Privacy Policy & Compliance

1. Who We Are

XGrowth (the "Service" or "Platform") is operated by SNDP-Design ("we", "us", or "our"). This Privacy Policy governs all data processed through our website (https://www.xgrowth.uno) and application workspace (https://www.xgrowth.uno/app/).

For inquiries regarding data protection, you may reach our Data Protection Officer at privacy@xgrowth.uno or hello@xgrowth.uno.

2. Information We Collect

2.1 Account & Authentication Information

When you authenticate using Google Sign-In, we receive basic identity profile details:

• Your full name and email address
• Your avatar / profile picture URL
• Your unique Google account identifier (sub)

We only request openid, email, and profile scopes. We do not access your Gmail, Google Drive, Calendar, or contacts during sign-in.

We use your name and email to send account emails such as the welcome message after you first sign in. These are service notices about your XGrowth account, not marketing campaigns.

2.2 Workspace & GTM Intelligence Data

When you use XGrowth agents, we store and process:

• Product URL & Canonical Facts: Target website domain, crawled feature lists, pricing models, value propositions, problem statements, and public mention citations.
• Agent Synthesis Results: ICP buyer segments, competitor teardowns, messaging headlines, objection scripts, experiment plans, campaign post drafts, and demand lead profiles.
• Founder Directives & Approvals: Approved strategic items, founder override notes, and learning feedback.

2.3 Payment & Billing Data

Subscription management and checkout are operated by Dodo Payments (PCI-DSS Level 1 compliant). We receive transaction identifiers, subscription status, and billing cycle dates. We never receive or store your raw payment card numbers.

3. Zero AI Model Training Commitment

We understand that your GTM strategy, product roadmaps, and customer positioning are proprietary trade secrets. We enforce the following strict AI data processing architecture:

• No Foundation Model Training: Data sent to our LLM inference providers (Google Cloud Gemini Enterprise & OpenAI API) is governed by commercial zero-retention / enterprise privacy agreements. Your data is never used to train, retrain, or improve foundational AI models.
• Isolated Contexts: Each agent prompt is strictly owner-scoped (keyed by your unique user ID and website origin). Data from one user is never shared with or accessible by other users.
• Fact vs. Inference Separation: The system explicitly labels AI hypotheses separately from verified company facts.

4. European General Data Protection Regulation (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you hold specific legal rights under GDPR (Articles 12–23):

• Right to Access (Art. 15): You have the right to obtain confirmation and a copy of the personal data we process about you.
• Right to Rectification (Art. 16): You can modify and correct any inaccurate profile information directly in the workspace.
• Right to Erasure / "Right to be Forgotten" (Art. 17): You can instantly delete your account and all associated workspace records through the in-app Settings view or by contacting us.
• Right to Restriction of Processing (Art. 18): You may request that we suspend processing your personal data.
• Right to Data Portability (Art. 20): You can export all your workspace intelligence, profiles, and drafts in structured JSON format at any time.
• Right to Object (Art. 21): You have the right to object to the processing of your data where we rely on legitimate interest.

Legal Bases for Processing: We process your data based on: (1) Contractual necessity to provide the XGrowth service you requested; (2) Legitimate interest in securing, optimizing, and operating our platform; and (3) Consent where explicitly requested.

5. California Consumer Privacy Act & CPRA (CCPA)

If you are a California resident, the California Consumer Privacy Act (as amended by CPRA) provides you with specific rights:

• Right to Know & Access: You may request details on the categories of personal data collected, sources, business purposes, and specific pieces of personal information collected in the preceding 12 months.
• Right to Delete: You may request the permanent deletion of your personal information collected by XGrowth.
• Right to Correct: You may correct inaccurate personal data.
• Do Not Sell or Share My Personal Information: We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you (in price, service level, or access) for exercising any of your CCPA rights.

6. Third-Party Sub-Processors

We work with trusted infrastructure sub-processors who adhere to strict data protection standards:

7. How to Exercise Your Rights (Self-Service)

We provide instant self-service controls directly within the XGrowth platform:

• Export Workspace Data: Open the Workspace Settings tab and click Export Data to download a complete JSON bundle of your product brain, ICP validation, positioning teardowns, messaging copy, experiment plans, campaigns, and demand leads.
• Delete Account & All Data: Open Settings, scroll to the Privacy section, and click Delete Account & Wipe Data. This permanently purges your records across our D1 database, KV cache, and Firebase Auth records.
• Manual Requests: You can also email privacy@xgrowth.uno. We respond to all verified privacy requests within 30 days without charge.

8. Security Architecture

Security is built into our platform from the ground up:

• Encryption in Transit & at Rest: All communications are encrypted with TLS 1.3. Stored tokens (e.g. Gmail/X OAuth credentials) are protected with AES-256-GCM encryption using dedicated server secrets.
• Tenant & Workspace Isolation: All database queries enforce strict user boundary filters (user_id = firebaseUser.sub) to prevent data cross-contamination.
• SSRF & Injection Defense: Public crawling tools validate every URL through public DNS-over-HTTPS guards and reject internal, loopback, or cloud metadata IP addresses.

9. Contact Us

If you have any questions, feedback, or concerns regarding this Privacy Policy or our compliance practices, please contact us:

• Privacy & DPO Inquiries: privacy@xgrowth.uno
• General Support: hello@xgrowth.uno
• Mailing Address: SNDP-Design, XGrowth Platform Team, https://www.xgrowth.uno