GROWINGO — PRIVACY POLICY

Effective Date: 1 August 2026 Last Updated: 21 October 2026 Version: 1.0

WHO WE ARE Ashish Kumar Jha, sole proprietor trading as "GROWINGO" ("GrowingO"), Ghaziabad, Uttar Pradesh, India. We decide why and how your personal data is processed (we are the "Data Fiduciary").

WHAT WE NEVER WANT Patient data, health records or any sensitive personal data. Do not enter it into any tool or form.

WHAT WE DO NOT DO We do not sell your personal data. We do not use your tool inputs to train third-party AI models.

YOUR RIGHTS Access, correction, erasure, withdrawal of consent, grievance redress, and nomination. Email partners@growingo.net.

This summary does not replace the full Policy in Part B.

1.1 This Privacy Policy explains how GrowingO collects, uses, shares, stores and protects personal data when you visit growingo.net (the "Website"), use any free tool on it (the "Tools"), submit any form, or communicate with us.

1.2 "GrowingO", "we", "us" or "our" means Ashish Kumar Jha, sole proprietor trading as "GROWINGO", at UG2, 2/118, Sec 2, Rajendra Nagar, Sahibabad, Ghaziabad, Uttar Pradesh 201005, India.

1.3 This Policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and, as and when their provisions come into force, the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025.

1.4 This Policy forms part of our Terms & Conditions https://growingo.net/terms/. Capitalised terms not defined here have the meaning given in the Terms.

1.5 This Policy does not cover personal data we process on behalf of clients under a signed services agreement. That processing is governed by the relevant agreement and data processing terms.

2.1 Data you give us directly (a) Diagnosis and contact forms: full name, professional title, work email address, organisation name, primary specialty, current hospital information system, monthly advertising spend band, description of business bottleneck, and anything else you choose to write. (b) Correspondence: content of emails, messages and calls with us, and any business information you share during a Diagnosis Session. (c) Marketing preferences: whether you have opted in or out of updates.

2.2 Data you submit to Tools (a) Text, URLs, domains, keywords or files you enter into a Tool ("Inputs"). (b) Tools are designed to analyse content, not people. Inputs should not contain personal data. If they do, see section 4.

2.3 Data collected automatically (a) Technical data: IP address, browser type and version, device type, operating system, screen size, referring URL, pages viewed, time spent, clicks, and date and time of access. (b) Approximate location derived from IP address (city or region level, not precise location). (c) Browser storage and cookies, including counters used to apply free-scan limits (see section 7). (d) Server and security logs, including request records, error logs and abuse-detection signals.

2.4 Data from third parties (a) Analytics providers (if enabled) give us aggregated reports about Website use. Currently no third-party tracking analytics are active on the Website. (b) Where a Tool analyses a public URL, third-party services (such as Google PageSpeed Insights) return technical data about that URL. This is generally not personal data. (c) Publicly available professional information (for example, a LinkedIn profile) where you contact us or we research a potential business relationship.

3.1 We use personal data only for the purposes stated at the time of collection or as described above, and only to the extent necessary for those purposes.

3.2 We do not use personal data for automated decisions that produce legal or similarly significant effects on you.

4.1 Do not submit to any Tool, form or communication: (a) any patient information or health, medical or clinical data relating to any identifiable individual; (b) passwords, financial account or card details, or government identification numbers; (c) biometric data, or information about anyone's sexual orientation, physical, physiological or mental health condition, or medical records or history; (d) personal data of any child (under 18); or (e) personal data of anyone who has not authorised you to share it.

4.2 If you submit such data despite this section, you do so at your own risk, you are responsible for having a lawful basis to do so, and you agree to the indemnity in our Terms. We may delete such data on discovery without notice.

5.1 AI Detector & Humanizer: Inputs are processed on our servers by a deterministic engine to generate scores and suggestions. Inputs are not sent to any external AI or language-model provider. Inputs are not stored after the result is returned.

5.2 Performance Tools: the URL you submit is sent to Google PageSpeed Insights (or a similar service) to obtain performance data. Google processes that request under its own terms and privacy policy.

5.3 AEO/SEO and future Tools: some Tools may send Inputs to third-party services, including AI model providers, to generate results. Where a Tool does this, the Tool page will say so before you run it, and the provider will be bound by terms that restrict use of your Inputs.

5.4 We do not use Inputs to train our own or any third-party AI model. We may keep aggregated, anonymised statistics (for example, number of scans, average word count, score distribution) that do not identify any individual or reproduce any Input.

6.1 We do not sell, rent or trade personal data.

6.2 We share personal data only with: (a) Service providers who process it on our behalf under contract, such as website hosting and content delivery (Hostinger), email and productivity services (Google Workspace / Google Sheets), calendar/scheduling tools, CRM, and API providers used by Tools (such as Google PageSpeed Insights API). (b) Professional advisers such as lawyers, auditors and accountants, under confidentiality obligations. (c) Government, regulatory, law-enforcement or judicial authorities where required by law, court order or lawful request, or to protect the rights, property or safety of GrowingO, our users or the public. (d) A successor entity in connection with incorporation, reorganisation, merger, acquisition or sale of all or part of our business, subject to this Policy. (e) Anyone else with your consent.

6.3 Our service providers may use their own sub-processors. We are not responsible for the independent privacy practices of third parties whose services you use directly (for example, by clicking a link to LinkedIn).

7.1 Types we use: (a) Strictly necessary: required for the Website and Tools to work, including session consent states and free-scan usage counters stored in your browser or hashed on our server. (b) Analytics: currently no third-party analytics cookies are active on the Website. (c) Third-party embeds: web font delivery (Google Fonts) and content delivery services may process standard technical HTTP headers.

7.2 Your choices. You can block or delete cookies and browser storage through your browser settings. Blocking strictly necessary storage may stop some Tools from working. Clearing storage to bypass usage limits is prohibited under our Terms.

8.1 Our service providers may store or process personal data outside India, including in the United States. We transfer personal data outside India only as permitted by Indian law, and not to any country or territory restricted by the Central Government under the DPDP Act.

9.1 Where required by law (including directions of CERT-In or any authority), we retain specific records for the period prescribed.

9.2 When retention ends, we delete or irreversibly anonymise data unless law requires otherwise.

10.1 We implement reasonable security practices and procedures appropriate to the nature of the data, including encryption in transit (HTTPS), access controls limited to personnel who need access, reputable hosting providers, and monitoring for misuse.

10.2 No method of transmission or storage is completely secure. While we take reasonable steps, we cannot guarantee absolute security. You are responsible for what you choose to submit, and should not submit data listed in section 4.

10.3 Breach response. If we become aware of a personal data breach, we will take reasonable steps to contain it and will notify affected individuals and the competent authorities as and when required by Applicable Law.

11.1 Subject to Applicable Law, you have the right to: (a) Access: obtain a summary of the personal data we process about you and the processing activities; (b) Correction and completion: have inaccurate or incomplete data corrected or completed, and update it; (c) Erasure: have your personal data erased where it is no longer needed for the purpose or you withdraw consent, unless retention is required by law; (d) Withdraw consent: at any time, as easily as you gave it. Withdrawal does not affect processing already carried out; (e) Grievance redressal: have your complaint addressed by our Grievance Officer; and (f) Nomination: nominate another individual to exercise your rights in the event of your death or incapacity.

11.2 How to exercise: email partners@growingo.net with the subject "Data Request". We may ask you to verify your identity before acting. We aim to respond within 30 days.

11.3 Marketing: click "unsubscribe" in any marketing email, or write to us. We will stop within 10 working days.

11.4 Your duties: under the DPDP Act you must not provide false information, impersonate anyone, suppress material information, or file frivolous or false complaints.

12.1 The Website and Tools are intended only for business users aged 18 and above. We do not knowingly collect personal data of anyone under 18. If you believe a child has provided personal data to us, contact us and we will delete it.

13.1 The Website links to third-party sites such as LinkedIn. Their privacy practices are their own. Please read their policies before sharing data with them.

14.1 We may update this Policy from time to time. The updated version will be posted on this page with a new "Last Updated" date. Material changes will be highlighted on this page for at least 30 days and, where we have your email and the change significantly affects you, notified by email. Where the law requires fresh consent, we will seek it.

15.1 Grievance Officer (under the Information Technology Act, 2000, the 2011 Rules and the DPDP Act, 2023):

Name: Ashish Kumar Jha Organisation: Ashish Kumar Jha, sole proprietor trading as "GROWINGO" Address: UG2, 2/118, Sec 2, Rajendra Nagar, Sahibabad, Ghaziabad, Uttar Pradesh, India 201005 Email: partners@growingo.net Privacy: partners@growingo.net

15.2 We will acknowledge your grievance within 48 hours and aim to resolve it within 30 days.

15.3 If you are not satisfied with our response, you may, once the relevant provisions are in force, approach the Data Protection Board of India after exhausting this grievance mechanism.

16.1 Matters of liability, indemnity, disclaimers and dispute resolution relating to your use of the Website and Tools are governed by our Terms & Conditions, which apply to this Policy to the extent permitted by Applicable Law.

END OF PRIVACY POLICY