Privacy Policy

This Privacy Policy explains how GrowKong Group Inc. and its affiliates (“GrowKong,” “we,” “us,” or “our”) collect, use, disclose, and protect personal information when you visit our website, create an account, and use the GrowKong Network platform or take part in the GrowKong creator program (together, the “Services”).

For people in the European Economic Area (“EEA”) and the United Kingdom (“UK”), GrowKong Group Inc. is the “controller” of your personal information unless we say otherwise. You can reach us at:

GrowKong Group Inc.
5511 Caprock Summit Dr
Austin, TX 78738, United States
privacy@growkong.com

Information you give us

• Account data — your email address and the credentials you use to sign in (passwords are stored in hashed form by our authentication provider; we never see them in plain text).
• Profile data — your name or creator handle, avatar, bio, country/region, connected social accounts, and preferences.
• Identity & verification data — where required to pay you or to meet legal obligations, information such as legal name, date of birth, government-issued ID, and address. This is collected and verified primarily by our payments partner (see How we share information).
• Payout & tax data — the financial account you are paid into and tax documentation (for example, a W-9 or W-8 series form). Full bank/card numbers are handled by our payment processor, not stored by us. Where you complete a tax certificate directly with us, or where we import a certificate previously collected for us by a tax-form provider, we store the signed certificate — including the taxpayer identification number it certifies — in encrypted form (field-level envelope encryption with restricted, audited access), and retain it for as long as tax, accounting, and audit obligations require, including after account closure.
• Content & submissions — the videos, links, promo codes, drafts, community messages, support tickets, and other material you submit to the Services.

Information we collect automatically

• Usage & device data — pages viewed, actions taken, referring pages, IP address, device and browser type, operating system, timestamps, and security or error events. We do not currently load an optional advertising or analytics tracker on the public site.
• Performance & attribution data — clicks on your tracked links, promo-code redemptions, registrations, and verified paying users that our systems attribute to you, together with the fraud and quality signals used to validate them.
• Cookies & similar technologies — see Cookies and similar technologies.

Information from third parties

• Sign-in providers — if you register with Google, we receive basic profile information (such as your name and email) from that provider.
• Connected platforms — where you connect or post on a third-party platform (for example, TikTok or Instagram), we may receive metrics and identifiers needed to attribute and measure performance, subject to that platform’s rules and your settings.
• Payments, identity & fraud partners — verification results, payout status, and risk signals.
• Address and tax providers — standardised address suggestions and, for certificates submitted through a third-party tax provider, tax-form records, signed documents, or verification statuses. Those providers receive and may retain the complete tax certificate, including its taxpayer number. We may retrieve a legacy certificate and preserve an encrypted copy for tax, accounting, and audit continuity. Full identity documents and bank credentials stay with the relevant identity or payment provider. As described above, taxpayer numbers collected directly by GrowKong or imported from a prior tax provider are stored by us using field-level encryption and restricted, audited access.

We use personal information to:

• create and administer your account and provide the Services;
• operate the creator program — track results, calculate performance rewards and bonuses, credit permanent Creator Levels from verified sales, track any phantom-reward points, and process payouts;
• verify your identity, prevent fraud and abuse, and keep the platform and its economy secure;
• communicate with you about your account, results, payouts, security, and support requests;
• send product updates and marketing where permitted (you can opt out of marketing at any time);
• understand how the Services are used and improve and develop them; and
• comply with legal, tax, accounting, and regulatory obligations and enforce our agreements.

If you are in the EEA or UK, we rely on the following legal bases under the GDPR / UK GDPR:

GrowKong uses cookies and browser storage to keep you signed in, secure the Services, save work you ask us to preserve, and remember your choices. We group them as:

• Strictly necessary — required to run the site and keep your session secure, preserve form or upload progress you ask us to save, and store your consent choice; these cannot be switched off.
• Functional — remember your settings and choices.
• Analytics — help us understand usage so we can improve the Services. We do not currently load an optional analytics tracker; this category is available so a future tracker cannot be enabled without your choice.

Before you choose, optional categories are off. The banner gives you equally available options to accept all, reject optional storage, or customise categories. You can withdraw or change your choice at any time through Cookie settings in the site footer, registration, onboarding, or your Legal account page. The consent preference itself is strictly necessary and lasts for 180 days. You can also clear stored choices in your browser. We honour recognised opt-out signals (such as Global Privacy Control) where applicable.

We do not sell your personal information. We share it only as described here:

• Service providers (processors) — vendors who help us run the Services under contract. These currently include Supabase (authentication and database infrastructure), Vercel (hosting), Stripe (identity and payouts), Avalara and TaxBandits (tax-form collection, storage, retrieval, and applicable tax verification for certificates submitted through them, including retained legacy certificates), Resend (transactional email), and Google (sign-in and address suggestions). A provider processes only the information needed for its role and is subject to its contract and privacy obligations. Stopping new submissions does not by itself end a tax-form provider’s processing: it may continue to store or make legacy certificates available while reconciliation, export, deletion, or legally required retention remains incomplete. We remove a tax-form provider from this list only after it no longer processes personal information for us.
• Within our corporate group — with GrowKong Group Inc. affiliates that help operate the Services, under appropriate safeguards.
• For legal reasons — where required by law, legal process, or to protect the rights, safety, and property of GrowKong, our users, or the public, and to detect or prevent fraud.
• Business transfers — in connection with a merger, financing, acquisition, corporate reorganisation, or the spin-out or sale of a product line, your information may be transferred as part of that transaction, subject to this Policy.
• With your direction — when you ask us to share information or make it public (for example, on leaderboards or in the community).

We are based in the United States, and we and our providers may process your information in the US and other countries whose data-protection laws may differ from your own. When we transfer personal information out of the EEA, UK, or Switzerland, we use appropriate safeguards — such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum — or another lawful transfer mechanism. You may request a copy of the relevant safeguards by emailing privacy@growkong.com.

We keep information only while it serves the purpose described here or a legal, security, accounting, dispute, or audit need. Our normal retention ranges are:

• account, profile, application, project, and content records — while your account is active and ordinarily up to 3 years after closure or the last relevant program activity;
• signed agreements, payout ledgers, and tax or accounting records — ordinarily 7 years after the relevant transaction or end of the relationship;
• support communications — ordinarily 3 years after the request is closed;
• security, access, and fraud/audit records — ordinarily up to 2 years, or longer while an investigation or legal claim remains open;
• optional cookie preferences — 180 days, unless you replace or clear the choice sooner; and
• provider-held identity, bank, and tax records — for the period set under our contract or instructions and the legal obligations of Stripe, Avalara, TaxBandits, or another provider. Exporting a copy to us or stopping new submissions does not necessarily cause a provider to delete an existing record immediately.

Some immutable financial, consent, and security audit records cannot be deleted immediately without undermining legal or fraud-prevention duties. When information is no longer needed, we delete, de-identify, or restrict it. You may ask which period applies to a specific record at privacy@growkong.com.

EEA & UK (GDPR / UK GDPR)

You may have the right to:

• access a copy of your personal information;
• correct inaccurate or incomplete information;
• erase your information (“right to be forgotten”);
• restrict or object to certain processing;
• data portability (receive your information in a portable format);
• withdraw consent where we rely on it; and
• lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office).

United States (California and other states)

Depending on where you live, you may have the right to know/access, delete, and correct your personal information, to opt out of the “sale” or “sharing” of personal information and of targeted advertising, and to limit the use of sensitive personal information. We do not sell your personal information, and we will not discriminate against you for exercising your rights. You may use an authorised agent where the law allows.

How to exercise your rights

Email us at privacy@growkong.com. We may need to verify your identity before acting, and we will respond within the time required by applicable law.

We use automated tools and risk signals to detect invalid traffic, fraud, and abuse, and to credit Creator Levels and reward eligibility from verified sales. Creator Levels only move up and never reduce what you earn from a sale; each project's published settlement timing is fixed for an earning when it qualifies. These decisions are not made solely by automated means where that would produce a legal or similarly significant effect on you without meaningful human review. If a decision materially affects you, you can ask us to review it by contacting privacy@growkong.com.

We use technical and organisational measures designed to protect personal information, including encryption in transit, access controls, and row-level security in our data stores. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify you and the relevant authorities as required by law.

The Services are intended for adults. You must be at least 18 years old to use GrowKong. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact privacy@growkong.com and we will delete it.

The Services link to and integrate with third-party sites and platforms (such as payment providers and social networks) that we do not control. Their handling of your information is governed by their own privacy policies, and we encourage you to review them.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you through the Services or by email. If a change requires new consent, we will ask for it instead of treating silence or continued browsing as consent.

For any privacy question or request, or to reach our privacy team, contact:

GrowKong Group Inc.
5511 Caprock Summit Dr, Austin, TX 78738, United States
privacy@growkong.com

If you are in the EEA or UK and we are required to designate a representative, we will update this Policy with their contact details.