Privacy Policy

This policy applies to HeyGrowfy — the Growfy Android app (package com.xenotixlabs.heygrowfy), the web app at heygrowfy.com, and the API behind both. Where this policy says “we” or “us”, it means HeyGrowfy.

Contact us about anything in this policy at hello@heygrowfy.com.

This distinction runs through the whole policy, so it comes first.

Businesses. People who sign up and use HeyGrowfy to talk to their customers on WhatsApp. They give us their own details directly.

Customers of those businesses. People whose names and phone numbers a business uploads or messages through HeyGrowfy. They never installed our app and may never have heard of us.

Business account details

Your name, email address, phone number and password (stored hashed, never in plain text). If you sign in with Google, we receive your Google account identifier and email instead of a password.

We also store the business profile you fill in, because the AI uses it to write replies: business name, industry and category, description, products or services and their prices, pricing model, location, working hours, special offers, communication style, and any additional notes or policies you add. Plus your WhatsApp Business account identifiers and display name, and a profile image if you upload one.

Customer contact records

When you add leads — one at a time, by bulk upload, by CSV file, or by importing a Google Sheet — we store the contact’s name, phone number, email address, WhatsApp profile name, location, source, status, tags and any notes you attach, along with a lead score our system calculates.

Message content

The messages sent and received through your connected WhatsApp Business number, in both directions, including replies the AI generates. These are stored so you can see the conversation history in your inbox.

Photos, video and documents

Images, video and documents you choose to attach to a message or add to a product catalogue. The app asks for access to your photos and videos only at the moment you pick a file, and only the file you select is uploaded — we do not scan or index your gallery. Uploaded files are stored with our hosting providers (Amazon S3 and Cloudinary).

Payment information

Wallet top-ups are processed by Razorpay. We store the transaction amount, currency, status and Razorpay’s payment and order identifiers, plus a ledger of what your account was charged for.

Usage and device information

For the website, we record anonymous analytics: a random visitor identifier, session identifier, the pages visited, the referring page, campaign parameters, browser user-agent, device type, country and IP address. These records are automatically deleted 90 days after they are created.

Stated plainly, because these are the things people assume:

• Your phone’s contact list. The app does not request contacts permission and cannot read your address book. Contacts only enter HeyGrowfy when you deliberately add or upload them.
• Your location. No location permission is requested. The country shown in website analytics is inferred from IP address, not from device GPS.
• Camera or microphone. Neither permission is requested by the app.
• Card or bank details. Handled entirely by Razorpay.
• Advertising identifiers. The app contains no advertising or tracking SDKs.

We do not sell personal data, and we do not share it with advertising networks or data brokers.

• To send and receive WhatsApp messages on your behalf.
• To generate AI replies to your customers, using your business profile and the recent conversation as context.
• To classify enquiries and score leads, so you can see which conversations need attention.
• To show your inbox, contacts, analytics and billing history.
• To charge your wallet for messages and AI usage.
• To provide support when you contact us.
• To keep the service secure and to detect abuse, including automated loops that would otherwise drain your balance.

HeyGrowfy uses OpenAI to generate replies, classify intent and score leads. To do that we send OpenAI your business profile and the recent messages in the conversation, including the customer’s name and what they wrote.

We do not send OpenAI your password, payment details or your full contact database. Data sent through OpenAI’s API is not used to train their models.

We use the following providers to run the service. Each receives only what it needs for its stated purpose.

We may also disclose data where the law requires it, or to protect our rights, users or the security of the service.

• All traffic between the apps and our servers is encrypted (HTTPS).
• Passwords are stored hashed, never in readable form.
• Every request is scoped to the signed-in business, so one account cannot read another’s contacts or conversations.
• Payment card data never touches our systems.

No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authority as the law requires.

You can ask us to:

• Give you a copy of the data we hold about you.
• Correct anything inaccurate.
• Delete your account and its data — see Delete your account.
• Withdraw consent, which for most features means closing your account.

Email hello@heygrowfy.com and we will respond within 30 days. Most contact and conversation data can also be deleted by you directly in the app, without contacting us at all.

You may be reading this because you received a WhatsApp message from a business using our platform. You have two routes.

To stop the messages: reply STOP to the conversation. That immediately opts you out — the business can no longer send you automated messages, and our system stops replying to you. Reply START if you ever want to resume.

To have your data erased: the business that contacted you controls that record, so ask them directly and they can delete it from their end. If you cannot reach them or would rather not, email hello@heygrowfy.com with the phone number that was messaged and we will pass the request to the business and follow it up.

You are responsible for the contacts you upload. By using HeyGrowfy you confirm that you have a lawful basis to hold those contact details and to message those people, and that you will honour opt-out requests.

We provide the tools to comply — STOP handling is automatic, and you can delete any contact and its full history at any time — but the responsibility for who you contact is yours.

HeyGrowfy is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, email us and we will delete it.

We are based in India. Some providers listed in section 7 process data on servers outside India, including in the United States and Europe. When data is transferred, we rely on those providers’ contractual safeguards for international transfers.

If we change how we handle data, we will update this page and the date at the top. For significant changes we will also notify you in the app or by email.

Questions, requests or complaints: hello@heygrowfy.com. We aim to reply within 30 days.