Data processing
Data processing terms
Draft dated 7 November 2026. Applies to Growth Dept ACR at acr.growthdept.ai.
1. Roles
The store is the controller of its shoppers’ personal data. Growth Dept is the processor: it processes that data only on the store’s instructions, to run the store’s campaigns and report their results.
2. What is processed
Shoppers’ contact details, checkout and order details, consent records, and the conversations the store’s campaigns hold, as listed in the privacy policy.
3. Subprocessors
- Vercel: application hosting, United States.
- Neon: database hosting, United States.
- Twilio: phone numbers, calls and text messages.
- ElevenLabs: the voice agent.
- Google and Microsoft: the store’s own mailbox, when connected.
- An AI text provider, when a store switches one on. [PROVIDER TO BE NAMED]
4. Security
Store data is separated by row-level security, secrets are encrypted, and access is by role with an audit log. The security page has the details.
5. Requests and deletion
Growth Dept helps the store answer shoppers’ requests to see or delete their data, and deletes or returns the store’s data when the service ends. [TIMELINES TBD]
6. Getting the agreement
Email hello@growthdept.ai to request the data processing agreement once it is published.