy of the personal data we hold about you.
Correct
Fix data that is inaccurate or out of date.
Export
Take your data with you in a portable format.
Delete
Ask us to erase your personal data.
Restrict
Limit how we process your data.
Object
Withdraw consent or object to processing.
Your Rights
You can access, correct, export, delete, restrict or object to the processing of your personal data at any time.
Under India’s Digital Personal Data Protection Act, you have the rights summarised in the panel above. You may exercise any of them by contacting our Data Protection Officer.
We will verify your identity before acting on a request and respond within 30 days. There is no charge for reasonable requests.
Data Retention
We keep your data only as long as your account is active, plus a short grace period, then delete it — unless the law requires us to keep records longer.
We retain Customer Data for as long as your account is active. After you close your account or your subscription ends, we retain data for 30 days to allow reactivation and export, then delete or anonymise it.
Certain records — such as GST invoices and financial data — may be retained for longer where required by Indian tax and accounting law, typically up to 8 years.
Children’s Privacy
GROWBZ is a business tool not meant for anyone under 18, and we don’t knowingly collect children’s data.
The Service is intended for businesses and is not directed to individuals under the age of 18. We do not knowingly collect personal data from children.
If we learn that we have collected personal data from a child without appropriate consent, we will delete it promptly. Contact us if you believe this has occurred.
India DPDP Act Compliance
We follow India’s Digital Personal Data Protection Act, act as a Data Fiduciary, and only process data for lawful, notified purposes.
We process personal data in accordance with the Digital Personal Data Protection Act, 2023. Acting as a Data Fiduciary, we process data only for lawful purposes for which you have given consent or which are otherwise permitted under the Act.
- We obtain clear, informed consent before processing personal data where consent is the lawful basis.
- We provide notices in plain language describing what we collect and why.
- We enable withdrawal of consent as easily as it was given.
- We notify the Data Protection Board and affected users of any reportable personal data breach.
Contact our Data Protection Officer
To exercise any of your rights, ask a question, or raise a concern about how we handle your personal data, reach our DPO directly. We respond to verified requests within 30 days.
Data Protection Officer · [Company Legal Name] · [Registered Office Address]