Privacy Policy

• Growmark, we, us: the business behind growmark.site, based in Cairo, Egypt.
• You: Anyone who visits our website, writes to us, applies to work with us, or works with us as a client.
• Website: growmark.site and all its pages.
• Client: A brand that has agreed to a Diagnosis or an engagement with us.
• Personal data: Any information that identifies a person, directly or indirectly. For example, a name, an email address or an IP address.
• Processing: Anything done with personal data: collecting, storing, reading, using, sharing or deleting it.
• Cookies: Small files, or similar browser storage, that a website saves on your device.
• Anonymized data: Data changed so it can no longer be linked to a person or a brand. Once anonymized, it is no longer personal data.
• Data protection laws: The laws that apply to the personal data we handle. These include Egypt’s Personal Data Protection Law (Law No. 151 of 2020) and its Executive Regulations, Saudi Arabia’s Personal Data Protection Law, and the data protection laws of the other Gulf countries where we work.

Growmark is responsible for the personal data described in this policy.

For data inside a client’s store or ad accounts, the client stays responsible. We handle it only on the client’s instructions (see §6).

If you work with us at a client brand, see our GDPR notice.

Data protection contact

Youssef Walid, Founder

Email

growmark@growmark.site

When you browse the website

• Necessary storage only, unless you turn analytics on (see §8).
• If you turn analytics on, Google Analytics records: the pages you visit, time on each page, how far down each page you scroll, the links and buttons you click or rest the pointer on, how long you spend on each part of a page, how far you read each case study, how quickly you scroll through each section, how much of each film you watch, which resources you download, whether you click or copy our email address, and whether you sent a form (never what you type into a form, or which answers you pick), device and browser type, screen size, language, the page that referred you (such as a search engine or an AI assistant), and your approximate location (city or country, from your IP address).

When you start a project (the seven-question form)

• Your name and email address
• Your brand name, and your website or Instagram link
• Where your business is now (the option you pick)
• Rough monthly revenue and budget ranges, if you choose to share them
• What you write about your brand, and any files you upload

Your answers stay on your own device until you press send (see §8). We receive nothing before that.

When you drop a quick word, email us or message us on WhatsApp

• Your name, email address or phone number, and what you write

When you apply to work with us

• What you submit through our application form on Tally. Usually your name, email, links to your work and your note to us.

When we reach out to you first

We look for DTC brands that may be a fit, using business details that people and brands have made public: a store, a social profile, a LinkedIn page or a store directory. We may keep:

• Your name, role and brand
• Your business email, phone number or social profile
• What we noticed on your public store or ads (for example, how long a product page took to load)

When you become a client

• Names, roles and contact details of the people we work with
• View-only access to your store and ad accounts, and the numbers you share with us: orders, sessions, conversion, order value, repeat buyers, ad spend, cost per purchase, product costs, delivery costs and cash-on-delivery refusal rates
• Agreements, scope sheets, invoices and payment records
• Notes from our calls, and your feedback on the work

When you pay us

• Payer name, amount, date and payment reference from InstaPay, bank transfer, Payoneer or Western Union. We never see or keep full card numbers.

We don’t ask for sensitive personal data, such as health, religious or biometric data. Please don’t send it to us.

• To reply to you, book a call and see whether we’re a fit
• To run your Diagnosis, strategy plan and Creative Design
• To report the numbers named in your Diagnosis and plan
• To send invoices, keep accounts and meet tax and legal duties
• To contact brands that may be a fit, and to stop when asked
• To review job applications
• To see how the website performs, if you allow analytics
• To keep our website and accounts secure

We don’t sell personal data, and we don’t use it to show you ads.

We process personal data only when the law allows it. Depending on the situation, we rely on:

• Your consent: for analytics, and for anything else we ask you to agree to. You can withdraw it at any time.
• A contract, or steps before one: to answer a project request, prepare a Diagnosis or proposal, and deliver the work.
• A legal duty: to keep invoices and accounting records.
• Legitimate interest: to reply to messages, contact brands that may be a fit, protect our website, and handle legal claims. We rely on it only when it doesn’t override your rights.

Where the law requires consent, we ask for it first.

During a Diagnosis or an engagement, we read your store and ad accounts to find what’s holding growth back. These accounts can contain your customers’ personal data, such as names and order details. Here is how we handle it:

• View-only. We ask for view-only access. We don’t change settings, run ads or contact your customers.
• Numbers, not people. We work from totals and trends, not individual customers. If we need an export, we remove customers’ names and contact details before saving it, and we delete it when the engagement ends.
• Your work only. Your data is used only for your brand.
• Removed at the end. We remove our access when the engagement ends, or sooner if you ask.
• In writing. The data clause in our agreement sets these rules.

Your customers’ data stays your responsibility. If one of your customers asks about their data, we’ll help you answer.

• Benchmarks. We keep anonymized, combined numbers from our work (for example, typical conversion rates by category) so we know what normal looks like. They never show a brand or a person by name, and we never sell them.
• Design patterns. We record which design changes moved which numbers, without names.
• Published results. We publish a client’s results only after the client approves the wording. Clients can ask us to publish anonymously.

Types

• Necessary: keeps the site working. Always on.
• Analytics: Google Analytics shows us which pages people read and where the site is slow. Off unless you turn it on.

We don’t use advertising cookies.

What we store

Your control

• Change your choice any time from Cookie settings at the foot of every page.
• You can also block or delete cookies in your browser settings. Chrome, Safari, Firefox and Edge all allow this.
• If you block necessary storage, parts of the site, like the project form, may not work.

We don’t sell personal data. We share it only with the services we need to run Growmark, and only what each one needs:

• Website hosting: Hostinger
• Website analytics: Google Analytics and Google Tag Manager (Google), only if you turn analytics on
• Form delivery: our own server, hosted by Hostinger
• Email: Hostinger
• Messaging: WhatsApp
• Job applications: Tally
• Payments: InstaPay, banks, Payoneer and Western Union
• Project partners: a developer, production crew or creator, only when your project needs one and you agree

We may also share data when the law requires it, or to protect our rights in a legal dispute. Each of these services has its own privacy policy.

Some of the services above store data on servers outside Egypt and the Gulf. When that happens, we use providers that protect data to a standard no lower than the law where you are, and we follow the transfer rules of the data protection laws that apply.

After that, we delete the data or anonymize it.

• Access is limited to the people working on your brand.
• We use view-only access to client accounts wherever the platform allows it.
• Our website and tools use encrypted connections.
• We remove access we no longer need.
• If a breach affects your personal data, we tell you and the relevant authority, as the law requires.

No system is perfectly secure. Please don’t send passwords or sensitive data by email or WhatsApp. Give us view-only access instead.

We use software, including trusted third-party AI tools, to help read business numbers and organize requests. We send them business numbers only, never your customers’ personal details, and we use them only under terms that stop them from training on our data. A person reviews every result. No decision about you or your brand is made by software alone.

Under the data protection laws that apply to you, you can ask us to:

• See the personal data we hold about you
• Get a copy of it in a common format
• Correct it if it’s wrong or incomplete
• Delete it
• Limit how we use it
• Object to how we use it, including outreach
• Withdraw any consent you gave, at any time

To use any of these rights, email growmark@growmark.site. We may ask you to confirm who you are. We reply within 30 days, and it’s free.

If you’re not happy with our answer, you can complain to the data protection authority where you live. In Egypt, that is the Personal Data Protection Center. In Saudi Arabia, it is the Saudi Data and AI Authority (SDAIA).

Our website and services are for businesses. We don’t knowingly collect data from anyone under 18. If you think we have, tell us and we’ll delete it.

Our website links to other sites, including Instagram, LinkedIn, Tally and Quote. We don’t control them, and their own privacy policies apply.

When our practices change, we update this page and the date at the top. If a change affects how we use client data, we email our clients before it applies.