Privacy Policy
Privacy Policy
Last updated: 9 October 2026
This policy explains what personal data Growtoria collects, why, who receives it, how long we keep it and how you can use your rights. It applies to growtoria.com, our emails, our chat assistant and our services.
1. Who is responsible for your data
The data controller is Zakaria MAMOUMI, EI, trading as Growtoria (full details in our Legal Notice). Contact for any privacy question or request: [email protected]. The same person is our privacy officer.
2. What we collect and why
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Orders and customer account | Name, email, billing country and address, order details, IP address, download history | Performing the contract; legal obligation (accounting) | Account: until you delete it or after 2 years of inactivity. Invoices and accounting records: 10 years. |
| Payments | Payment status and transaction references (card data is handled by Stripe, PayPal or Revolut, never by us) | Performing the contract; legitimate interest (fraud prevention) | Transaction records: 10 years (accounting). Card data: not stored by us. |
| WordPress services | Website address, email, description of the problem, access you give us | Performing the contract | 3 years after the end of the service; access details deleted at the end of the job. |
| Customer support (email, WhatsApp, forms) | Your messages and contact details | Legitimate interest (answering you); performing the contract | 3 years after our last exchange. |
| AI chat assistant | The messages you type in the chat (sent to Anthropic to generate the reply); your email and a short summary of your request if you choose to give your email | Legitimate interest (answering your questions); consent for follow-up | Conversations are not stored on our server. Email and request summary: as for marketing below. |
| Newsletter, free resources and free tools results by email | Email, first name, signup date and source, proof of consent | Consent | Until you unsubscribe, or 3 years after your last interaction. |
| Emails to existing customers about similar products | Email, purchase history | Legitimate interest (you can object at any time, including at checkout) | 3 years after your last purchase. |
| Abandoned cart reminder | Email entered at checkout and cart content | Legitimate interest (you can object by clicking the link in the email) | Only as long as needed to send the reminders. |
| Review invitations (optional) | Name, email, products ordered | Consent (box at checkout) | Until the invitation is sent, then per the review service’s policy. |
| Audience measurement and advertising | Pages viewed, device and browser data, approximate location, cookie identifiers | Consent (cookie banner) | Cookies: 13 months maximum. Analytics data: kept by the provider for up to 14 months. |
| Security and site operation | IP address, technical logs | Legitimate interest (security) | Up to 12 months. |
Fields marked as required at checkout are needed to process your order; without them we cannot deliver it. Other fields are optional. We do not make decisions about you based solely on automated processing, and we do not sell your personal data.
3. Who receives your data
Your data is only accessible to Growtoria and to the service providers below, which process it for us or, for payment providers, as independent controllers under their own privacy policies:
| Provider | Role |
|---|---|
| Hostinger (Cyprus) | Website hosting; server in France |
| Cloudflare (USA) | Content delivery, protection against attacks |
| Stripe (Ireland / USA) | Card, Apple Pay and Google Pay payments |
| PayPal (Luxembourg) | PayPal payments |
| Revolut (Lithuania) | Revolut Pay and card payments |
| Brevo (France) | Sending emails (order emails and newsletters) |
| Anthropic (USA) | AI model behind the chat assistant |
| Telegram (UAE / UK) | Internal notifications to our team about chat or form requests |
| Google (Ireland / USA) | Google Analytics (with your consent), Search Console |
| Microsoft (Ireland / USA) | Microsoft Clarity, usage analytics (with your consent) |
| Meta (Ireland / USA) | Meta Pixel and Conversions API (with your consent); WhatsApp if you contact us there |
| Pinterest (Ireland / USA) | Pinterest tag, ad measurement (with your consent) |
| CusRev | Review invitations, only if you tick the box at checkout |
We may also share data with authorities when the law requires it.
4. Transfers outside Europe
Some providers are located outside the European Economic Area and the UK (mainly in the United States). Your data is then protected by an adequacy decision (such as the EU-U.S. Data Privacy Framework and the UK Extension for certified companies) or by the European Commission’s standard contractual clauses (and their UK equivalents). Your data may therefore be accessible to authorities of those countries under their laws.
5. How long we keep your data
See the table in section 2. At the end of these periods, data is deleted or anonymised.
6. Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. You can withdraw your consent at any time (for example by unsubscribing or changing your cookie choices), without affecting what was done before. Under French law, you can also give instructions about what happens to your data after your death. To use your rights, write to [email protected]; we may ask you to confirm your identity. We answer within one month. See also our data deletion page.
7. Complaints
If you are not satisfied, tell us first at [email protected]: we acknowledge every privacy complaint within 30 days and tell you the outcome. You can also complain to a data protection authority: in France the CNIL (cnil.fr), in the UK the ICO (ico.org.uk), in Canada the Office of the Privacy Commissioner, in Australia the OAIC, or the authority of your country.
8. Emails and marketing
- We only send newsletters and promotional emails if you subscribed (unticked box or clear signup form), or, if you are a customer, about products similar to the ones you bought — and you can object at checkout and in every email.
- Every marketing email identifies Growtoria and contains a one-click unsubscribe link. Unsubscribe requests are processed within 5 business days.
- We have switched off open tracking for our newsletters. Our email delivery provider (Brevo) may record delivery and opening events for order emails, only to check deliverability and security.
9. Cookies and trackers
Analytics and advertising tools (Google Analytics, Microsoft Clarity, Meta Pixel, Pinterest tag) only run if you accept them in our cookie banner. Our website does not respond to “Do Not Track” browser signals; instead, these tools stay off unless you opt in, and you can change your choice at any time. Third parties such as Google, Microsoft, Meta and Pinterest may collect information about your online activity over time and across websites if you accept them. Details: Cookie Policy.
10. Information for specific countries
- United Kingdom: we process your data under the UK GDPR as described above; you can complain to the ICO.
- California (CalOPPA): the categories of data and recipients are listed in sections 2 and 3; you can review and correct your data by contacting us; changes to this policy are announced on this page with a new “last updated” date. We do not sell or share personal information for money.
- Canada: your data may be processed and stored outside Canada (in the EU and the USA). Our privacy officer is Zakaria MAMOUMI, [email protected]. Tracking for analytics or advertising is off by default.
- Australia: you can contact us about privacy at [email protected] and complain to the OAIC.
11. Children
Our website is not directed to children under 16 (under 13 in the United States), and we do not knowingly collect their data. If you think a child has given us personal data, contact us and we will delete it.
12. Security
We use encrypted connections (HTTPS), restricted access, security monitoring and regular backups. No system is perfectly secure; if a breach affects your data in a way that creates a risk for you, we will inform you and the authorities as required by law.
13. Changes
We may update this policy; the date at the top shows the latest version. Important changes will be announced on the website or by email.