Privacybeleid / Privacy Policy

Last updated: March 20, 2026

1. Data Controller

GrowMachine is a service operated by Zero Creative, based in the Netherlands. For questions about this privacy policy or your personal data, contact us at growmachine@studioghost.town.

2. What Data We Collect

We collect the following personal data:

  • Account data: email address, name, company name, industry, and target location you provide at registration.
  • Social media tokens: OAuth access tokens when you connect platforms (Instagram, TikTok, LinkedIn, YouTube, X) — used solely to manage campaigns on your behalf.
  • Campaign data: ad budgets, campaign settings, and performance metrics.
  • Technical data: IP address and browser type in server logs (retained for 30 days).

We do not collect special categories of personal data (health, political opinions, religion, etc.).

3. Legal Basis for Processing (Art. 6 GDPR / AVG)

We process your data based on:

  • Contract performance (Art. 6(1)(b)): to provide the GrowMachine service you signed up for, including creating and managing ad campaigns.
  • Legitimate interest (Art. 6(1)(f)): to improve our service, prevent abuse, and ensure security.
  • Consent (Art. 6(1)(a)): for optional marketing communications (you can withdraw consent at any time).

4. How We Use Your Data

  • Create and manage ad campaigns on your connected platforms
  • Generate AI-powered ad copy for your campaigns
  • Display campaign performance and analytics in your dashboard
  • Send essential service notifications (account security, billing, platform changes)
  • Improve our service through aggregated, anonymized usage analysis

5. Data Sharing & Sub-processors

We share data only with the following third-party processors, all with appropriate data processing agreements:

  • Supabase (EU — Frankfurt): database hosting and authentication.
  • Vercel (US, EU edges): application hosting. Vercel is certified under the EU-US Data Privacy Framework.
  • Meta Platforms: to run ad campaigns on Instagram/Facebook via their Marketing API.
  • Anthropic: to generate ad copy via AI. Only campaign metadata (industry, platform, location) is sent — no personal data.

We never sell your personal data to third parties.

6. Data Storage & Security

Your data is stored in the EU (Supabase Frankfurt region). All data is protected by row-level security policies ensuring you can only access your own data. Social media tokens are stored server-side and never exposed to client browsers. All connections use TLS encryption.

7. Data Retention

  • Account data: retained while your account is active, deleted within 30 days of account deletion.
  • Campaign data & metrics: retained while your account is active.
  • Social media tokens: deleted immediately when you disconnect a platform or delete your account.
  • Server logs: retained for 30 days.

8. Cookies

We use strictly necessary cookies only for authentication and session management. No tracking cookies, no analytics cookies, no advertising cookies. Because we only use essential cookies, no cookie consent banner is required under the Dutch Telecommunications Act (Telecommunicatiewet).

9. Your Rights (GDPR / AVG)

Under European data protection law, you have the right to:

  • Access — request a copy of all personal data we hold about you.
  • Rectification — correct inaccurate data (edit your profile in Settings).
  • Erasure — request deletion of your data and account.
  • Data portability — receive your data in a machine-readable format.
  • Restriction — request we limit how we process your data.
  • Objection — object to processing based on legitimate interest.
  • Withdraw consent — at any time, without affecting prior processing.

To exercise any of these rights, email growmachine@studioghost.town. We will respond within 30 days as required by law.

10. Right to Complain

If you believe we handle your personal data incorrectly, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

11. Changes to This Policy

We may update this privacy policy from time to time. Significant changes will be communicated via email. The latest version is always available on this page.

12. Contact

GrowMachine / Zero Creative
Email: growmachine@studioghost.town
The Netherlands