Skip to main content

Privacy Policy

How Growtle collects, uses, shares and protects personal data for brands, creators and agencies — including the information you allow us to read when you connect an Instagram professional account or a YouTube channel.

Last updated
Provided by
Growtle Digital Private Limited

  • We never sell your data

    Personal data is never sold or rented, and Instagram and YouTube data is never used for advertising.

  • You control connected accounts

    Connect only the accounts you choose and disconnect from Growtle, Instagram or Google at any time.

  • Tokens are encrypted

    Instagram and Google access tokens are encrypted at rest with AES-256-GCM and never reach your browser.

  • Deleted on request

    YouTube data is erased the moment you disconnect, and Instagram data within 30 days or immediately on a deletion request.

1.Who we are

Growtle is operated by Growtle Digital Private Limited (“Growtle”, “we”, “us”), a company registered in India. Growtle is a marketplace and growth platform that helps brands discover and work with creators, and gives creators tools such as a media kit, link in bio, campaign tracking, Instagram automations and a verified audience badge for connected Instagram and YouTube accounts.

This policy applies to growtle.com, its workspaces and related services (the “Service”). For personal data you share with us, we act as the data fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and as the controller under the EU and UK GDPR where those laws apply.

2.Information we collect

Information you give us

  • Account details — name, email address, phone number, the role you sign up for, and your password, which is stored only as a one-way Argon2 hash.
  • Profile details — for creators: niche, location, languages, rates, portfolio and social handles; for brands and agencies: company name, website, team members and billing details.
  • Identity verification — creators who verify their identity share PAN, Aadhaar (through DigiLocker), a selfie for a liveness check and bank details for payouts. We keep only a masked Aadhaar number, the verification result and an encrypted copy of the portrait used for matching.
  • Collaboration content — campaign briefs, applications, proposals, contracts, deliverables, messages and files exchanged through the Service.
  • Payment records — invoices, amounts, payment references and payout status. We do not store full card numbers.
  • Communications — enquiries, support requests and newsletter preferences.

Information from Instagram or YouTube when you connect them

If you choose to connect an Instagram professional account or a YouTube channel, we receive the data described under Instagram data and YouTube data, limited to the permissions you grant.

Information from other services you use to sign in or connect

  • Google Sign-In — your name, email address and profile picture.
  • Google Sheets — for agencies that import a roster, only the spreadsheets you choose to connect.
  • WhatsApp sign-in — your phone number, used to deliver one-time passcodes.

Information collected automatically

  • Log and device data — IP address, browser type, device information, pages viewed, referring pages and timestamps.
  • Security signals — bot-protection checks on sign-in and contact forms.
  • Cookies — described under Cookies.

3.Instagram data and Meta Platform Data

Connecting Instagram is optional. It requires an Instagram professional (Business or Creator) account, and you sign in on Instagram's own page through the Instagram API with Instagram Login. We never see or store your Instagram password.

Depending on the permissions you approve on the consent screen, we receive and use the following:

instagram_business_basicAccount ID, username, name, account type, profile picture, follower, following and media counts, and your posts, reels and stories with captions, links, timestamps and like and comment counts.
To show your connected profile, build your media kit and portfolio, display verified follower counts to brands, and let you choose which posts appear on your Growtle profile.
instagram_business_manage_commentsComments on your media, including the commenter's Instagram-scoped ID and username.
To detect the keywords you set in an AutoDM automation and, if you enable it, to post the public reply you wrote.
instagram_business_manage_messagesThe ability to send direct messages from your account.
To send the automated message you wrote to people who commented with your keyword. We keep a delivery log of each message for your dashboard and daily limits.
instagram_business_manage_insightsViews, reach, saves and shares for your posts.
To calculate engagement in your dashboard and media kit. Brands see these figures only when you share your media kit or a campaign report with them.

Meta notifies us of new comments on your media through webhooks. We store each notification only long enough to process it and delete processed notifications after 30 days.

What we never do with Instagram data

  • Sell, rent, license or trade it, or share it with data brokers.
  • Use it for advertising, retargeting or to build profiles for third parties.
  • Use it to make eligibility decisions about anyone, such as for credit, housing or employment, or for surveillance.
  • Read or send messages other than the automated replies you configure.
  • Keep it after you disconnect for longer than the retention period under How long we keep data.

Our use of data received from Meta complies with the Meta Platform Terms and Developer Policies. Access by our staff is limited to support and security work that needs it.

If you commented on a creator's post

When you comment on the post of a creator who uses AutoDM, we process your Instagram-scoped ID, username and comment on the creator's behalf to send the reply they set up. You can ask us to delete this information by writing to hello@growtle.com.

4.YouTube data and Google API Services

Connecting YouTube is optional. Growtle uses YouTube API Services to read information about your own channel after you sign in with Google and approve access. By connecting, you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. We never see your Google password.

youtube.readonlyYour channel ID, name, handle, profile picture and creation date, its public subscriber and video counts, and the publish date, views, likes and comment counts of your 50 most recent uploads.
To confirm you own the channel, show the Verified audience badge, display your subscribers and recent performance on your profile and media kit, and check government campaign rules such as channel age and posting frequency.
yt-analytics.readonlyAggregated audience reports for the last 90 days: the share of views by age group and gender, and the country with the most views.
To show brands a summary of your audience. These are percentages for your whole audience, never information about individual viewers. You can leave this permission unticked and still connect.

We do not read or store your videos, comments, playlists, subscriptions, watch history or messages, and we never upload, edit or delete anything on your channel.

How YouTube data is stored, shared and deleted

  • We refresh your channel data from YouTube every 12 hours while you stay connected. Data we cannot refresh for 30 days is deleted automatically.
  • Brands see your subscriber count, recent performance and audience summary on your profile and media kit. If you join government campaigns, the same figures appear in the empanelment dossier shared with the department running the campaign.
  • We do not sell YouTube data, use it for advertising, or share it with anyone except as described here.
  • When you disconnect, we revoke our access with Google and delete your YouTube data straight away. If you remove our access from your Google Account instead, we delete it the next time we try to refresh it, within 24 hours.

You can remove Growtle's access at any time from your Google Account's third-party connections page.

Limited Use

Growtle's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use YouTube data to train AI or machine-learning models, and our staff read it only to provide support you ask for, for security, or where the law requires it.

5.How we use information

We use personal data only for these purposes:

  • To create and secure your account and provide the Service you asked for.
  • To show your profile, match brands with creators and run campaigns, contracts and payments.
  • To run the Instagram features you turn on — profile sync, AutoDM, comment replies and insights.
  • To verify the YouTube channel you connect and show its subscribers, recent performance and audience summary.
  • To verify creator identities and keep the marketplace free of fake or duplicate accounts.
  • To send service messages such as sign-in codes, receipts, campaign updates and security alerts.
  • To provide support and respond to enquiries.
  • To detect and prevent fraud, abuse and security incidents.
  • To keep collaborations on the Service — we automatically detect and hide contact details in messages and profile text, and record which brands view which creator profiles to enforce fair-use limits.
  • To improve the Service using aggregated, de-identified usage data.
  • To comply with legal obligations and enforce our Terms.

We rely on your consent (which you can withdraw at any time), the performance of our contract with you, our legitimate interest in running a safe service, and our legal obligations. Marketing emails are sent only with your consent and always include an unsubscribe link.

6.How we share information

We do not sell personal data. We share it only in these situations:

  • With people you choose to work with — your public profile, and the details you send in an application, proposal, contract or media kit. For creators, visitors see your name, photo, categories, location and follower range; signed-in brands also see reach, engagement, audience insights and rates. Your social handles are shared only with brands you have a signed contract with, and your email address and phone number are never shown to brands.
  • With Meta — when we send a message, reply or request to Instagram on your behalf.
  • With Google — when we request your YouTube channel data on your behalf.
  • With government departments — only if you join government campaigns: your verified name, age, state, audience figures and declarations, in a dossier for a campaign you are proposed for.
  • With service providers who process data for us under contracts that require them to protect it: cloud hosting and content delivery, media storage (Cloudinary), email delivery, payments, refunds and creator payouts (Razorpay), identity verification (Cashfree Payments), one-time passcode delivery (WhatsApp Business Platform), bot protection (Cloudflare Turnstile), and — only with your cookie consent — analytics and advertising measurement (Google Analytics and Tag Manager, Microsoft Clarity, Meta Pixel and LinkedIn Insight Tag).
  • For legal reasons — when required by law or a valid order, or to protect the rights, safety and property of Growtle, our users or the public.
  • In a business transfer — such as a merger or acquisition, where this policy continues to apply to your data.

7.How long we keep data

Account and profileYour account, profile and collaboration history
For as long as your account is active. Deleted or anonymised within 30 days of an account deletion request.
Connected Instagram accountProfile, media, insights and automation logs
Refreshed regularly while connected. Expired stories are removed on the next sync.
After you disconnect InstagramAccess token and Instagram data
The access token is revoked immediately. The remaining Instagram data is deleted automatically within 30 days; reconnecting within that time restores your automations.
Meta deletion requestSent when you remove Growtle in Instagram
All Instagram data for that account is deleted as soon as the request arrives.
Connected YouTube channelChannel details, figures and audience summary
Refreshed every 12 hours while connected. Deleted if it cannot be refreshed for 30 days.
After you disconnect YouTubeGoogle access token and YouTube data
The token is revoked and the data deleted immediately — or within 24 hours if you remove our access in your Google Account.
Webhook notificationsComment events sent by Meta
Deleted 30 days after processing.
Financial and tax recordsInvoices, payments and payouts
For as long as Indian tax and company law requires, generally up to eight years.
Identity verificationMasked Aadhaar, result and encrypted portrait
While your verification is valid, and afterwards only as long as the law requires.

8.Cookies

  • Necessary cookies keep you signed in, protect forms and remember your cookie choice. The Service cannot work without them.
  • Analytics cookies (Google Analytics, Microsoft Clarity) help us understand how the Service is used. They load only after you accept analytics.
  • Marketing cookies (Meta Pixel, LinkedIn Insight Tag) measure our advertising. They load only after you accept marketing.

To change your choice, clear the cookies for growtle.com in your browser and the cookie banner will ask you again.

9.Your rights and choices

Depending on where you live, you have the right to:

  • Access a summary of the personal data we hold about you and how it is used.
  • Correct or update inaccurate or incomplete data — most of it directly in your account.
  • Erase your data, subject to records the law requires us to keep.
  • Withdraw consent at any time, including by disconnecting Instagram or YouTube.
  • Nominate another person to exercise your rights in the event of death or incapacity, under the DPDP Act.
  • Object to or restrict processing and receive a portable copy of your data, under the GDPR.
  • Raise a grievance with us, and then with the Data Protection Board of India or your local data protection authority.

Write to hello@growtle.com from your registered email address. We will confirm your request and respond within 30 days.

10.Disconnecting Instagram or YouTube and deleting your data

  • In Growtle — open Tools for growth → Instagram in your creator workspace and choose Disconnect.
  • In Instagram — go to Settings → Apps and websites, select Growtle and choose Remove. Meta then tells us to delete your data.
  • YouTube in Growtle — open Verification → Verified audience and choose Disconnect next to your channel.
  • YouTube in Google — open your Google Account's third-party connections, select Growtle and remove access.
  • Your whole account — email us with the subject “Delete my data”.

Step-by-step instructions are on our data deletion page.

11.Security

  • All traffic is encrypted in transit with HTTPS.
  • Instagram and Google access tokens and identity portraits are encrypted at rest with AES-256-GCM.
  • Passwords are stored only as Argon2 hashes.
  • Every webhook from Meta is verified against its signature before it is processed.
  • Access is role-based and sensitive actions are recorded in audit logs.

No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

12.Children

The Service is for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13.International transfers

We are based in India, and some of our service providers process data in other countries. Where data leaves India, we use providers bound by contractual safeguards and transfer it only as permitted by the DPDP Act and, where it applies, the GDPR.

14.Changes to this policy

We may update this policy as the Service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell you by email or in the Service before it takes effect.

15.Contact and grievance officer

For questions, requests or complaints about your personal data, contact our Grievance Officer. We acknowledge grievances within 48 hours and resolve them within 30 days.

Growtle Digital Private Limited

Unit 603–604, 6th Floor, Tower BBhutani Alphathum, Sector 90Noida, Uttar Pradesh 201305, India

hello@growtle.com+91 9289905136