Privacybeleid / Privacy Policy

1. Who is responsible

GrowMachine is operated under the name Studio Ghost Town, Stationsplein 26, 6512 AB Nijmegen, the Netherlands. For the account, billing, support and security processing described here, Studio Ghost Town acts as controller under the GDPR (AVG). Contact us at growmachine@studioghost.town.

A business customer may be the controller of personal data in its uploaded content or campaigns, with GrowMachine acting as processor on that customer's instructions. That relationship requires a separate Article 28 data processing agreement; this notice does not establish one. Social platforms and payment providers can act as independent controllers for their own processing.

2. Data and its sources

• Account and profile: email, authentication information, name, company, industry, target location and brand context you provide.
• Waitlist and correspondence: email submitted for launch updates, messages, support requests and information you include in them.
• Connected accounts: account identifiers, usernames, profile information, authorised permissions, access/refresh tokens and expiry information received through the platform's authorisation process.
• Content and activity: uploaded images/videos, captions, prompts, AI output, collaborator handles, publishing choices, publication identifiers, results and errors.
• Campaigns and billing: budgets, targeting settings, platform performance metrics and payment amounts, descriptions, identifiers and status received from the relevant platform or payment provider.
• Optional Telegram integration: chat identifier, username, first name, link status and post-approval interactions supplied through Telegram.
• Technical information: IP address, request/browser information and diagnostic or security events processed by the application and hosting providers.

Information comes from you, your use of the service, accounts you authorise and the providers involved in the requested feature. Content and AI prompts can contain personal data about other people. Do not submit sensitive personal data, such as health information or political beliefs, unless appropriate lawful processing arrangements have been agreed.

3. Purposes and legal bases

• Providing your service (Article 6(1)(b)): account access, requested connections, AI assistance, publishing, campaign management, payments and essential service messages, where necessary to perform our contract with you.
• Legitimate interests (Article 6(1)(f)): administering business-customer relationships and contacts, responding to enquiries, maintaining security, preventing abuse, diagnosing faults and handling legal claims. These interests are balanced against your rights; you may object.
• Legal obligations (Article 6(1)(c)): required tax/accounting records and responses to binding legal requests.
• Consent (Article 6(1)(a)): requested waitlist launch emails and any optional marketing or non-essential tracking introduced with consent. You can withdraw at any time by contacting us or using an available unsubscribe control.

Connecting an account is your instruction to enable that feature, not blanket consent for unrelated uses. Where we act as your processor, the customer determines the lawful basis for its content and our processing follows its documented instructions. Essential account details are needed to provide access; without platform permissions, that integration cannot operate. Optional profile details and Telegram linking are not required for basic account access.

4. Providers and recipients

Data is shared as needed for the feature you use, not automatically with every integration:

• Supabase: authentication, database and uploaded-media storage.
• Vercel: application hosting, request delivery and operational/security logging.
• OpenAI: prompts, relevant brand context, requested content and generated text for AI features. Web-assisted generation or handle lookup can also submit information from your brief to search tools.
• Anthropic: relevant prompt/context data when that alternative AI provider is configured and used. Local AI processing may be used instead where configured.
• Meta (Instagram, Facebook and Threads) and TikTok: account authorisation, requested publishing or campaign actions, content and retrieval of supported account/results information. Other integrations apply only where actually available and enabled.
• Mollie: payment information required for payments made through its checkout. Payment details you enter at checkout are handled by the payment provider.
• Telegram: linking and approval/notification messages when you enable that integration, including relevant post content.

Hosting and AI providers may act as processors under the applicable contracts. Platforms, search services and payment providers may also determine their own purposes; their privacy notices govern that processing. Authorised personnel and professional advisers may access information where needed for support, security or legal/accounting duties. Data may be disclosed where legally required. We do not sell personal data.

5. Uploaded media and publication

Uploaded post media is currently stored in a public storage bucket. A person with the media URL can access the file, even before publication or if a social post is set to private. Do not upload confidential material on the assumption that social-platform privacy controls protect the original upload. Selecting private visibility on TikTok does not make that storage URL private.

When you approve publishing or enable supported automation, content is transmitted to the destinations you select. Published material may become visible to the platform's audience and may be copied or reshared. Deleting a GrowMachine record or disconnecting an account does not necessarily remove media from storage, published content or copies held by others. Contact us about stored-media deletion and use the platform's own controls for published content.

6. Location and international transfers

Providers operate internationally; storage, support access or feature processing may involve countries outside the European Economic Area, including the United States. An EU database region does not by itself guarantee EU-only processing. The actual regions, recipient entities and transfer mechanisms remain to be verified for this draft.

Before adopting this notice, transfers must be documented and covered by an applicable GDPR Chapter V mechanism, such as an adequacy decision or Standard Contractual Clauses with any required supplementary measures. Reliance on the EU-US Data Privacy Framework requires verifying the relevant recipient's current certification and coverage. The final notice must identify the applicable safeguards and how to obtain a copy. This draft does not claim that those checks or agreements are already complete.

7. Retention and security

Retention must be limited to what is needed for each purpose. Account/profile data and saved content are needed while the account and requested features remain in use. Following closure or an erasure request, data no longer needed must be deleted or anonymised, except where a legal retention duty, dispute or other lawful reason requires keeping it. Applicable Dutch basic accounting records generally need to be retained for seven years.

Connection credentials are needed while the integration remains authorised; use the disconnect controls or revoke access on the platform. Security logs and backups require their own purpose-limited retention and expiry schedules. For waitlist details, retention must be limited to the requested launch communication or earlier withdrawal. The operational schedules for deletion, logs, backups and unused accounts remain to be confirmed; this draft makes no promise of automatic deletion within a fixed number of days.

The application uses authentication, access controls and encryption for stored social credentials. Security measures reduce risk but cannot guarantee absolute security. Public uploaded media has the access characteristics explained in section 5. Never include passwords, access tokens or confidential information in AI prompts.

8. Cookies and browser storage

Authentication/session cookies and short-lived OAuth cookies support sign-in and secure account connections. Browser session storage temporarily holds onboarding progress; local storage remembers recently used Instagram collaborator handles. You can clear this storage through your browser, although clearing authentication cookies can sign you out.

The current application does not include advertising trackers or a third-party analytics script. Social platforms and linked websites apply their own cookie policies. Any future non-essential tracking requires the information and consent required by applicable law before it is enabled. A final cookie/storage review is required before adopting this notice.

9. AI and automated processing

AI supports drafting and configured campaign actions using your inputs and settings. Advertising targeting may use the audience criteria you select and the platform's own systems. GrowMachine is not intended to make solely automated decisions about people that produce legal or similarly significant effects within Article 22 GDPR. You should review generated content and authorised campaign actions; AI output can be wrong. Provider-side retention and any training settings must be verified rather than assumed.

10. Your rights and complaints

Subject to the GDPR's conditions, you may request access, correction, erasure, restriction and portability of your personal data. You may object to processing based on legitimate interests, and always object to direct marketing. You may withdraw consent without affecting the lawfulness of prior processing. These rights are not all absolute; if a request cannot be fulfilled, we must explain the reason and available complaint options.

Send requests to growmachine@studioghost.town. Proportionate identity verification may be needed. A response is due without undue delay and normally within one month of receipt. Where permitted for complex or numerous requests, that period may be extended by two further months, with the reason communicated within the first month. Requests are normally free of charge. For customer-controlled content, we may refer the request to the relevant controller and assist as required.

You may complain to the Autoriteit Persoonsgegevens, or the competent supervisory authority in the country where you live, work or where the alleged infringement occurred. You do not need to contact us first.

11. Updates and contact

The service is intended for adults, not children under 18. Material changes to processing must be communicated appropriately; where a new purpose requires consent, publishing an updated notice does not provide that consent. Contact Studio Ghost Town at Stationsplein 26, 6512 AB Nijmegen, the Netherlands, or the email above with privacy questions.