Privacy policy

The data controller is Growthwing, a French simplified joint-stock company whose registration is in progress, represented by its founders. Contact: talk@growthwing.ai. Growthwing has not appointed a data protection officer; requests relating to personal data are handled at this same address.

On growthwing.ai, when you request an invitation:

• your last name, first name, work email address, company and role, and the word you leave about your needs;
• the date of your request and, where applicable, the page you arrived from (link origin parameters, referrer), for internal measurement without profiling.

In the application, once you have access:

• account data: first name, last name, email address, role in the company, company, login credentials;
• company data: name, sector, size, organisation into departments and teams, invited members and their roles;
• usage data: the missions you give (the text of your request, the attachments you add, your exchanges with the team), the deliverables produced, visibility settings, display preferences;
• voice data: during the onboarding conversation and voice team-creation conversations, your voice is transcribed in real time; the transcript is kept, the audio recording is not kept by Growthwing;
• financial data, only if you enter it or connect an account in the Executive department: balances, transactions, due dates, prepared transfer orders. This data is encrypted at rest;
• technical data: connection and security logs (IP address, timestamp, browser), needed to run and protect the service.

Growthwing does not collect any special category of data within the meaning of Article 9 of the GDPR, and asks you not to entrust any to the application.

• Handling your invitation request and answering you: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Providing the application: creating your account, assembling your teams, running your missions, producing your deliverables, keeping your company’s memory: performance of the contract (Art. 6(1)(b)).
• Securing the service, preventing abuse, keeping technical logs: Growthwing’s legitimate interest (Art. 6(1)(f)).
• Informing you about changes to the service, including the switch to a paid offer: legitimate interest, with the right to object at any time (Art. 6(1)(f) and 21).
• Meeting our legal obligations, including accounting and log retention: legal obligation (Art. 6(1)(c)).

Growthwing does not sell or rent your data, and does not use it for advertising. No decision producing legal effects on you is made solely by automated means.

The teams you assemble in Growthwing are artificial intelligence systems. The content they produce (answers, deliverables, audio presentations) is generated by these systems and is presented to you as such, in accordance with Article 50 of Regulation (EU) 2024/1689 on artificial intelligence.

To produce this content, your mission data (your request, your attachments, your company context) is passed, by our partner’s engine, to language and generation models, strictly to the extent needed to carry out the mission. You choose the model behind your teams; the origin of each model and where its provider is established are stated when you choose. Growthwing does not use your data to train any model, and takes contractual and technical measures so that the model providers used do not either.

Company memory (what your teams retain from one mission to the next) belongs to your company and is never shared with another client company.

• Invitation request: until your access is opened or, failing that, three years after your last contact with us.
• Account and company data: for as long as you use the service, then three years after the account is closed, unless you ask for earlier deletion.
• Missions, deliverables and company memory: for the life of the account; deleted within thirty days of its closure, unless the law requires otherwise.
• Voice transcripts: for the life of the account, like missions.
• Financial data entered or connected: for the life of the account; deleted within thirty days of its closure or of disconnecting the bank account.
• Technical and security logs: twelve months.
• Accounting records, once the service is subscribed: ten years, as required by the French Commercial Code.

Your data is processed by the Growthwing team and by the following processors, each bound by contract to the obligations of Article 28 of the GDPR:

• Scaleway SAS (France): hosting of our servers and database, in France.
• Our technology partner providing the engine that runs the teams, established in France: execution of missions on machines dedicated to your company.
• Anthropic (United States) and Mistral AI (France): language models used by our own writing, analysis and summary functions.
• The providers of the language models you choose for your teams, called by our partner’s engine: their identity and where they are established are shown when you choose.
• OpenAI (United States): generation of the portraits illustrating your team members, from a description containing no personal data about you.
• ElevenLabs (United States): the onboarding and team-creation voice conversation, and the voices of the audio presentations of deliverables.
• Growthwing’s email delivery provider: confirmation of your invitation request and service emails.
• Where applicable, the licensed bank-account access provider you choose to connect in the Executive department.

Administrative or judicial authorities may access your data in the cases provided for by law.

Your data resides in a data centre located in Paris. Some of the processors listed above are established in the United States: Anthropic, OpenAI and ElevenLabs. Depending on the language model you choose for your teams, its provider may also be established outside the European Union; you are told when you choose, and remain free to prefer a model established in France or in Europe. The resulting transfers are governed by the standard contractual clauses adopted by the European Commission and, where the processor is certified, by the EU-US Data Privacy Framework. Only the data strictly needed for the operation is transferred, and never your financial data.

You can ask not to use the voice conversation and use the written entry instead: no data is then passed to ElevenLabs.

growthwing.ai uses Google Analytics to measure its traffic, only if you accept it in the banner shown when you arrive. Until you accept, no Google script is loaded and no measurement cookie is set. Your choice, acceptance or refusal, is kept for six months in your browser; you can change it at any time from the “Cookies” link at the bottom of the page. Measurement data is processed by Google Ireland Limited, with IP anonymisation enabled, and is not used for advertising.

The application uses your browser’s local storage and session tokens strictly needed for your login and display preferences (theme, settings, resuming an interrupted conversation). These are exempt from consent under Article 82 of the French Data Protection Act, and serve no advertising tracking.

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to set instructions on what happens to your data after your death.

To exercise them, write to talk@growthwing.ai from the address linked to your account, or provide the details that identify you. We reply within one month, extendable by two months for complex requests.

If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris cedex 07, www.cnil.fr.

Growthwing applies technical and organisational measures suited to the sensitivity of the data: encryption in transit, encryption at rest for financial data, separation of data by company, restricted and logged server access, regular security review. In the event of a data breach likely to create a risk to your rights, we inform you and notify the CNIL under Articles 33 and 34 of the GDPR.

This policy may change with the service. The date at the top of the page indicates the version in force. In the event of a substantial change, users of the application are informed in the application or by email.