Privacy Policy

GrowthPilot AI is an AI marketing copilot currently in free public beta. In this policy "we" means the team operating the service, and "you" means the person using it or contacting us through this website.

This policy covers the marketing website you are reading, the signed-in product, and the contact form. It does not cover third-party sites we link to.

We collect only what the product needs to function. There is no advertising network, no third-party analytics script, and no tracking pixel on this site.

The contact form accepts submissions from anyone, so it needs an abuse guard. We rate-limit it to three submissions per ten minutes per source address.

To do that without keeping a log of who visited, we never store your IP address. We take the address our hosting platform reports for the connection — X-Vercel-Forwarded-For, which the platform sets itself and a caller cannot forge, falling back to the first hop of X-Forwarded-For and then to X-Real-IP on hosts that do not set it — combine it with a server-side secret salt, hash the result with SHA-256, and store only that 64-character hash together with a counter and a window timestamp. The raw address is never written to the database, and the hash cannot be reversed to recover it without the salt.

These rate-limit rows are throwaway state, not a record of you: they hold no name, email, or message, and they are only ever read by the rate limiter.

This is the part most policies bury, so it is stated plainly: the text you put into GrowthPilot AI is sent to third-party AI providers to be processed. That includes your product descriptions, the URLs you supply, competitor page summaries, and the prompts built from them.

Groq is the primary inference provider, running open-weight Llama models: it is tried first for every generation. Google Gemini is configured as the fallback and receives a request only when Groq fails or is unavailable. There is no embeddings provider and no vector database in this product — your product profile is not indexed anywhere; it is sent as part of the prompt. Your data is handled by those providers under their own terms, which we cannot vary on your behalf.

We do not train any model on your content and we do not fine-tune on customer data. We do cache AI responses keyed by a hash of the prompt, so an identical request is not billed or re-sent twice; that cache holds the generated response and no account identifier.

To run the product you asked for: build your product profile, analyse the competitors you name, audit the URL you give us, propose strategies, and generate content.

To keep the service working and fair: enforce the beta usage caps, rate-limit the contact form, debug failures, and monitor cost.

To reply to you when you contact us.

We do not sell your data, we do not share it for advertising, and we do not build advertising profiles. We do not make automated decisions that have legal effects about you.

The public marketing pages set no cookies. Nothing on this page is tracking you.

Once you sign in, Supabase sets authentication cookies that hold your session and refresh tokens. They are strictly necessary — without them you cannot stay signed in — and they are cleared when you sign out. The site also stores your light or dark theme choice in your browser's local storage, which never leaves your device.

Account and project data is kept for as long as your account exists. Delete a project and its product profile, competitor records, SEO audits, strategies, and generated content are deleted with it; delete the account and everything belonging to it goes.

Contact form messages are kept while we deal with them and for a reasonable period afterwards so we have a record of the conversation. Rate-limit hashes are transient — a row is only meaningful for the ten-minute window it describes and is overwritten by the next submission from the same source.

AI usage counters and cached AI responses are retained for cost control and are not linked to your account after deletion.

This is a beta. If we shut the service down, we will give notice before deleting data and provide a way to take your content with you.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. You can withdraw consent and stop using the service at any time. Depending on where you live you may also have the right to object to processing, to restrict it, or to complain to your local data protection authority.

To exercise any of these, use the contact form or email the address published there. We will respond within 30 days. We may need to confirm you control the account email before acting on a deletion request.

Data is stored in a managed Postgres database with row-level security enabled on every table, so a project's rows are only readable by the account that owns them. Privileged server-side operations use a service-role key that is never exposed to the browser. Traffic is served over HTTPS.

No system is perfectly secure, and this one is in beta. Do not put confidential material into it — treat it as suitable for information you would be willing to publish.

GrowthPilot AI is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

We will update this page when the product changes what it collects or who it sends data to, and we will move the "last updated" date when we do. Material changes to how we handle your data will be announced in the product rather than only edited in quietly.