Privacy Policy
What we collect, why we collect it, and what you can ask us to do about it. Written in plain language on purpose.
Who we are
The Growth Project is a marketing agency. We build and run growth systems for a small number of client businesses: websites, search visibility, email, social media, and the systems behind them.
This policy covers thegrowthproject.me, the tools we run on it, and the work we do for clients. If you want to reach a person about anything on this page, email hello@thegrowthproject.me.
What we collect
When you book a call. Your name, email address, and anything you type into the booking form, such as your business name and what you want help with. Booking runs on Cal.com.
When you email us. Your email address and whatever the message contains.
When you browse the site. Standard analytics: pages viewed, how you arrived, roughly where in the world you are, your device and browser, and how you move around a page. Some of this is recorded as anonymised session replay, meaning a playback of clicks and scrolling. We do not record what you type into form fields.
We do not ask for, and do not want, payment card numbers, government identification, or sensitive personal information through this website.
The tools we use, and what each one sees
- Cal.com: booking. Sees your name, email, and booking answers.
- Google Analytics 4: traffic and where visitors come from. Sees anonymised usage data.
- PostHog: which parts of the site people actually use. Sees anonymised usage data.
- Microsoft Clarity: heatmaps and session replay. Sees anonymised interaction data.
- Meta Pixel: measures whether our ads work, and lets us show ads to people who already visited. Sees anonymised usage data tied to Meta's own identifiers.
- Google Sheets: our internal customer record. Holds the booking details above.
- Klaviyo: email. Holds your email address if you booked or subscribed.
- Vercel: hosting. Sees standard server request logs.
Each of these companies has its own privacy policy, and your data sits under their terms once it reaches them.
Why we collect it
Three reasons, and no others. To reply to you and run the call you booked. To understand which parts of the site are useful so we can improve them. To measure whether our own marketing works.
We do not sell personal information. We have never done it and there is no version of this business where we would.
Who we share it with
Only the service providers listed above, and only so they can do the job they are there for. We share information outside that list in one case: when the law requires it.
How long we keep it
Booking and enquiry records stay in our customer record while there is an active or possible working relationship, and are removed on request. Analytics data follows each provider's own retention period, typically fourteen months for Google Analytics and shorter for session replay.
Your choices and your rights
You can ask us what we hold about you, ask us to correct it, ask us to delete it, or ask us to stop emailing you. Email hello@thegrowthproject.me and we will action it. There is no form and no process to fight through.
You can also block analytics and advertising cookies in your browser settings, or use a content blocker. The site works normally either way.
Depending on where you live, you may have specific legal rights over your data, including under Quebec's Law 25, Canada's PIPEDA, and the GDPR in Europe and the UK. We honour those requests regardless of where you are.
Cookies
The tools above set cookies and similar identifiers to recognise a returning browser and to measure whether an ad led to a visit. None of them are needed for the site to display. Clearing cookies or blocking them in your browser removes them.
Data we handle on behalf of clients
When a business hires us, we are usually given access to accounts they own: their website, their analytics, their ad accounts, their email list. That data belongs to the client, not to us. We access it only to do the work they hired us for, we do not copy it out for our own use, and we return or lose access to it when the engagement ends. We are a processor of that data and the client remains the controller of it.
Google user data
Some of our internal tools connect to Google APIs using accounts we or our clients own, for example to read Search Console performance, Analytics reports, or Google Ads keyword data.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice that means we use Google data only to provide and improve the specific feature the account owner asked for, we do not transfer it except as required by law or with the owner's explicit consent, we do not use it for advertising, and we do not allow humans to read it except where the owner asked us to, where it is needed for security, or where the law requires it.
Security
Credentials and access tokens are stored in restricted files and password managers, never in documents, spreadsheets, or messages. Accounts that support two-factor authentication have it switched on. No system is perfectly secure, and we will tell you promptly if something involving your data goes wrong.
Children
This site and our services are for businesses. They are not directed at anyone under 16, and we do not knowingly collect information from them.
Changes to this policy
If we change how we handle personal information, we update this page and change the date at the top. Material changes will be obvious rather than buried.
Contact
The Growth Project
hello@thegrowthproject.me
See also our Terms of Service.