Privacy Policy

1. Introduction

GrowthMap ("we", "our", "us") is a marketing companion application operated by JMS Dev Lab, the data controller for the service. This Privacy Policy explains how we collect, use, and protect your personal information when you use our web application at mygrowthmap.net and our Shopify app.

2. Information We Collect

When you use GrowthMap, we may collect:

• Account information (email address, name, business name)
• Business profile data (industry, website, marketing preferences)
• Usage data (tasks completed, progress, streaks)
• Campaign attribution and the optional “How did you hear about GrowthMap?” answer
• Shopify store data (store name and product catalog) when installed as a Shopify app
• Payment information (processed securely by Stripe or Shopify Billing)

3. How We Use Your Information

• To provide personalized marketing task suggestions
• To track your marketing progress and streaks
• To generate AI-powered content only when you request it, or when you explicitly enable overnight draft preparation with your own Anthropic key
• To manage your subscription and billing
• To improve our service and user experience
• To understand which acquisition channels lead to useful product adoption

4. Lawful Bases

We process account, roadmap and billing data to perform our contract with you; security, fraud prevention and essential diagnostics for our legitimate interests; optional analytics, advertising, support chat and marketing email only with your consent; and records where required by law. You can change optional cookie and email choices at any time.

5. Shopify Data

When you install GrowthMap from the Shopify App Store, we access your store data through Shopify's API with the following scopes:

• read_products — To personalize marketing suggestions with your actual products

Store access tokens are encrypted at rest using AES-256-GCM. Product titles, product types and store details may be sent to Anthropic when you request an AI suggestion so the result can reflect your catalogue. GrowthMap does not request Shopify customer or order scopes.

6. Data Storage & Security

Your data is stored securely using Supabase (PostgreSQL) with encryption at rest. All communications use TLS/HTTPS. Shopify access tokens are encrypted with AES-256-GCM. We do not sell personal information. We disclose data to the service providers below only as needed to operate, secure and improve GrowthMap, or when you consent to optional analytics and advertising.

7. Retention, Export & Deletion

Account data is retained while your account is active and then only as long as needed for legal, security and backup obligations. You can download a machine-readable copy or permanently delete your account in Settings. Cancel a paid subscription first so billing cannot continue after deletion. You can also contact us. Shopify uninstall deactivates the connection, and we process Shopify's mandatory privacy webhooks.

8. Service Providers & Transfers

• Supabase — Authentication and database
• Anthropic (Claude) — AI-powered marketing suggestions using the business context, request text and relevant product details you provide
• Stripe — Payment processing for web subscribers
• Shopify — App platform and billing for Shopify merchants
• Vercel — Application hosting
• Sentry — Error diagnostics and performance monitoring
• Resend — Transactional email and opted-in weekly digests
• Google Tag Manager, Analytics and Ads — Optional measurement and advertising, loaded only after consent
• Meta — Optional advertising measurement, loaded only after consent
• JMS Admin Portal / Cloudflare — Portfolio-level acquisition events sent by GrowthMap after registration and when you provide the optional “How did you hear about us?” answer; optional in-app support chat loads only after consent
• YouTube — Privacy-enhanced video playback in the public training centre

Some providers process data outside Ireland or the EEA. Where required, transfers rely on adequacy decisions, standard contractual clauses or another lawful safeguard.

9. Embedded Training Videos

Training videos use a click-to-load player. GrowthMap does not connect your browser to YouTube until you select “Load video from YouTube” or follow a direct YouTube link. The embedded player uses youtube-nocookie.com, but YouTube may still receive your IP address and browser details after loading under Google's privacy terms.

10. Your Rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier processing. You may complain to Ireland's Data Protection Commission at dataprotection.ie.

11. Contact

Controller: JMS Dev Lab, Ireland. For privacy questions or rights requests, contact: support@mygrowthmap.net