Privacy Policy

This policy explains how Growth Automation collects, uses, shares and protects personal information, and the choices and rights you have. It applies to:

• our customers and their users;
• business professionals whose details are in our database, or who receive outreach we run; and
• visitors to our websites.

Summary

1. Who we are and what this policy covers

1.1 Who we are. "Growth Automation", "we", "us" and "our" mean NAVU LLC, a Wyoming limited liability company doing business as Growth Automation, at 1309 Coffeen Ave, STE 1200, Sheridan, WY 82801, United States. Our team works remotely from several countries. Contact details are in section 15.

1.2 What this policy covers. It covers personal information we handle through:

• our websites, including growthautomation.ai (the "Site");
• the Growth Automation platform at app.growthautomation.ai, including Dex and related tools (the "Platform");
• our managed outbound services: prospect research, audience building, email and LinkedIn outreach, reply handling, lead forwarding, phone number lookup and meeting booking (together with the Platform, the "Services"); and
• our own sales, marketing, recruitment and supplier relationships.

1.3 Our role. Privacy laws use two roles:

• a "controller" (or "business") decides how and why information is used;
• a "processor" (or "service provider") handles information on someone else's instructions.

We act in both roles:

• We are the controller for information about Site visitors, our customers and their users, and the business professionals in the Growth Automation B2B Contact Database (the "GA Database"). This includes choosing which contacts in the GA Database match a customer's ideal-customer profile, and providing those contacts to the customer.
• We act for our customers, as their processor or service provider, when we run outreach for them. That means sending messages in the customer's name, handling and forwarding replies, booking meetings, processing lists the customer gives us, and identifying visitors to the customer's website where the customer uses our visitor identification add-on (section 2.4). The customer decides to contact you and what to say, and its own privacy policy also applies. If you received a message from one of our customers, you can contact that customer directly. Or contact us, and we'll pass your request on and help them respond.
• In all cases, we keep a record of people who have asked not to be contacted, so we can honour that request (section 11.1).

1.4 What this policy doesn't cover. Third-party websites and platforms (for example LinkedIn or Calendly), which have their own policies. It also doesn't cover what our customers do with information they hold independently of us.

2. Information we collect

2.1 Customers, users and prospective customers

• Contact and account details: name, work email address, phone number, job title, company, username, and user role and permissions. Passwords are handled by our authentication provider and stored only in hashed (scrambled) form.
• Billing details: billing contact, company billing address, tax identifiers, plan and payment history. Our payment processor, Stripe, collects and stores card details. We don't see or store full card numbers.
• Onboarding and campaign information: company profile, ideal-customer profile, offers, messaging and brand materials, sender names and signatures, calendar and booking links, existing customer lists, do-not-contact lists, and public content from your website that we scan to set up campaigns.
• Connected accounts: to run outreach from your accounts, you may connect them through our providers. Examples: LinkedIn through Unipile or Ulinc; email sending through EmailBison and our mailbox providers. We store the access tokens, session data and API keys needed to run those connections, in access-controlled systems. We don't ask for your account passwords.
• Communications: emails, chats with our team and with Dex, meeting notes, support requests and feedback. If we record a call or meeting, we'll tell you at the start.
• Usage and device information: sign-ins, pages and features used, actions taken, IP address, browser and device type, and error reports. To diagnose problems, our error-monitoring provider (Sentry) may record a sample of Platform sessions. We mask text and inputs in those recordings.

2.2 Business professionals (the GA Database and people we contact for customers)

We collect information about people in their professional capacity. It may include:

• Professional identity: name, job title, seniority, department, employer, work location (city, region, country), links to professional profiles (such as LinkedIn), and professional history and skills that the person or their employer has published.
• Business contact details: work email address, work or mobile phone number, and company switchboard. We look up mobile numbers only for people who have replied to outreach, and only for customers who have switched this feature on.
• Company information: company name, website, industry, size, revenue range, locations, technologies, hiring activity, news, public registrations (for example charity registers) and website performance.
• Business signals and insights:
• facts from public sources that are relevant to a business conversation, such as job advertisements, press releases and public posts;
• insights we derive, such as how well a role matches a customer's offer, likely department and seniority, communication-style insights, and whether an email address is likely to be deliverable.
• Interaction information: which messages were sent to you and when; whether you replied and what you said; how our systems categorised your reply (for example "interested", "not now" or "out of office"); whether you asked not to be contacted; meetings booked; and LinkedIn connection status and messages.
• Suppression information: the minimum needed to make sure you aren't contacted again, such as your email address, LinkedIn profile address, or an irreversible (hashed) version of them.
• Public engagement signals: where a customer uses our intent add-on, public engagement with the LinkedIn company pages and posts of companies the customer names. Examples: following a page, or commenting on or reacting to a post.

We don't intentionally collect sensitive information about business professionals. That includes health, racial or ethnic origin, religion, sexual orientation, political opinions, union membership, precise location, government identifiers and financial account numbers. If you include sensitive information in a reply, we use it only to handle your message.

2.3 Website visitors

• Information you give us: for example your name, work email, company and message when you fill in a form, and the details you enter when you book a call through Calendly.
• Information collected automatically: IP address, browser and device type, pages viewed, referring website, time on page, and approximate location (derived from IP address).
• Company identification: we use Factors.ai to match IP addresses to organisations, so we can see which companies visit our Site. It's designed to identify organisations rather than individuals. But if you fill in a form or book a call, we may link your earlier visits to your details.
• Cookies and similar technologies: see section 10.

2.4 Visitors to our customers' websites

Some customers use our visitor identification add-on. For them, we provide a script, through partners such as RB2B and Factors.ai, that the customer places on pages of its own website.

• What the script collects: pages visited, time of visit, IP address and device information.
• What it identifies: the organisation a visitor belongs to. In the United States only, where the law allows it, it may also identify an individual business professional, for example by matching to a professional profile.
• What we do with it: we use this information only for that customer's Campaigns, for example to add relevant business contacts at a visiting organisation to the customer's outreach.
• Who is responsible for notice: the customer runs the website, and is responsible for telling its visitors about the script in its own privacy and cookie notices, and for obtaining any consent required.
• Opting out: you can ask us to stop at any time (section 11.1).

2.5 Other people

We collect information from job applicants (CVs, interview notes, references), suppliers and partners (contact and payment details), and people who contact us, to manage those relationships.

3. Where we get information

• From you: when you sign up, fill in a form, book a call, reply to a message or talk to us.
• From our customers: lists and CRM exports they give us, do-not-contact lists, user invitations and campaign instructions.
• From licensed B2B data providers: companies that license professional contact and company data, such as AI-Ark, BetterContact, Prospeo and Deepline, and the providers Deepline connects to (for example PredictLeads and TheirStack).
• From public sources: company websites, public registers (for example the Australian Charities and Not-for-profits Commission register), job boards, news and press releases, and public professional profiles and posts. We obtain some of this through data vendors such as Bright Data.
• From our customers' websites: where a customer uses our visitor identification add-on (section 2.4).
• From verification and deliverability services: services that check whether an email address can receive mail, such as MillionVerifier, BounceBan and EmailGuard.
• From platforms you interact with: for example your reply to an email, or your LinkedIn connection status and messages.
• From service providers: for example analytics, Factors.ai, Calendly and Stripe.
• Created by us: categorisations, relevance scores and other insights.

For most people in the GA Database, the source is one or more of the licensed data providers and public sources above; some records also come from our customers. If you ask, we'll tell you the specific source of your information, as far as our records show.

4. How and why we use information

Balancing note (legitimate interests). "Legitimate interests" is a legal basis that lets an organisation use personal information without asking permission first, as long as its reason is genuine and doesn't unfairly override the interests of the people concerned. We rely on it for business-to-business prospecting because it lets businesses find people whose roles are relevant to what they offer, and that is widely recognised as a legitimate purpose. We limit the impact on you:

• we use work-related information only, and no sensitive information;
• we explain how we operate in this policy;
• we make it easy to object, and we honour objections; and
• we keep records accurate and remove them when they're no longer useful.

You can ask for a summary of our assessment.

5. AI, automated processing and profiling

5.1 What we use AI for. We use AI models from providers such as Anthropic, OpenAI and Google, and models accessed through OpenRouter, to:

• research publicly available information about companies and roles;
• draft personalised business messages;
• categorise replies (for example "interested", "not now" or "remove me");
• draft replies to routine responses, such as offering meeting times, and send them where a customer has switched on our auto-responder;
• summarise conversations;
• rank prospects by how relevant they are to a customer's offer; and
• answer questions in Dex.

5.2 Human oversight. Customers approve campaign strategy and messaging before launch, and our team reviews replies the AI can't confidently categorise. You can ask to speak with a person at any time.

5.3 No significant automated decisions. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects, such as decisions about employment, credit, housing, insurance or access to essential services. Deciding which business professionals receive a business message, or how a reply is routed, isn't that kind of decision. So the additional disclosures that data protection law requires for such decisions don't apply; we describe our automated processing below anyway. You can object at any time (section 11).

5.4 Automated decisions. Some of our software makes, or helps make, the following decisions. It uses professional identity, role and seniority, company information, public business signals and interaction information to decide:

• which business contacts are offered to a customer or included in a campaign;
• the order in which they're contacted;
• how replies are categorised and routed; and
• whether a phone number lookup is triggered.

Some of these decisions, such as categorising a routine reply, are made by the software alone. Others, such as choosing a campaign audience, are reviewed by our team or the customer. We don't expect any of these decisions to significantly affect anyone's rights or interests, but we describe them here for transparency.

5.5 How our AI providers handle your information. We send AI providers only the information needed for the task. We use provider settings and terms under which providers don't use the information we send to train their general-purpose models. We may use information from the Services to evaluate and improve our own prompts, classifiers and features. We don't use personal information to train large language models, and we don't sell personal information for that purpose.

6. How we share information

• With our customers. We provide contact information and insights from the GA Database to customers who use our Services for B2B sales and marketing. When we run outreach for a customer, the customer can see in the Platform the messages we sent, the replies received and lead details. Replies that show interest may be forwarded to the customer's team.
• With service providers. These are companies that process information on our behalf:
• hosting and databases;
• email sending and mailbox infrastructure;
• LinkedIn connectivity;
• data and verification providers;
• AI providers;
• analytics and error monitoring;
• payments, scheduling and accounting;
• communication and productivity tools.

They may use the information only to provide services to us. You can ask us for a list of them. - With platforms you interact with. Email and LinkedIn messages pass through those platforms, which handle information under their own policies. - With professional advisers, such as lawyers, accountants, auditors and insurers, under confidentiality obligations. - For legal reasons: to comply with the law or a lawful request, to enforce our agreements, or to protect the rights, safety and security of our customers, the public or us. - In a business transfer: as part of a merger, acquisition, financing or sale of assets, subject to this policy. - With your consent or at your direction.

Information customers give us. We use lists and information a customer gives us to provide the Services to that customer. Where our agreement with the customer allows it, we may also use business contact details from those lists to verify and keep the GA Database accurate.

De-identified and aggregated information. We may create and share statistics that don't identify anyone, such as average reply rates. We keep that information in de-identified form and don't try to re-identify it.

7. "Selling", "sharing" and targeted advertising (US state law)

• Account information: we don't sell or share the personal information of our customers, users or Site visitors.
• The GA Database: we give our customers business contact information in exchange for payment, so they can identify and contact prospective business customers. That includes identifiers, professional information, work location and related insights. California and some other US states treat this as a "sale" of personal information. We have sold these categories to our customers in the past 12 months.
• Targeted advertising: we don't use the Site or the Platform to serve targeted (cross-context behavioural) advertising.
• Minors: we don't knowingly sell or share the personal information of anyone under 16.
• Your right to opt out: anyone can opt out of the sale of their information. Email privacy@growthautomation.ai with the subject "Do Not Sell or Share My Personal Information", or reply to any of our messages. We honour opt-outs for everyone, not only residents of states that require it.

8. How long we keep information

We keep personal information only as long as we need it for the purposes above, then delete or de-identify it. How long that is depends on the type of information:

9. How we protect information

We use administrative, technical and physical safeguards designed to protect personal information. They include:

• encryption in transit and at rest;
• access controls that separate each customer's data;
• least-privilege staff access;
• secrets management;
• logging and monitoring; and
• confidentiality obligations for our staff and contractors.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we'll notify you and the relevant regulators as the law requires. Customers are responsible for keeping their own login credentials secure and for managing their users' access.

10. Cookies and similar technologies

10.1 What we use on the Site.

10.2 On the Platform. We use strictly necessary storage to keep you signed in and secure, and error monitoring (Sentry) to find and fix problems. We don't use advertising cookies on the Platform.

10.3 Your choices. You can block or delete cookies in your browser settings, and install Google's Analytics opt-out browser add-on. Blocking analytics cookies won't stop the Site working.

10.4 Browser signals. There's no agreed standard for browsers' "Do Not Track" signals, so we don't respond to them. You can opt out of the sale of your information as described in section 7.

10.5 Emails. Our outreach emails don't use open-tracking pixels by default.

11. Your choices and rights

11.1 Stop outreach, or remove yourself from our database

• To stop messages from a campaign: reply to the message (for example "unsubscribe" or "remove me"), or email privacy@growthautomation.ai.
• What we do: we stop all outreach we run to you, for every customer, and exclude you from future contact lists we provide. We do this as soon as possible, and at the latest within 5 business days.
• Removal from the GA Database: we'll delete your record and keep only a minimal suppression record, so you aren't added back later from another source.
• Customers who already have your information: where practical, we'll tell any customer we gave your details to in the previous 12 months about your request. Those customers may hold your information independently, so you may also want to contact them directly.

11.2 Your rights

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you, and get a copy (in some places, a portable copy);
• correct inaccurate information;
• delete your information;
• restrict or object to our processing (for direct marketing, see the right to object at the top of this policy);
• opt out of the sale or sharing of your information, targeted advertising, and profiling that produces significant effects;
• withdraw consent, where we rely on consent;
• in US states that provide it, appeal our decision on your request (section 11.4);
• complain to us and to a privacy regulator; and
• not be treated differently for exercising your rights.

We honour these requests for everyone, wherever you live, subject to legal exceptions. For example, we may keep information we need to comply with the law or defend legal claims, or to keep a suppression record. If your request is about a message one of our customers asked us to send, see section 11.5.

11.3 How to make a request

Email privacy@growthautomation.ai, or reply to any message we sent you. You don't need an account.

• Verification. We'll ask for enough information to confirm who you are, for example asking you to confirm a request from the email address we hold. For access and deletion requests, we match the details you give us against our records. We use the information you give us for verification only to handle your request.
• Authorised agents. Someone can make a request for you if they have your signed permission or a power of attorney.
• Timing. We acknowledge requests within 10 business days. We respond:
• within one month in the EEA, UK and Switzerland (extendable by two months for complex requests);
• within 45 days under US state laws (extendable by 45 days);
• within 30 days in Canada;
• within 20 working days in New Zealand;
• within a reasonable period in Australia, normally 30 days.

We'll tell you if we need more time, and why. - Cost. Requests are free, unless they are clearly unfounded or excessive.

11.4 Appeals (US)

If we decline your request, you can appeal: reply to our decision, or email privacy@growthautomation.ai with "Appeal" in the subject line, within 60 days. We'll respond within the time your state's law allows, usually 45 or 60 days. If you're not satisfied, you can contact your state Attorney General.

11.5 Requests about customer data

If your request is about information we process for a customer (for example, messages that customer asked us to send), we'll pass it to the customer and help them respond. We also stop our own use of your information, as described in section 11.1.

11.6 Complaints

If you have a privacy concern or complaint, please contact our Privacy Officer first (section 15).

• We aim to acknowledge complaints within 5 business days, and always within 30 days.
• We investigate, and aim to give you a written response within 30 days.
• If you're not satisfied, you can complain to a regulator (section 12).

12. Information for specific regions

12.1 European Economic Area, United Kingdom and Switzerland

• Controller: NAVU LLC (Growth Automation), for the purposes described in section 1.3.
• Legal bases: see section 4. Where we rely on legitimate interests, you can object at any time. If the objection is to direct marketing, we'll stop.
• Sources: see section 3. Some sources are publicly accessible, such as company websites and public registers. Others aren't, such as licensed data providers.
• Rights: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (section 11). You also have the right to complain to your local data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner.
• International transfers: see section 13.
• Do you have to give us information? Customers must give us what we need to set up and bill an account. Business professionals don't have to give us anything.

12.2 United States

California: notice at collection and categories of information. In the past 12 months, we've collected the categories below. We use each category for the purposes in section 4. We keep it for the periods in section 8, which are set by record type. For example, business contact identifiers and professional information are kept as GA Database records, and billing records as customer account records.

Your California rights: know and access, delete, correct, opt out of sale or sharing, and non-discrimination (section 11). We don't use sensitive personal information for purposes that would give you a right to limit it. We don't offer financial incentives in exchange for personal information.

Other US states: Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states have their own privacy laws. Most of them don't cover information about people acting in a business role. We extend the rights in section 11, including appeals (section 11.4), to everyone anyway.

Nevada: you can ask us not to sell your covered information by emailing privacy@growthautomation.ai.

12.3 Australia

We handle personal information in line with the Australian Privacy Principles (APPs).

• Kinds of information, how we collect and hold it, and why: see sections 2 to 4. We hold information electronically, with the service providers described in section 6.
• Direct marketing: you can ask us at any time to stop using or disclosing your information for direct marketing, including marketing by our customers, and to tell you where we got your information. We'll do this free of charge within a reasonable time (section 11.1). Every direct marketing message we send includes a way to opt out.
• Anonymity: you can deal with us anonymously, or using a pseudonym, where that's practical (for example, for general enquiries).
• Access and correction: see section 11.
• Overseas disclosure: we're likely to disclose personal information to recipients in the countries listed in section 13.
• Automated decisions: see section 5.4.
• Complaints: see section 11.6. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

12.4 Canada (including Quebec)

• Privacy Officer: our Privacy Officer is responsible for our compliance (section 15).
• Business contact information: we use business contact information to communicate with people about their work.
• Where information is stored: personal information is stored and processed outside Canada, mainly in the United States (section 13), and may be accessible to authorities there.
• Automated tools: we use automated tools and profiling as described in section 5. Quebec residents can ask about the personal information and main factors used.
• Your rights: you can access and correct your information and withdraw consent (section 11). You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

12.5 New Zealand

When we collect information about you from someone else, this policy tells you:

• that we collected it, and why;
• who will receive it;
• our name and address; and
• your rights to access and correct it.

You can complain to the Office of the Privacy Commissioner (privacy.org.nz).

12.6 Other countries

If you live in another country, including India, the Philippines, Singapore, the United Arab Emirates or Saudi Arabia, you can exercise the rights your local law gives you by contacting us (section 15). For India, our Privacy Officer also acts as our grievance officer.

13. International transfers

We are a US company, and our main databases and servers are hosted in the United States. Our team and contractors work from several countries, including the Philippines.

We're likely to disclose personal information to recipients in:

• the United States;
• the Philippines;
• the European Union (including France, where our LinkedIn connectivity provider is based);
• Israel (a data provider); and
• other countries where our team members and service providers are located.

This means your information may be processed in a country with different privacy laws from yours.

When we transfer personal information out of the EEA, UK or Switzerland, we use safeguards recognised by those laws:

• the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments where relevant;
• a provider's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), where the provider is certified; and
• other lawful mechanisms.

We aren't ourselves certified under the Data Privacy Framework. You can ask us for a copy of the relevant safeguards.

When we disclose personal information to overseas recipients, we take reasonable steps to make sure they protect it in line with the laws that apply to us, including, where they apply, the Australian Privacy Principles.

14. Children, third-party links and Google data

Children. Our Services are for businesses and aren't directed at children. We don't knowingly collect personal information from anyone under 16. If we learn we have, we'll delete it.

Third-party websites and platforms. Our Site and messages may link to other websites and platforms, such as LinkedIn and Calendly. Their privacy practices are their own.

Google user data. Our staff connect their Growth Automation Google Workspace accounts to the Platform, so it can read and organise work email, send forwarded leads, and access Drive files and calendars. Growth Automation's use, and transfer to any other app, of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising or to train generalised AI models.

15. Contact us

Privacy Officer NAVU LLC (Growth Automation) 1309 Coffeen Ave, STE 1200 Sheridan, WY 82801, United States Email: privacy@growthautomation.ai

16. Changes to this policy

We may update this policy as our Services or the law change, and we'll post the new version with a new "Last updated" date. If we make material changes, we'll tell customers by email or in the Platform, and highlight the change on this page, before it takes effect. Where the law requires your consent to a change, we'll ask for it. Previous versions are available on request.