Privacy Policy

This Privacy Policy explains how GrowKong Group Inc. and its affiliates (“GrowKong,” “we,” “us,” or “our”) collect, use, disclose, and protect personal information when you visit our website, create an account, and use the GrowKong Network platform or take part in the GrowKong creator program (together, the “Services”).

For people in the European Economic Area (“EEA”) and the United Kingdom (“UK”), GrowKong Group Inc. is the “controller” of your personal information unless we say otherwise. You can reach us at:

GrowKong Group Inc.
5511 Caprock Summit Dr
Austin, TX 78738, United States
privacy@growkong.com

Information you give us

• Account data — your email address and the credentials you use to sign in (passwords are stored in hashed form by our authentication provider; they are not retained by us in plain text).
• Profile data — your name or creator handle, avatar, bio, country/region, connected social accounts, and preferences.
• Identity & verification data — where required to pay you or to meet legal obligations, information such as legal name, date of birth, government-issued ID, and address. This is collected and verified primarily by our payments partner (see How we share information).
• Payout & tax data — the financial account you are paid into and tax documentation (for example, a W-9 or W-8 series form). Full bank/card numbers are handled by our payment processor, not stored by us. Where you complete a tax certificate directly with us, or where we import a certificate previously collected for us by a tax-form provider, we store the signed certificate — including the taxpayer identification number it certifies — in encrypted form (field-level envelope encryption with restricted, audited access), and retain it for as long as tax, accounting, and audit obligations require, including after account closure.
• Legal acceptance records — the document version and hash, account, date and time, and relevant legal-payee context. Your initial Creator Agreement signature includes the signer name, IP address and user agent. Later checkbox confirmations are stored as separate records linked to the signed agreement, with the current legal-payee context, a hashed IP address and user agent. These records document the version you accepted without replacing your initial signature.
• Content & submissions — the videos, links, promo codes, drafts, community messages, support tickets, and other material you submit to the Services, including work samples, publication evidence, review notes, and media metadata. Audio/video may contain your face or voice or other people's personal data. We do not use creator media to build a biometric identification database. Upload only material you have permission to share.

Information we collect automatically

• Usage & device data — pages viewed, actions taken, referring pages, IP address, device and browser type, operating system, timestamps, and security or error events. We do not currently load an optional advertising or analytics tracker on the public site.
• Performance & attribution data — clicks on your tracked links, promo-code redemptions, registrations, and verified paying users that our systems attribute to you, together with the fraud and quality signals used to validate them. This can include link/click identifiers, timestamps, IP address, browser and referrer data, country, customer registration identifiers, payment and subscription references, and amounts received from our products or their payment/registration systems. Identifiable tracking records are not automatically anonymous simply because dashboards aggregate results. Each promoted product has its own customer privacy notice.
• Cookies & similar technologies — see Cookies and similar technologies.

Agreement and consent evidence includes the document version and hash, account, time, choices, typed signer name, legal-payee context, IP address, and user agent as relevant. Browser tax drafts may temporarily preserve names, addresses and classification in tab storage, but exclude taxpayer numbers and signature fields. Draft data is cleared after successful submission and on sign-out through the app; shared-device users should also close their browser session. Necessary upload-resume data can remain locally until completed or cleared.

Information from third parties

• Sign-in providers — if you register with Google, we receive basic profile information (such as your name and email) from that provider.
• Connected platforms — where you connect or post on a third-party platform (for example, TikTok or Instagram), we may receive metrics and identifiers needed to attribute and measure performance, subject to that platform’s rules and your settings.
• Payments, identity & fraud partners — verification results, payout status, and risk signals.
• Address and tax providers — standardised address suggestions and, for certificates submitted through a third-party tax provider, tax-form records, signed documents, or verification statuses. Those providers receive and may retain the complete tax certificate, including its taxpayer number. We may retrieve a legacy certificate and preserve an encrypted copy for tax, accounting, and audit continuity. In the designated identity and payout flows, full identity documents and bank credentials stay with the relevant provider. As described above, taxpayer numbers collected directly by GrowKong or imported from a prior tax provider are stored by us using field-level encryption and restricted, audited access.

We use personal information to:

• create and administer your account and provide the Services;
• operate the creator program — track results, calculate performance rewards and bonuses, credit permanent Creator Levels from verified sales, track any phantom-reward points, and process payouts;
• verify your identity, assess application eligibility, prevent fraud and abuse, and keep the platform and its economy secure;
• communicate with you about your account, results, payouts, security, support requests, agreement updates, and changes to these notices;
• send product updates and marketing where permitted (you can opt out of marketing at any time);
• understand how the Services are used and improve and develop them; and
• comply with legal, tax, accounting, and regulatory obligations and enforce our agreements.

If you are in the EEA or UK, we rely on the following legal bases under the GDPR / UK GDPR:

We use contract necessity only for processing objectively needed to perform the contract, and legitimate interests only after balancing those interests against your rights. An obligation under US law is not automatically an EEA or UK legal-obligation basis; for obligations not recognised by the applicable law we assess another lawful basis and safeguards. Where separate consent is required, including applicable sensitive-data processing, we request it before that processing. Signing Terms or acknowledging this Policy is not blanket consent.

GrowKong uses cookies and browser storage to keep you signed in, secure the Services, save work you ask us to preserve, and remember your choices. We group them as:

• Strictly necessary — required to run the site and keep your session secure, preserve form or upload progress you ask us to save, and store your consent choice; these cannot be switched off.
• Functional — remember your settings and choices.
• Analytics — help us understand usage so we can improve the Services. We do not currently load an optional analytics tracker; this category is available so a future tracker cannot be enabled without your choice.

Before you choose, optional categories are off. The banner gives you equally available options to accept all, reject optional storage, or customise categories. You can withdraw or change your choice at any time through Cookie settings in the site footer, registration, onboarding, or your Legal account page. The consent preference itself is strictly necessary and lasts for 180 days. You can also clear stored choices in your browser. We honour recognised opt-out signals (such as Global Privacy Control) where applicable.

We do not sell personal information or share it for cross-context behavioural advertising, and do not use sensitive tax or identity data for targeted advertising. We disclose data for the purposes below. Providers may act as processors for some operations and independent controllers for their own legally required fraud, banking, or compliance duties; their own notices apply to those activities.

• Infrastructure and media. Supabase provides authentication, database and storage services; Vercel hosts the app; Cloudflare provides media upload, processing, playback and archive infrastructure, including Stream and R2. They can process uploaded media, account or request metadata, and the records needed for their role.
• Payments and tax. Stripe handles payout recipients, bank/identity information, verification, currency quotes and transfers. Avalara and TaxBandits may process tax certificates, taxpayer numbers, verification and historical records where used. Stopping new forms does not delete existing provider records; retention and export may continue for reconciliation, tax or legal purposes. Our own stored certificates remain subject to the encryption and access controls described here.
• Communications and connected services. Resend processes email addresses, service or marketing email content and delivery events. Google supplies sign-in and address suggestions. Telegram may receive restricted operational alerts and staff links and, if you use a connected Telegram feature, the identifiers and messages needed for it. Operational staff alerts omit creator names, emails and free-text support content. Social networks process your public posts and any separately authorised connections under their own policies.
• AI assistance where enabled. Configured OpenAI, Anthropic, or Google models may receive application/review text, project briefs, or support conversation excerpts to draft responses and assist staff. Support AI can receive the subject, latest message and recent text transcript; support attachments are not included by that feature. Staff review drafts before sending. Provider processing is subject to the configured service and contract; we do not promise universal zero retention or training exclusions across providers. Do not put tax numbers, bank credentials, or identity documents in free-text support or community messages; use the designated secure collection flow.
• Other creators and staff. Intended recipients can see community posts, messages and profile information you share. Authorised staff access information needed for their operational role. When the creator leaderboard is enabled, authenticated eligible creators can see participating active creators' handles, ranks, levels, badges and a capped sales count, including valid sales still pending settlement or on hold. Counts above 1,000 appear as 1,000+. The leaderboard does not disclose another creator's earnings, payout amounts or balance. This visibility follows the feature rules and is not controlled by cookie or marketing preferences. Contact us about privacy concerns or applicable rights. Private tax, bank and identity records are not leaderboard fields.
• Group, law and business changes. Affiliates helping operate the Services may receive relevant data. We may disclose what is necessary for legal process, claims, fraud prevention or safety, and to advisers or counterparties in a merger, financing or sale, subject to applicable confidentiality and data-protection duties. We also share at your direction where you authorise a specific use.

Conversation attachments are served through authenticated access checks and short-lived signed links. People authorised to see a message can still download or copy it; a link already issued can work until it expires. Previously downloaded or cached copies cannot be recalled by changing access. Profile avatars and materials you publish publicly may be accessible outside a conversation. Avoid unnecessary personal information in shared files and public profile assets.

GrowKong is based in the United States. We and our providers may process data in the US and other countries with different protections. Transfers subject to EEA, UK or Swiss restrictions require a valid legal mechanism, such as applicable adequacy arrangements or contractual safeguards (European Commission Standard Contractual Clauses and, where needed, the UK Addendum or IDTA), with any necessary supplementary measures. We do not rely on acceptance of these Terms as consent to unrestricted international transfers or claim GrowKong itself holds a certification not identified here. Contact privacy@growkong.com for information about the safeguards applicable to your data.

We retain data according to its purpose, the duration of the creator relationship, transaction and tax requirements, disputes, legal holds, security needs, and provider obligations. Closing an account does not immediately erase financial records, signed agreements, tax certificates, or audit evidence. We do not promise that every category is removed by an automated account-deletion process.

• Account, application, profile, project and communication records support participation, support and dispute handling; we assess their continued need after closure or a verified deletion request.
• Tax certificates and payout/accounting records are retained for applicable reporting, examination and recordkeeping periods. Their sensitivity requires restricted access even after the account closes; records subject to retention cannot be erased simply on request.
• Signed agreements, consent and security evidence remain as needed to prove instructions, rights, obligations, and investigate claims. Licence rights do not themselves require retaining every identifiable profile record indefinitely.
• Unused or superseded media is eligible for staged cleanup according to its lifecycle. Published, referenced or legally held assets may be retained longer. Removing a portal record does not automatically remove a creator's social-platform post or third-party copies.
• Optional cookie preferences last 180 days unless replaced or cleared. Browser drafts and upload-resume data follow their local lifecycle and can also be cleared through browser storage controls.
• Providers and backups can have separate retention cycles and legal obligations. Exporting a certificate or stopping new processing does not itself delete their historical copies.

When data is no longer needed, we delete, de-identify, or restrict it as appropriate; a valid legal hold delays destruction, not unlimited unrelated reuse. Ask privacy@growkong.com for the retention criteria applicable to a particular record and for deletion or restriction. We explain lawful exceptions when responding.

EEA & UK (GDPR / UK GDPR)

You may have the right to:

• access a copy of your personal information;
• correct inaccurate or incomplete information;
• erase your information (“right to be forgotten”);
• restrict or object to certain processing;
• data portability (receive your information in a portable format);
• withdraw consent where we rely on it; and
• lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office).

United States (California and other states)

Depending on where you live, you may have the right to know/access, delete, and correct your personal information, to opt out of the “sale” or “sharing” of personal information and of targeted advertising, and to limit the use of sensitive personal information. We do not sell your personal information, and we will not discriminate against you for exercising your rights. You may use an authorised agent where the law allows. Where applicable, you may also opt out of targeted advertising or profiling for decisions with legal or similarly significant effects and appeal a denied request. These rights depend on the law's scope, exemptions, and your circumstances, including whether information concerns a commercial or work relationship.

How to exercise your rights

Email us at privacy@growkong.com. We may need to verify your identity before acting, and we will respond within the time required by applicable law. An EEA/UK request is ordinarily answered within one month; where a lawful extension applies we explain it within that period. US deadlines depend on the applicable state law. To appeal a denial where available, reply to our decision or email the same address with “Privacy appeal”; we provide the outcome and applicable regulator complaint route. Do not send a full TIN or identity document by ordinary email; we arrange proportionate secure verification if needed. You may request human review and submit information contesting a material automated decision. No account acceptance or arbitration provision prevents contacting a regulator.

Automated rules match attribution and payment evidence, check country, identity and tax status, flag fraud, calculate earnings and Creator Levels, and evaluate project/content obligations. A mismatch, invalid event, refund or unmet condition can delay payouts, reduce a related reward, or trigger access review. These checks can operate before a person reviews the result; they are not a guarantee that every alert proves wrongdoing. Creator Levels only move up; their thresholds do not create monetary multipliers, and accepted earning conditions remain subject to the Terms.

AI assists drafting and staff review using the information described above. You can request an explanation, correction and human review of a material decision at privacy@growkong.com or through support, express your position and contest the outcome. Where law restricts solely automated decisions with legal or similarly significant effects, we must have a permitted basis and required safeguards; acknowledging this Policy does not waive those protections.

Controls include encryption in transit, database access policies, restricted server credentials, permission checks and privileged-session verification for sensitive staff actions. Native tax certificates use field-level envelope encryption; ordinary interfaces use masked tax identifiers. Creator access to a tax PDF is owner-scoped; authorised administrative access requires heightened authentication, a reason and an audit record. Sensitive document responses use no-store caching. These are specific controls, not a claim that every stored field has separate encryption or that no authorised operator can access personal data.

We limit PII in operational alerts and error logs. Keep credentials and devices secure, do not share accounts, and report suspected exposure promptly to privacy@growkong.com. No system is absolutely secure. We assess incidents, contain access, preserve necessary evidence and notify affected individuals and authorities where required by applicable law.

The Services are intended for adults. You must be at least 18 years old to use GrowKong. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact privacy@growkong.com and we will investigate and delete or restrict it, subject to necessary legal retention.

The Services link to and integrate with third-party sites and platforms (such as payment providers and social networks) that we do not control. Their handling of your information is governed by their own privacy policies, and we encourage you to review them.

Material updates identify their version, effective date, and a summary of changes. We notify active creators in the Services and by service email to their account address, separately from marketing preferences. The account may ask you to review and acknowledge the new notice. Acknowledgement records delivery of information, not consent to all processing. If a change requires new consent, we request it before the affected processing instead of treating silence or continued browsing as consent. Applicable advance-notice requirements remain in force.

For any privacy question or request, or to reach our privacy team, contact:

GrowKong Group Inc.
5511 Caprock Summit Dr, Austin, TX 78738, United States
privacy@growkong.com

If you are in the EEA or UK and we are required to designate a representative, we will update this Policy with their contact details.