Privacy Policy

1. Who we are

GrowGodzilla is operated by TMRW MADE LTD ("GrowGodzilla", "we", "us"), a company registered in England and Wales under company number 17275374, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We operate the website at https://www.growgodzilla.com and the GrowGodzilla service.

TMRW MADE LTD is the data controller for the personal data described in this policy under the UK GDPR and the Data Protection Act 2018 (and, where it applies to you, the EU GDPR). For any privacy question, contact us at support@growgodzilla.com.

2. Information we collect

Information you give us

• Sign-in details from Google: your name, email address and profile photo. We never see your Google password. Signing in gives us no access to any other Google data. That only happens if you separately connect Search Console or Google Analytics (see section 3).
• Product details: your product website, objective, chosen platforms, posting times and plan.
• Content in the product: the videos, slideshows, posts, AI creators and launch videos we make for you and their scripts and captions, the analysis of your product ("Product Brain"), notes you add about your product, your brand kit (name, handle, colour, and any logo, app screenshots or short screen recordings you upload), which ideas you liked or passed on (so your feed learns your taste), your calendar, and your Token balance and history.
• Messages you send us by email or through our contact form, including any files you attach.

Information from services you connect

• Google Search Console and Google Analytics, read-only. Explained in full in section 3.
• TikTok, X, LinkedIn and Facebook, when you connect them: an access token (encrypted, see section 6), your account or Page name, and, for posts you publish through GrowGodzilla, the post link and its public engagement numbers (views, likes, comments, shares). We only post when you tap Post now.
• Your website: we fetch the public pages of the website you give us (for example the homepage and a few key pages, with screenshots of them) to build your Product Brain and your launch videos.

Information collected automatically

• Technical data such as IP address, browser type and device, used for security, rate limiting and abuse prevention.
• Strictly necessary cookies that keep you signed in and protect sign-in flows (see our Cookie Policy).

We do not use advertising trackers, and the website does not run third-party analytics scripts.

3. Google user data

You can choose to connect Google Search Console and Google Analytics. Each is optional, requested separately, and only when you click Connect.

What we access

• Google Search Console (scope webmasters.readonly): the list of properties you have verified, and their search performance data: clicks, impressions, click-through rate, average position, top search queries and top pages.
• Google Analytics (scope analytics.readonly): the list of Google Analytics 4 accounts and properties you can access, and aggregated reports for the property you pick: active users, sessions and key events, broken down by date, traffic source and landing page.

Both are read-only. We cannot change your Search Console or Analytics data or settings.

How we use it

Only to provide features you can see in your own GrowGodzilla account:

• Showing you your own numbers in Analytics and on your Home page: your Google clicks and top searches, your visitors and signups, and how many came from each platform you post on. Google data is never sent to an AI provider.

How we store it

We store an encrypted refresh token for each connection and the property you picked for each product. Reports are fetched from Google when you open Analytics or your Home page, and are not saved in our database.

What we never do

• We never sell Google user data.
• We never use it for advertising, including retargeting, personalised or interest-based ads.
• We never use it to train or improve AI or machine-learning models, ours or anyone else's.
• We never transfer it to anyone except as needed to provide the features described above, to comply with the law, or as part of a merger or acquisition with notice to you.
• Our staff do not read it, except with your explicit permission (for example when you ask for support), for security purposes such as investigating abuse, or to comply with the law.

Your control

You can disconnect Search Console or Google Analytics at any time from Settings in the app. We then delete the stored token. When you disconnect the last Google connection, or delete your account, we also ask Google to revoke our access. You can also remove access at any time from your Google Account at myaccount.google.com/permissions.

GrowGodzilla's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

• To provide and operate GrowGodzilla, including the actions you ask for (writing ideas, making videos and images, posting when you tap Post now).
• To keep the service secure, prevent fraud and abuse, and enforce limits.
• To respond to your messages and provide support.
• To send service messages such as security notices and account updates.
• To process payments and manage your subscription and credits.
• To comply with legal obligations.

We do not sell your personal data. We do not use your content, connected data or API keys to train AI models.

5. Legal bases (UK and EEA users)

We process personal data on the basis of contract (to deliver the service you requested), legitimate interests (security, abuse prevention and communication about the service), consent (where required, for example when you connect a service) and legal obligation.

6. AI and media providers

AI and media generation are included in GrowGodzilla: we hold the provider accounts and you don't add keys. Each provider receives only what its job needs:

• OpenAI writes your Product Brain, ideas, scripts and captions, and paints slideshow photos. It receives the public text of your website, your Product Brain and product details, your notes, and the idea you chose. For a photo that shows your app on a phone, it also receives that one screenshot.
• Anthropic (Claude) directs and reviews launch videos and checks their frames. It receives your Product Brain, the script, and descriptions or still frames of the video being made. It also reads public trend posts (see Apify below).
• fal.ai makes AI creators: their portraits from a text description, short reaction clips, and lip-synced talking videos, for which it receives the creator's portrait and the voiceover audio.
• ElevenLabs, only if you pick one of its premium voices, receives the voiceover script. Other voices are generated on our own servers.
• Amazon Web Services renders videos (AWS Lambda). It receives the video's design, your media and the voiceover, and returns the finished file to our storage.
• Apify collects public data about posts that are trending on TikTok (captions, public stats, a cover image link) for the shared trend feed. It doesn't receive any of your data.

Your logo is never sent to an image model: our own software places it into your designs. Content sent to these providers is also subject to their terms and privacy policies. We use business APIs that, according to each provider, are not used to train their models by default.

How we protect your keys and tokens

The tokens that connect Google, TikTok, X, LinkedIn and Facebook are secrets that belong to you. We collect the minimum needed to act for you and treat them like passwords:

• Locked on arrival. A token is encrypted on our server before it is saved. It is never stored or transmitted anywhere else in readable form.
• Encrypted per account. Each secret is encrypted with AES-256-GCM using its own key, derived for your account and that provider only. A copied secret can't be opened on any other account, and a changed one is rejected.
• The database only holds ciphertext. The master key lives only in our server environment, never in the database or its backups, so a copy of the database alone reveals no tokens.
• Used only in the moment. A token is decrypted in memory for the one request that needs it (for example, posting when you tap Post now, or fetching your post stats) and then discarded.
• Never shown, logged or shared. Tokens are never written to logs, never sent to the browser, never shared with other providers and never used for anything you haven't asked for. Your browser can't read the table they are stored in; only our server can.
• Nobody looks at them. No one at GrowGodzilla views your tokens. Our product, dashboards and support tools have no way to display them, and access to production systems is restricted and protected with two-factor authentication.
• Gone when you say so. Disconnect a service and its encrypted token is deleted straight away. Deleting your account deletes all of them.

7. Who we share data with

We share data only with:

• Service providers that run the product for us, under confidentiality and data-protection obligations: Supabase (database, authentication and file storage), Vercel (website and app hosting), Railway (video worker hosting), Resend (email delivery), Stripe (payments), OpenAI, Anthropic, fal.ai and ElevenLabs (AI and media, see section 6), Amazon Web Services (video rendering) and Apify (public trend data).
• Services you connect (Google, TikTok, X, LinkedIn, Facebook), only to carry out what you ask, such as reading reports or publishing a post when you tap Post now.
• Authorities, when legally required, or to protect rights, safety and security.
• A successor, in the event of a merger or acquisition, with notice to you.

8. International transfers

Your data may be processed outside the United Kingdom and the EEA, for example in the United States. Where required, we rely on appropriate safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses.

9. Retention and deletion

We keep personal data while your account is active and only as long as needed for the purposes above. Disconnecting a service deletes its stored token straight away. Contact messages are kept while we resolve your request and for a reasonable period afterwards.

You can delete your account at any time in Settings. This immediately deletes your account, products, content, Product Brain, stored images, videos and screenshots, and connection tokens, and asks Google to revoke our access. Posts already published on your social accounts stay there until you delete them on that platform. Copies in routine backups are removed within 30 days. Records we are legally required to keep, such as invoices, are kept for the period the law requires.

10. Security

API keys and access tokens are encrypted per account at rest (see section 6), and all traffic is encrypted in transit (HTTPS). Every account's data is isolated at the database level, so one user can never read another's. We request the narrowest permissions each feature needs (read-only for Google), rate-limit sensitive actions, restrict and protect access to production systems, and log automated actions. If we ever learn of a breach that affects your personal data, we will tell you and the relevant regulator without undue delay, as the law requires. No system is perfectly secure, so please grant only the permissions you need and tell us straight away if you suspect a problem.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict use of your personal data, to object to processing, and to withdraw consent. To exercise these rights, email support@growgodzilla.com from the address on your account. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to your local data protection authority. We would appreciate the chance to resolve your concern first.

12. Cookies

See our Cookie Policy for the cookies we use and how to control them.

13. Children

GrowGodzilla is not directed to anyone under 18, and we do not knowingly collect children's data.

14. Changes

We may update this policy. If we make material changes we will tell you by email or in the product before they take effect. The date at the top shows when it was last updated.

15. Contact

Questions? Email support@growgodzilla.com or use our contact form.

TMRW MADE LTD
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company number 17275374 · Registered in England and Wales