GrowSpace ("we," "our," or "us") operates the GrowSpace platform (the "Service"), an Instagram marketing automation and consultation scheduling tool. This Privacy Policy describes how we collect, use, store, and protect your information when you use our Service.
Summary: We only collect data necessary to provide our automation and consultation services. We encrypt sensitive tokens, never sell your information or Google user data, and you can delete your data or disconnect integrations at any time.
1. Information We Collect
1.1 Account Information
- Email address and password (for login)
- Instagram Business/Creator account username and profile picture (via Instagram OAuth)
- Instagram account ID
1.2 Instagram API Data
When you connect your Instagram account via Meta's OAuth, we receive access to:
- instagram_business_basic — Profile info (username, profile picture, account ID)
- instagram_business_manage_messages — Ability to send and receive Direct Messages on your behalf
- instagram_business_content_publish — Ability to publish scheduled posts/reels
- instagram_business_manage_insights — Account analytics and insights data
- instagram_business_manage_comments — Comment monitoring for keyword-based automation triggers
1.3 Google Calendar API Data
When you optionally connect your Google Account to enable consultation scheduling and auto-generate Google Meet call links, we request access to:
- Google Calendar Events Scope (https://www.googleapis.com/auth/calendar.events) — Permission to create, view, and manage events on your primary Google Calendar.
- Google Account Information — Your Google account email address to verify calendar ownership.
- Consultation Event Metadata — Booking titles, client names, client emails, consultation topics, and scheduled time slots.
1.4 Automation & Consultation Data
- Automation configurations (keywords, DM templates, target posts)
- Contact records (commenter usernames, comment text, interaction timestamps)
- Consultation booking records (client details, scheduled meeting links, booking status)
- DM delivery status (sent, pending, failed)
- Follower gain metrics per automation
1.5 Scheduled Content
- Videos and images uploaded for scheduling
- Captions, hashtags, and cover images
- Scheduled publish dates and times
2. How We Use Your Information
We use the collected information to:
- Authenticate your identity and manage your account
- Execute automated DM responses based on your configured triggers
- Publish scheduled content at your specified times
- Schedule consultation sessions on your Google Calendar and automatically generate Google Meet video call links
- Display analytics and performance metrics
- Track follower growth attributed to your automations
- Send service-related notifications and alerts (e.g., token expiry warnings, booking confirmations)
We do NOT: Sell, rent, or share your personal data, Instagram data, or Google user data with third parties for marketing or advertising purposes.
3. Google User Data & Limited Use Policy Disclosure
GrowSpace takes the privacy and security of your Google account data very seriously. This section specifically addresses how we handle Google user data obtained via Google APIs (such as Google Calendar API):
3.1 Sharing, Transfer, and Disclosure of Google User Data
GrowSpace does NOT share, transfer, or disclose your Google user data with any third parties, external organizations, data brokers, or commercial entities.
Your Google user data (including calendar event details, attendee emails, and account email) is processed exclusively on our secure servers to provide consultation scheduling and Google Meet link creation as explicitly requested by you. Exceptions are limited strictly to:
- Providing and facilitating the consultation booking features directly requested by you.
- Compliance with applicable law, legal process, or enforceable governmental requests.
3.2 Strict Prohibitions on Google User Data
- No Data Selling: We never sell, trade, or rent Google user data under any circumstances.
- No Advertising: Google user data is never used for serving, targeting, or customizing advertisements.
- No AI/ML Training: Google user data is never used for training generalized artificial intelligence (AI) or machine learning (ML) models.
- No Human Reading: No human reads your Google Calendar data unless you explicitly request customer support assistance or it is required for security investigations or legal compliance.
3.3 Google API Services User Data Policy Compliance
GrowSpace's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Data Storage & Security
4.1 Token Encryption
Access tokens (for both Instagram OAuth and Google OAuth) are encrypted using Fernet symmetric encryption (AES-128-CBC) before storage in our database. Credentials and refresh tokens are never stored in plaintext.
4.2 Token Management
- Tokens are automatically refreshed before expiry
- If a token expires, associated automations or calendar syncs are paused until re-authentication
- Tokens are immediately revoked upon account or integration disconnection
4.3 Data Storage
- Application data is stored in a secure database
- Media files (uploaded videos/images) are stored securely and deleted after publishing
- All data transmission uses HTTPS/TLS encryption
5. Data Retention
- Account data: Retained until you delete your account
- Contact & Consultation records: Retained for the lifetime of your account or until manual deletion
- Scheduled media: Deleted within 7 days after publishing
- Logs: Retained for 30 days then automatically purged
6. API Rate Limits & Compliance
We comply with Meta and Google API rate limits and policies:
- Maximum 200 automated messages per Instagram account per hour
- Excess messages are queued and sent in subsequent hours
- We do not send unsolicited messages; all DMs and calendar events are triggered by direct user actions
7. Your Rights
You have the right to:
- Access: View all data we have about your account via the dashboard
- Delete: Delete your account and all associated data from Settings
- Disconnect: Revoke Instagram or Google Calendar access at any time from Settings or via Google/Meta authorized apps settings
- Export: Request a copy of your data by contacting us
8. Data Deletion
To delete your data:
- Go to Settings → Delete Account on the GrowSpace dashboard
- This will permanently delete all your automations, contacts, consultation bookings, scheduled content, and connected OAuth tokens
- You can also email us at support@growspace.com to request deletion
We also support Meta's Data Deletion Callback — when you remove our app from your Instagram settings, we receive a callback and automatically delete your data. You can also revoke GrowSpace access at any time via your Google Account Permissions.
9. Third-Party Services
We integrate with the following third-party service providers:
- Meta/Instagram Graph API: For Instagram authentication, messaging, publishing, and insights
- Google API Services / Google Calendar API: For user authentication, consultation event scheduling, and Google Meet link generation
- Google Fonts: For web typography (no personal data shared)
10. Children's Privacy
Our Service is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or dashboard notification. Continued use of the Service after changes constitutes acceptance.
12. Contact Us
If you have questions about this Privacy Policy or our data practices: