Mobile App Privacy Policy

1. Introduction

This Privacy Policy describes how GrowDash ("we", "our", or "us") collects, uses, and protects information in connection with the GrowDash iOS mobile application (the "App"). This policy applies exclusively to the App and supplements our general website and platform privacy practices.

If you use the GrowDash web platform, please also review our Website and Platform Privacy Policy, which governs data we collect outside of the App.

By downloading, accessing, or using the App, you agree to the practices described in this Privacy Policy.

2. Information We Collect

2.1 Account Information

GrowDash is a business-to-business service. Accounts are not created from within the App. Instead, they are provisioned by the GrowDash team for authorized users at customer organizations, following a commercial onboarding process. The App provides sign-in only. When you sign in, we collect and process:

• Email address
• Name
• Company or restaurant name
• Authentication credentials and session tokens

2.2 User-Generated Content

When you interact with the App, we collect content you create or submit, including:

• Chat messages and prompts you send through the App
• Files, images, or documents you upload (if applicable)
• Feedback and support messages

This content is transmitted securely to GrowDash servers where it is processed to deliver the features of the App.

2.6 Restaurant Business Data Used by Aisha

When you use the in-app Aisha AI assistant, the App may forward business data from your linked restaurant accounts to GrowDash servers so that Aisha can answer your question. This includes, depending on the question you ask:

• Sales totals, order counts, and revenue figures
• Branch- and brand-level performance metrics
• Advertising spend, campaign metrics, and discount performance
• Aggregator (delivery platform) connection metadata
• Conversation history within the Aisha assistant

This data does not include customer payment details, end-consumer personal information, or your account password. Section 4 explains how this data is processed by AI subprocessors.

2.3 Device Information

• Device type and model
• iOS version
• App version and build number
• Unique device identifiers (such as Apple's IDFV)
• Language and region settings
• Time zone

2.4 Usage Data

• Features accessed and interactions within the App
• Session duration and frequency of use
• Performance metrics
• Crash logs and diagnostic information

2.5 Push Notification Tokens

If you enable push notifications, we receive an Apple Push Notification Service (APNs) device token so we can deliver alerts relevant to your account. You can disable push notifications at any time in iOS Settings.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and maintain the App and its features
• To generate AI-powered responses to your messages, processed on GrowDash infrastructure
• To authenticate your account and secure your session
• To respond to support requests and communicate with you
• To improve the App through analytics and performance monitoring
• To detect, prevent, and investigate security incidents and fraud
• To comply with our legal and regulatory obligations

4. AI Processing and Subprocessors

Your messages are sent to GrowDash servers where they are processed to generate AI-powered responses. The App communicates only with GrowDash. You do not interact directly with any third-party AI provider.

In-app consent. The first time you open the Aisha assistant, the App displays an AI data-sharing disclosure that explains what is sent, who receives it, and links to this Privacy Policy. You must explicitly tap "I agree, continue to Aisha" before any chat prompt or business data is forwarded for AI processing. If you choose "Not now," the App returns to the Feed and no AI processing occurs.

As part of this processing, we use enterprise-grade third-party AI infrastructure providers as subprocessors — currently OpenAI, Anthropic, Google Gemini, and Fireworks AI. These providers process data on our behalf under strict data processing agreements that contractually require them to provide data protection at least equivalent to that described in this Privacy Policy. They do not use your data to train their models. A current list of all subprocessors is available upon request by contacting [email protected].

Key points about how AI processing works in the App:

• Controller relationship: GrowDash is the data controller. The AI provider acts solely as a subprocessor.
• No model training: Your messages and content are not used to train, fine-tune, or improve third-party AI models.
• Purpose limitation: The subprocessor processes data only to return responses to GrowDash, and for no other purpose.

5. Data Sharing and Disclosure

We share information only in the limited circumstances described below.

5.1 Subprocessors

We use vetted subprocessors who act on our behalf under binding data processing agreements, including:

• AI infrastructure providers (see Section 4)
• Cloud hosting and database providers
• Analytics and crash-reporting providers
• Customer support tooling

5.2 Legal Requirements

We may disclose information when required to comply with applicable law, legal process, or enforceable government requests.

5.3 Business Transfers

If GrowDash is involved in a merger, acquisition, reorganization, or asset sale, your information may be transferred as part of that transaction, subject to this Privacy Policy.

5.4 With Your Consent

We may share information for any other purpose with your explicit consent.

5.5 What We Do Not Do

• We do not sell your personal information.
• Your data is not used to train third-party AI models.
• We do not share your content with advertisers.

6. Data Retention

We retain information collected through the App for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. When we no longer need your information, we will securely delete or anonymize it. You can request deletion of your account at any time as described in the Account Deletion section below.

7. Data Security

We implement appropriate technical and organizational safeguards, including:

• Encryption in transit using TLS 1.2 or higher (TLS 1.3 where supported)
• Encryption at rest for stored data
• Role-based access controls and least-privilege access
• Audit logging and monitoring of access to production systems
• Regular security reviews and third-party penetration testing
• Contractual security requirements for subprocessors, including breach notification obligations

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Your Rights

8.1 GDPR and UK GDPR Rights (EU / UK Users)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights regarding your personal data:

• Right of access — obtain a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to restriction — request that we limit how we process your data.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent.
• Right to lodge a complaint — with your local data protection authority.

8.2 CCPA Rights (California Users)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of your personal information
• Correct inaccurate personal information
• Opt out of the "sale" or "sharing" of personal information
• Limit the use of sensitive personal information
• Not be discriminated against for exercising your rights

We do not sell personal information as that term is defined under the CCPA, and we do not share it for cross-context behavioral advertising.

8.3 How to Exercise Your Rights

To exercise any of these rights, email us at [email protected]. We will respond within the time frame required by applicable law. We may need to verify your identity before acting on your request.

9. Account Deletion

Because GrowDash accounts are provisioned by our team for business customers (and are not self-created within the App), account deletion is handled through a supported request process rather than a self-service in-app control. You can request deletion of your account and the personal data associated with it at any time.

9.1 How to Request Deletion

You can request deletion in any of the following ways:

• Email [email protected] from the email address associated with your account.
• Contact your dedicated GrowDash account manager.
• Submit a request through the in-app support channel.

We will verify your identity, confirm the scope of the request, and complete the deletion. If you are an end user at a customer organization, we may coordinate with your organization's administrator, since they are the account holder of record for the business account.

9.2 What Happens After Deletion

• Your account and the personal data associated with it are removed from our active systems.
• We instruct our subprocessors to delete associated data in accordance with the data processing agreements in place.
• Some information may be retained where required by law (for example, billing or fraud prevention records).

10. Children's Privacy

The App is a business-to-business product intended for use by restaurant operators and their authorized team members. It is not directed to, and we do not knowingly collect personal information from, children under the age of 13 (or the equivalent minimum age in the relevant jurisdiction, such as 16 in parts of the EEA).

If we become aware that we have collected personal information from a child without appropriate consent, we will delete that information. If you believe we may have collected information from a child, please contact [email protected]. This practice is consistent with the U.S. Children's Online Privacy Protection Act (COPPA).

11. International Data Transfers

GrowDash operates globally. Your information is primarily processed in the European Union (Netherlands, europe-west4 region) and may also be processed in the regions where our subprocessors operate.

When we transfer personal data outside of the EEA, the UK, or Switzerland, we rely on appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, and the UK International Data Transfer Addendum where applicable
• Adequacy decisions where they apply
• Supplementary technical and organizational measures

You can request a list of our current subprocessors and the regions in which they process data by contacting [email protected].

12. Push Notifications

The App may send push notifications for account activity, AI responses, and important service updates. Notifications are opt-in: iOS will ask for your permission before any push notifications are delivered.

You can turn off push notifications at any time:

1. Open the iOS Settings app.
2. Tap Notifications.
3. Select GrowDash.
4. Toggle Allow Notifications off.

13. Analytics and Tracking

We use Google Analytics as a first-party product analytics tool to understand how the App is used, diagnose issues, and improve performance. Google Analytics acts as our data processor and collects aggregated usage events, session data, and device information on our behalf.

Our analytics is limited to first-party product usage. We do not use the Advertising Identifier (IDFA), and we do not share analytics data with third parties for their own advertising or marketing purposes.

13.1 App Tracking Transparency (ATT)

Under Apple's App Tracking Transparency (ATT) framework, "tracking" means linking user or device data collected from our App with user or device data collected from other companies' apps, websites, or offline properties for targeted advertising or advertising measurement, or sharing such data with data brokers.

The GrowDash App does not engage in tracking as defined by ATT. For this reason, the App does not display the ATT permission prompt. Our Privacy Nutrition Label on the App Store reflects this as "Data Not Used to Track You."

You can review and change system-level tracking preferences at any time in iOS Settings → Privacy & Security → Tracking.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the App or by email. Material changes will take effect only after reasonable notice. Your continued use of the App after an update means you accept the revised policy.

15. Contact Information

If you have questions about this Privacy Policy or want to exercise your rights, contact us:

EU / UK representative: if required under Article 27 of the GDPR or the UK GDPR, details of our appointed representative will be listed here.