**Privacy Policy – Growth App

Last updated: 12.25.2025**

This Privacy Policy describes how Growth App (“Growth,” “we,” “us,” or “our”) collects, uses, processes, stores, and protects personal data in connection with your access to and use of the Growth mobile application available on iOS and Android (the “App”).

This Privacy Policy is designed to comply with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Romanian and European Union laws. Where the App is accessed by users outside the European Union, Growth App applies GDPR-level data protection standards as a baseline, together with any additional requirements imposed by applicable local data protection laws.

By accessing or using the App, you acknowledge that you have read and understood this Privacy Policy.

  1. Controller Information

The controller responsible for the processing of personal data under this Privacy Policy is Growth App, located in Constanța, Romania. The registered address is located in Constanța, Romania and may be provided upon lawful request where required under applicable data protection laws. Inquiries relating to privacy or personal data, including requests for address details where applicable, may be directed to [email protected]

Growth App has not appointed a Data Protection Officer at this time, as it currently assesses that it is not legally required to do so under Article 37 GDPR.

  1. Eligibility and Age Restrictions

Growth App is available exclusively to individuals who are at least sixteen (16) years of age. Reasonable technical and organizational measures are implemented to prevent users from registering with an age below this threshold. We do not knowingly permit ineligible users to access or use the Services, and we do not knowingly process personal data of individuals under sixteen.

If personal data relating to an individual under the age of sixteen (16) is identified, such data will be permanently deleted without undue delay, and the associated account will be suspended or terminated in accordance with applicable law.

  1. Information We Collect

Growth App processes personal data that users voluntarily provide when creating an account, completing onboarding, or using App features. This includes account identifiers, onboarding information, fitness-related metrics, goals, preferences, progress entries, uploaded images, dietary descriptions, AI interaction inputs, and communications submitted to customer support. Certain personal data is required to create and maintain an account and to enable core App functionality, while other data is optional and provided at the user’s discretion. Users are responsible for ensuring that the personal data they provide is accurate, complete, and kept up to date.

  1. Health-Related Data and Explicit Consent

Certain categories of personal data processed through the App, including body measurements, fitness goals, workout activity, progress images, dietary information, and related inputs, may constitute health-related data within the meaning of Article 9 of the GDPR. Growth App processes such data solely on the basis of the user’s explicit consent, which is obtained during the onboarding process before access to relevant features is granted.

This consent permits the collection, analysis, display, and use of such data, including processing by AI-supported systems used to generate personalized fitness and wellness insights within the App, for the purposes of providing fitness tracking, personalization, and AI-powered insights within the App. Users may withdraw their explicit consent at any time through account settings. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal but may result in the limitation or unavailability of certain App features.

Explicit consent is obtained by informing users in a clear and understandable manner during onboarding and by requiring user action before health-related data is processed or relevant features are made available.

  1. Automatically Processed Technical and Usage Data

During normal App operation, Growth App processes technical and usage-related data generated through user interaction with the App and associated devices. This processing is necessary to operate the service, maintain security, detect errors, prevent misuse, and evaluate overall system performance.

Such processing occurs automatically and is limited to what is reasonably necessary for the functioning, protection, and improvement of the App. Where feasible, data is processed in aggregated or anonymized form. Such data is not used to identify individual users, is not combined with other personal data for profiling purposes, and is processed separately from account-level information wherever feasible.

  1. Artificial Intelligence and Automated Processing

The App incorporates artificial intelligence technologies provided by third-party providers, including third-party artificial intelligence providers (such as OpenAI), to support features such as AI coaching, workout recommendations, nutritional estimation, and interactive guidance. User inputs may be processed by these systems to generate responses and personalize App functionality.

Growth App may configure, fine-tune, adapt, or evaluate artificial intelligence systems for use within the App, including through prompt design, system configuration, response calibration, and the analysis of aggregated or anonymized interaction data to improve service quality and reliability.

Personal data is not used by Growth App to train, develop, or improve general-purpose or foundational artificial intelligence models.

Any refinement or optimization of AI systems is strictly limited to the operation and performance of the Growth App and does not extend beyond its specific functionalities.

AI-generated outputs are provided solely for general fitness, wellness, and informational purposes. They do not constitute medical advice, diagnosis, treatment, or professional guidance of any kind. Users remain solely responsible for evaluating AI-generated content and for all decisions, actions, or omissions based on such content.

Growth App does not engage in decision-making based solely on automated processing, including artificial intelligence, that produces legal effects or similarly significant impacts on users within the meaning of Article 22 of the GDPR. All AI-supported features are intended to assist users and do not replace human judgment or user decision-making.

  1. Purposes of Processing

Growth App processes personal data for purposes including, but not limited to, account creation and administration, delivery of App features, personalization of fitness and nutrition functionality, operation of AI-powered services, progress tracking, subscription administration, refund assessment, customer support, security, compliance with legal obligations, and the maintenance and improvement of the App.

Processing is limited to what is reasonably necessary to achieve these purposes.

  1. Legal Bases for Processing

Personal data is processed based on your consent, the necessity of processing for the performance of a contract, compliance with legal obligations, and our legitimate interests in operating and improving the App. Health-related data is processed exclusively based on your explicit consent.

Depending on the specific purpose of processing, personal data is processed on one or more of the legal bases described above, in accordance with Articles 6 and 9 of the GDPR.

Where processing is based on legitimate interests, such interests are balanced against users’ fundamental rights and freedoms.

  1. Subscriptions, Payments, and Free Trials

Paid features of the App are offered through recurring subscription plans. All payment transactions are processed through the Apple App Store, Google Play Store, and RevenueCat, acting in accordance with their own terms and privacy policies. Growth App does not collect, store, or have access to users’ full payment card details or sensitive financial information.

Where subscriptions or in-app purchases are made through the Apple App Store or Google Play Store, payment processing and any related personal data processing are handled by the respective platform providers, acting as independent data controllers, in accordance with their own terms and privacy policies.

Payment processing, billing, and subscription management are handled in accordance with the terms, policies, and security standards of the relevant payment service provider. Users are encouraged to review the privacy policies and terms of such providers for additional information regarding their data processing practices.

Growth App may receive limited transactional information, such as subscription status, payment confirmation, billing cycle details, or refund indicators, solely for the purposes of account management, service delivery, customer support, fraud prevention, and compliance with legal and accounting obligations.

Where a free trial is offered, the applicable duration (currently seven (7) days, unless otherwise stated) and applicable conditions are clearly disclosed to the user prior to subscription activation. Unless canceled before the end of the free trial period, the subscription will automatically renew and convert into a paid subscription in accordance with the terms presented at the time of purchase.

  1. Refunds

Growth App offers a refund policy as described in its Terms and Conditions. Refund eligibility is assessed in accordance with the applicable terms and is not guaranteed in all circumstances.

In connection with refund requests, Growth App may process usage-related data or user-submitted information strictly for verification, fraud prevention, and policy enforcement purposes. Such processing is limited in scope and duration and does not extend beyond what is necessary to evaluate the request.

  1. Communications and Notifications

Growth App may send communications that are necessary for account administration, service operation, security, legal compliance, customer support, and important service-related updates via email, push notifications, or in-app messaging. Marketing or promotional communications are sent only where permitted by applicable law and may be opted out of at any time. Essential service communications, including security and account-related notices, cannot be disabled as they are required for the proper functioning and lawful operation of the App.

  1. Analytics and Third-Party Services

We use third-party analytics and monitoring services, such as Google Analytics and Firebase, to understand how the App is used and to improve performance. These services may process technical and usage data on our behalf, in accordance with their own privacy policies and applicable data protection laws.

Growth App does not sell personal data and does not use personal data for targeted advertising, behavioral profiling, or third-party marketing purposes.

Where required by applicable data protection laws, and where applicable and supported by the relevant analytics service configuration, Growth App configures analytics services, including Google Analytics and Firebase, to apply appropriate safeguards such as IP anonymization and to ensure that any international data transfers are subject to appropriate transfer mechanisms in accordance with the GDPR.

  1. Data Retention

Growth App retains personal data only for as long as it is reasonably necessary to provide the App’s services, fulfill contractual obligations, comply with applicable laws, resolve disputes, enforce agreements, and maintain platform security and integrity.

Upon a user’s request to delete an account, the account is deactivated and associated personal data is placed into a restricted retention state. Personal data may be retained for a limited recovery period of up to thirty (30) days solely to allow account restoration upon user request, ensure platform security, prevent fraud, or misuse, or resolve technical or operational issues. During this recovery period, access to such data is strictly limited and controlled. After the expiration of the recovery period, personal data is permanently deleted or irreversibly anonymized, unless continued retention is required by applicable law or for the establishment, exercise, or defense of legal claims.

Growth App may retain and use aggregated or anonymized data that can no longer be used to identify individuals for analytical, statistical, or service improvement purposes.

  1. Data Security

Growth App implements appropriate technical and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures are intended to reflect the nature, scope, and sensitivity of the data processed. While no system can guarantee absolute security, Growth App continuously evaluates and improves its protective measures. Users are responsible for maintaining the confidentiality of their account credentials, and Growth App is not responsible for security incidents resulting from unauthorized access caused by user negligence or factors beyond its reasonable control.

  1. International Data Transfers

Some of Growth App’s service providers, including artificial intelligence and analytics providers, may process personal data outside the European Economic Area (“EEA”). Where such international transfers occur, Growth App ensures that appropriate safeguards are implemented in accordance with applicable data protection laws, including the use of Standard Contractual Clauses approved by the European Commission or other legally recognized transfer mechanisms that provide an equivalent level of data protection. Growth App applies GDPR-level protections to personal data regardless of where it is processed.

  1. Data Subject Rights

Subject to applicable law, users have the right to access, rectify, delete, restrict, or object to the processing of their personal data, as well as the right to data portability and the right to withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

  1. Supervisory Authority and Complaints

Users located in the European Economic Area have the right to lodge a complaint with a competent data protection supervisory authority if they believe that the processing of their personal data violates applicable data protection laws. This may include the supervisory authority in the user’s country of habitual residence, place of work, or place of the alleged infringement.

In Romania, the competent supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal – ANSPDCP).

  1. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be communicated through the App or other appropriate means, and the updated policy will take effect on the date indicated above. Where required by applicable law, users may be notified of material changes.