Privacy policy

Last updated: 2026-10-15

This policy explains how [company name] handles personal data in GrowViking: what we collect, why, how long we keep it and what rights you have. GrowViking is sold to businesses, so the people concerned are mostly the owners and team members of those businesses, and the shoppers of the shops they connect.

Who we are

GrowViking is run by [company name], CVR [CVR number], [company address]. We are the data controller for the personal data described in this policy, except where we say that we act as a data processor for a business.

Questions about privacy, or a request to use your rights: write to [contact email]. We answer within one month, usually much sooner.

Our test site dev.growviking.com holds only made-up demo data and is hidden from search engines. Please do not enter real business or personal data there.

Our two roles

We are the controller for data about our customers and visitors: accounts, billing, support, our website and our own marketing.

GrowViking processes order data on behalf of each business that signs up (GrowViking is the data processor; the business is the controller). Customer emails are not stored; only a keyed, one-way code used to count repeat buyers. Data is hosted in the EU and is never sold or shared with other businesses.

What data we collect

• Account data: name, email address, password (kept only as a one-way code), language, your role in the team, and the business details you enter, such as business name, VAT number and address.
• The version of the terms you accepted, and when, so we can show what was agreed.
• Billing data: your package, invoices and payment status. Card and bank details are handled by Stripe and Nets; we only see, for example, the card type and the last four digits.
• Shop data, as a processor: orders, products, prices, costs and stock from the shops you connect (Shopify, WooCommerce or files you upload). A shopper's email address is not stored; it becomes a keyed, one-way code that only counts repeat buyers.
• Advertising data: from the Meta (Facebook and Instagram) and Google Ads accounts you connect, GrowViking reads campaigns, ad sets, ads, audiences, spend and results, and keeps the access keys encrypted. It does not read who saw or clicked your ads. If you switch on ad comments, it reads the text of the comments under your running ads and keeps it without the writer's name.
• Customer service, as a processor: if you switch on AI Customer Service, the messages your customers send by email (Gmail or another mailbox you connect), in the chat box on your website, on Messenger, in Instagram messages and on WhatsApp, with the sender's name and address, and the replies. They are kept so your team can read and answer them.
• Other services you connect: Google Analytics 4, Google Search Console, Google Merchant Center, Microsoft Clarity, TikTok Ads and Trustpilot, from which GrowViking reads figures such as visits, search terms, product status and review scores (from Clarity only the share of visits where shoppers got stuck, never recordings), and Canva, where it sends and imports only the designs you pick.
• GrowViking's tracking script, if you add it to your shop: for shoppers who come from an ad, the page, the ad's tags and click ids, and the steps to an order, under a random id kept in the shopper's browser. It never stores IP addresses, names or emails, and by default it waits for the shopper's marketing consent.
• Meta Conversions API, only if you switch it on: each paid order is sent to Meta with its value, products and country. Only if you also tick "share buyer details" are the buyer's email, phone, name, city and postcode sent, hashed, with the IP address and browser; your shop's own privacy policy must then say so.
• Demo bookings and messages to us: the email address, and if you like your name and shop address, that you give when you book a demo or write to us.
• Use and security data: when you log in, the IP address at sign-in, failed log-in attempts and an audit log of the changes made in your account.
• Website visitors: necessary cookies always, and statistics and marketing cookies only if you say yes (see Cookies below).

Why we use it, and the legal basis

• To provide the service your business signed up for: the contract (GDPR article 6(1)(b)).
• To send invoices and keep accounts: our legal duty under the Danish Bookkeeping Act (article 6(1)(c)).
• To keep GrowViking secure, stop misuse and make it better: our legitimate interest (article 6(1)(f)).
• To send news about GrowViking: your consent, or our legitimate interest towards existing customers as the Danish Marketing Practices Act allows. Every such email lets you say no.
• Statistics and marketing cookies on our website: your consent (article 6(1)(a)), which you can take back at any time.

We send log-in, password, invoice and notice emails, and a weekly summary email that each person can switch off in Settings.

We never sell personal data, and we do not use your shop data to train AI models.

Data processing agreement

When you connect a shop, your business is the controller of its shoppers' data and GrowViking is the processor. This section, together with the terms, is our data processing agreement under GDPR article 28. Your business accepts it when it creates an account.

• We process the data only on your documented instructions: to show profit, advice and the other features you switch on. We do not use it for anything else.
• Everyone at GrowViking who can reach the data is bound by confidentiality.
• We protect the data with encryption on the way and of stored access keys, a separate space for each business, access control, backups and an audit log.
• We use the sub-processors listed below. We tell you before we add or replace one, so you can object; if we cannot agree, you can cancel.
• We help you answer requests from your shoppers and meet your own duties, and we tell you without undue delay, at the latest within 48 hours, if we learn of a personal data breach that affects your data.
• When your account ends, we delete the shop data within 30 days, unless the law requires us to keep it. On request we give you the information needed to show that these rules are kept, and allow a reasonable audit.

Platform learnings (only if the owner switches it on)

A business can choose to share anonymous learnings with the GrowViking Platform Brain. GrowViking then turns the business's own results into learning cards that hold only: a kind of ad or test from GrowViking's fixed list (for example "Ad angle: Gift"), whether it earned more or less profit per 1 spent than the business's other ads (rounded), the industry, the country and the month. They never hold personal data, customer or order details, product names, ad texts or images, amounts of money, or anything read from Meta or another connected platform.

Cards are combined into patterns that are shown only when at least 5 different businesses back them, each business counted once. The owner can switch sharing off at any time, which deletes the business's cards at once. Sharing is a choice of the business as controller; no personal data is used for it.

Support access

The GrowViking team can only look inside a business's account when its owner opens support access, for a period the owner chooses. It is read-only, can be closed at any time, and every page the team opens is listed in the business's audit log.

Data from Google and Meta

GrowViking's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the policy

We use data from Google (Google Ads, Analytics, Search Console, Merchant Center and, for customer service, Gmail) only to show and run the features you switched on for your own business. We do not use it for advertising, do not sell it, do not use it to train general AI models, and no person at GrowViking reads it, except with your permission, for security, or when the law requires it.

Data from Meta (Facebook Login, ad accounts, Pages, ad comments, and Messenger, Instagram and WhatsApp messages) is used the same way: only for the features you switch on, never sold, and deleted when you disconnect, as described under Deleting your data.

Sub-processors

These companies help us run GrowViking. Each gets only the data it needs for its task.

Meta, Google, Microsoft, Shopify, TikTok, Trustpilot and Canva are independent controllers for their own purposes, under their own terms; your business connects them under its own agreement with them. If we change the AI engine or another sub-processor, we update this list first.

Transfers outside the EU

Our servers and database are in the EU. Some sub-processors (Stripe, Anthropic, Google, Meta and Microsoft) are based in the USA or may reach data from there. We only allow that with a lawful safeguard: the EU-US Data Privacy Framework where the company is certified, and otherwise the European Commission's standard contractual clauses, with extra measures such as encryption and sending only the data needed.

How long we keep data

• Account data: while the account is open, and deleted within 30 days after it is closed.
• Shop, order and advertising data: while the account is open or until you disconnect the source, then deleted within 30 days.
• Customer service messages, ad comments and tracking events: while the account is open, and deleted within 30 days after it is closed.
• Demo bookings and messages to us: up to 12 months after our last contact, unless you become a customer.
• Invoices and bookkeeping records: 5 years from the end of the financial year, as the Danish Bookkeeping Act requires.
• Security logs: up to 12 months, unless they are needed for an open case.
• Backups roll over within 30 days, so deleted data also leaves the backups within that time.

Your rights

You have the right to see the data we hold about you, to have it corrected or deleted, to limit or object to its use, and to get it in a format you can move to another service. Where we rely on your consent, you can take it back at any time; this does not affect what was done before.

These rights follow the GDPR, which applies in Denmark, Sweden, Germany and France, and in Norway through the EEA Agreement.

If your data came to us through a shop that uses GrowViking, please contact that shop first: it is the controller, and we help it answer you.

To use your rights, write to [contact email]. We may ask you to confirm who you are. It is free, and we answer within one month.

Deleting your data

Facebook and Instagram data: on the Ads page press Disconnect next to an ad account, and GrowViking deletes that account and everything it read from it. On the Meta setup page, Disconnect Facebook deletes GrowViking's Facebook login. You can also remove GrowViking in Facebook under Settings › Business integrations, which stops all access at once.

Google: Disconnect next to a Google service in GrowViking stops its access and deletes its key. You can also remove GrowViking at myaccount.google.com/permissions.

Shopify: removing the GrowViking app in your Shopify admin stops all access at once. Shopify then asks us to delete the shop's data, and we do. We also answer the data requests Shopify sends for your shoppers.

To delete a whole business account and all its data, its owner can ask GrowViking from the account's sign-in email address; it is deleted within 30 days.

Anyone can ask us to delete their data by writing to [contact email]. We confirm when it is done, within 30 days. If your data came to us through a business that uses GrowViking (its shop, its ads or its messages), we pass the request on to that business and help it.

Cookies

Cookies are small files a website keeps in your browser. GrowViking always uses necessary cookies, and uses statistics and marketing cookies only if you say yes in the cookie banner. The three choices there are equally easy: Accept all, Only necessary, or Choose.

Statistics and marketing tools are only used when we have switched them on, and any new tool is added to this list first. Your light or dark look and the menu you opened are kept in your browser only and never sent to us.

You can change or take back your choice at any time with Cookie settings at the bottom of every page and in your account menu. When you take back a yes, the page reloads and the cookies those tools left are removed.

Cookie settings

The GrowViking chat box on a shop keeps a random conversation id in the visitor's browser, so the conversation carries on from page to page.

A shop that uses GrowViking tracking on its own website asks its own visitors for consent and describes it in its own privacy policy.

Changes to this policy

We update this policy when GrowViking or the law changes. The date at the top shows the latest version, and we email account owners about important changes before they apply.

Contact and complaints

Write to [contact email], or by post to [company name], [company address].

You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk. We would be glad to hear from you first, so we can try to put it right.

If you live or work in another country, you can also complain to the authority there, for example Datatilsynet in Norway, Integritetsskyddsmyndigheten (IMY) in Sweden, the data protection authority of your German state, or the CNIL in France.