Privacy policy
Draft for review. Ali approves before launch.
Last updated: 2026-10-12
This policy explains how [company name] handles personal data in GrowViking: what we collect, why, how long we keep it and what rights you have. GrowViking is sold to businesses, so the people concerned are mostly the owners and team members of those businesses, and the shoppers of the shops they connect.
Who we are
GrowViking is run by [company name], CVR [CVR number], [company address]. We are the data controller for the personal data described in this policy, except where we say that we act as a data processor for a business.
Questions about privacy, or a request to use your rights: write to [contact email]. We answer within one month, usually much sooner.
Our two roles
We are the controller for data about our customers and visitors: accounts, billing, support, our website and our own marketing.
GrowViking processes order data on behalf of each business that signs up (GrowViking is the data processor; the business is the controller). Customer emails are not stored; only a keyed, one-way code used to count repeat buyers. Data is hosted in the EU and is never sold or shared with other businesses.
What data we collect
- Account data: name, email address, password (kept only as a one-way code), language, your role in the team, and the business details you enter, such as business name, VAT number and address.
- The version of the terms you accepted, and when, so we can show what was agreed.
- Billing data: your package, invoices and payment status. Card and bank details are handled by Stripe and Nets; we only see, for example, the card type and the last four digits.
- Shop data, as a processor: orders, products, prices, costs and stock from the shops you connect, and the customer messages you bring into GrowViking if you use customer service.
- Advertising data: from the Meta and Google accounts you connect, GrowViking reads campaigns, ads, spend and results, and keeps the access keys encrypted. It reads no personal data about the people who saw your ads.
- Use and security data: when you log in, the IP address at sign-in, failed log-in attempts and an audit log of the changes made in your account.
- Website visitors: necessary cookies always, and statistics and marketing cookies only if you say yes (see Cookies below).
Why we use it, and the legal basis
- To provide the service your business signed up for: the contract (GDPR article 6(1)(b)).
- To send invoices and keep accounts: our legal duty under the Danish Bookkeeping Act (article 6(1)(c)).
- To keep GrowViking secure, stop misuse and make it better: our legitimate interest (article 6(1)(f)).
- To send news about GrowViking: your consent, or our legitimate interest towards existing customers as the Danish Marketing Practices Act allows. Every such email lets you say no.
- Statistics and marketing cookies on our website: your consent (article 6(1)(a)), which you can take back at any time.
We never sell personal data, and we do not use your shop data to train AI models.
Data processing agreement
When you connect a shop, your business is the controller of its shoppers' data and GrowViking is the processor. This section, together with the terms, is our data processing agreement under GDPR article 28. Your business accepts it when it creates an account.
- We process the data only on your documented instructions: to show profit, advice and the other features you switch on. We do not use it for anything else.
- Everyone at GrowViking who can reach the data is bound by confidentiality.
- We protect the data with encryption on the way and of stored access keys, a separate space for each business, access control, backups and an audit log.
- We use the sub-processors listed below. We tell you before we add or replace one, so you can object; if we cannot agree, you can cancel.
- We help you answer requests from your shoppers and meet your own duties, and we tell you without undue delay, at the latest within 48 hours, if we learn of a personal data breach that affects your data.
- When your account ends, we delete the shop data within 30 days, unless the law requires us to keep it. On request we give you the information needed to show that these rules are kept, and allow a reasonable audit.
Platform learnings (only if the owner switches it on)
A business can choose to share anonymous learnings with the GrowViking Platform Brain. GrowViking then turns the business's own results into learning cards that hold only: a kind of ad or test from GrowViking's fixed list (for example "Ad angle: Gift"), whether it earned more or less profit per 1 spent than the business's other ads (rounded), the industry, the country and the month. They never hold personal data, customer or order details, product names, ad texts or images, amounts of money, or anything read from Meta or another connected platform.
Cards are combined into patterns that are shown only when at least 5 different businesses back them, each business counted once. The owner can switch sharing off at any time, which deletes the business's cards at once. Sharing is a choice of the business as controller; no personal data is used for it.
Support access
The GrowViking team can only look inside a business's account when its owner opens support access, for a period the owner chooses. It is read-only, can be closed at any time, and every page the team opens is listed in the business's audit log.
Sub-processors
These companies help us run GrowViking. Each gets only the data it needs for its task.
| Company | What it does for us | Where |
|---|---|---|
| Hostinger | Hosts our servers and database. | EU |
| Stripe | Card payments and subscriptions. | EU and USA |
| Nets (Nexi Group) | Card payments. | EU |
| Anthropic | The AI engine that writes advice and texts. It gets only what each answer needs, and does not train on it. | USA |
| Google Ads and Google Analytics, when you connect them or say yes to statistics cookies. | EU and USA | |
| Meta | Facebook and Instagram ads, when you connect them, and the Meta Pixel if you say yes to marketing cookies. | EU and USA |
| [email provider] | Sends log-in, password and notice emails. | EU |
For their own purposes, Meta and Google are independent controllers under their own terms. If we change the AI engine or another sub-processor, we update this list first.
Transfers outside the EU
Our servers and database are in the EU. Some sub-processors (Stripe, Anthropic, Google and Meta) are based in the USA or may reach data from there. We only allow that with a lawful safeguard: the EU-US Data Privacy Framework where the company is certified, and otherwise the European Commission's standard contractual clauses, with extra measures such as encryption and sending only the data needed.
How long we keep data
- Account data: while the account is open, and deleted within 30 days after it is closed.
- Shop, order and advertising data: while the account is open or until you disconnect the source, then deleted within 30 days.
- Invoices and bookkeeping records: 5 years from the end of the financial year, as the Danish Bookkeeping Act requires.
- Security logs: up to 12 months, unless they are needed for an open case.
- Backups roll over within 30 days, so deleted data also leaves the backups within that time.
Your rights
You have the right to see the data we hold about you, to have it corrected or deleted, to limit or object to its use, and to get it in a format you can move to another service. Where we rely on your consent, you can take it back at any time; this does not affect what was done before.
If your data came to us through a shop that uses GrowViking, please contact that shop first: it is the controller, and we help it answer you.
To use your rights, write to [contact email]. We may ask you to confirm who you are. It is free, and we answer within one month.
Deleting your data
Facebook and Instagram data: on the Ads page press Disconnect next to an ad account, and GrowViking deletes that account and everything it read from it. On the Meta setup page, Disconnect Facebook deletes GrowViking's Facebook login. You can also remove GrowViking in Facebook under Settings › Business integrations, which stops all access at once.
To delete a whole business account and all its data, its owner can ask GrowViking from the account's sign-in email address; it is deleted within 30 days.
Cookies
Cookies are small files a website keeps in your browser. GrowViking always uses necessary cookies, and uses statistics and marketing cookies only if you say yes in the cookie banner. The three choices there are equally easy: Accept all, Only necessary, or Choose.
| Cookie | Kind | What it does | How long |
|---|---|---|---|
mm_session | Necessary | Keeps you logged in and protects forms. | 12 hours |
gv_consent | Necessary | Remembers your cookie choice. | 6 months |
gv_lc, gv_lc_seen | Necessary | Remembers the language and currency you picked, and that we told you which we picked for you. | 1 year |
gv_tz | Necessary | Remembers your time zone, to pick your language and show the right dates. | 1 year |
_ga, _ga_* | Statistics | Google Analytics: counts visits and how the site is used. | Up to 2 years |
_clck, _clsk | Statistics | Microsoft Clarity: shows how pages are used, without knowing who you are. | Up to 1 year |
_fbp, _fbc | Marketing | Meta Pixel: lets Meta measure our ads and show them to people who visited. | 3 months |
_gcl_au | Marketing | Google Ads: lets Google measure our ads. | 3 months |
Statistics and marketing tools are only used when we have switched them on, and any new tool is added to this list first. Your light or dark look and the menu you opened are kept in your browser only and never sent to us.
You can change or take back your choice at any time with Cookie settings at the bottom of every page and in your account menu. When you take back a yes, the page reloads and the cookies those tools left are removed.
A shop that uses GrowViking tracking on its own website asks its own visitors for consent and describes it in its own privacy policy.
Changes to this policy
We update this policy when GrowViking or the law changes. The date at the top shows the latest version, and we email account owners about important changes before they apply.
Contact and complaints
Write to [contact email], or by post to [company name], [company address].
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk. We would be glad to hear from you first, so we can try to put it right.