Growthstack Privacy Policy

Effective Date: March 26, 2026

Influx Marketing, Inc. ("Influx," "we," "us," or "our") operates the Growthstack™ platform, including the Growthstack website at www.Growthstack.app (the "Website") and the Growthstack mobile applications for iOS and Android (the "App"). Together, the Website and App are referred to as the "Service." Growthstack™ is a registered trademark. All rights reserved.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Website, use our App, or otherwise interact with the Service. The Service is built upon technology and infrastructure provided by third-party platform providers under license to Influx. These third-party providers may process, store, or transmit data on our behalf in connection with the delivery of the Service, subject to appropriate data handling agreements.

Please read this policy carefully. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please discontinue use of the Service immediately.

1. Information We Collect

1.1 Information You Provide Directly

When you register for an account, subscribe to our services, or otherwise interact with the Service, we may collect the following:

• Account Information: Your name, email address, phone number, business name, job title, and mailing address.
• Payment and Billing Information: Credit card numbers, billing addresses, and other financial data necessary to process your subscription or purchases. Payment processing is handled by third-party payment processors; we do not store full credit card numbers on our servers.
• Communications: Information you provide when you contact our support team, respond to surveys, or communicate with us through the Service.
• User Content: Any data, text, images, or other content you upload, input, or generate within the Service in connection with your use of the Growthstack platform.
• Healthcare and Patient-Related Data: The Service is designed for healthcare providers and may be used to manage information that includes or relates to Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). This may include patient names, contact information, appointment details, treatment inquiries, communication records, and other data that could identify an individual in connection with healthcare services. The handling of PHI is governed by the Business Associate Agreement set forth in the Influx & Growthstack Terms of Service and applicable HIPAA regulations, and those obligations take precedence over any conflicting provision of this Privacy Policy.

1.2 Information Collected Automatically

When you access or use the Service, we automatically collect certain information, including:

• Device Information: Device type, operating system and version, unique device identifiers, mobile network information, and browser type.
• Log Data: IP address, access times, pages viewed, referring URLs, and actions taken within the Service.
• Location Data: Approximate geographic location derived from your IP address. We do not collect precise GPS location data unless you explicitly grant permission through your device settings.
• Usage Data: Information about how you interact with the Service, including features used, session duration, click patterns, and navigation paths.

1.3 Information Collected Through Tracking Technologies

We and our third-party partners use cookies, pixels, tags, and similar tracking technologies to collect information about your activity on the Service and across other websites and online services. These technologies include:

• Cookies: Small data files placed on your device that help us remember your preferences, understand usage patterns, and improve the Service.
• Meta Pixel (Facebook Pixel): We use Meta's tracking pixel to measure the effectiveness of our advertising on Meta platforms (Facebook, Instagram), to understand user actions on our Service, and to deliver targeted advertisements. The Meta Pixel collects data such as HTTP headers, pixel-specific data, button click data, optional values, and form field names.
• Google Analytics: We use Google Analytics to analyze traffic and usage patterns on the Service. Google Analytics collects information such as how often users visit the Service, what pages they visit, and what other sites they used prior to visiting. We may use both Universal Analytics and Google Analytics 4. Google's ability to use and share information collected by Google Analytics is governed by the Google Analytics Terms of Service and the Google Privacy Policy.
• PostHog: We may use PostHog, a product analytics platform, to capture user interactions, session recordings, feature flag usage, and other behavioral data to improve the Service. PostHog may collect event data, device properties, and user identifiers.
• Additional Analytics Tools: We may use other analytics, advertising, and tracking tools from time to time, including but not limited to Google Tag Manager, Google Ads conversion tracking, LinkedIn Insight Tag, TikTok Pixel, Hotjar, Microsoft Clarity, and similar services. Each of these tools may collect similar types of usage and device data as described above.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To Provide and Maintain the Service: Including account creation, authentication, customer support, and delivering the features and functionality of the Growthstack platform.
• To Process Transactions: Including processing subscription payments, sending transaction confirmations, and managing billing.
• To Improve the Service: Analyzing usage trends, diagnosing technical issues, developing new features, and conducting research and analytics.
• To Personalize Your Experience: Tailoring content, features, and recommendations based on your preferences and usage patterns.
• To Communicate With You: Sending service-related notices, updates, security alerts, and support messages. With your consent where required, we may also send promotional communications.
• To Advertise and Market: Measuring the effectiveness of our advertising campaigns, delivering targeted ads on third-party platforms, creating lookalike or custom audiences, and retargeting users who have visited our Service.
• To Ensure Security and Prevent Fraud: Detecting, investigating, and preventing unauthorized access, fraud, and other illegal activities.
• To Comply With Legal Obligations: Including applicable laws, regulations, legal processes, and governmental requests.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• Third-Party Platform Providers: The Service is built upon technology provided by third-party platform providers under license to Influx. These providers may process, store, and transmit your data — including, where applicable, Protected Health Information (PHI) — as necessary to deliver the features and functionality of the Service. Such providers operate under data processing agreements and, where PHI is involved, Business Associate Agreements that require them to protect your information in accordance with applicable law.
• Service Providers: We share information with third-party vendors, contractors, and service providers who perform services on our behalf, such as payment processing, data analysis, email delivery, hosting, customer service, and marketing assistance. These providers are contractually obligated to use your information only as necessary to provide services to us.
• Analytics and Advertising Partners: We share data with analytics providers (such as Google, Meta, PostHog, and others described in Section 1.3) to help us understand Service usage and improve our advertising. This may involve sharing or making available identifiers, device data, and usage information. We take steps to ensure that PHI is not shared with analytics or advertising partners. Where analytics tools are deployed within the Service, data is processed through our Customer Data Platform (CDP), which removes PHI before relaying events to third-party analytics platforms.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.
• Legal Requirements: We may disclose your information if required to do so by law, or in the good-faith belief that such action is necessary to comply with legal obligations, protect our rights or property, investigate fraud, or protect the safety of our users or the public.
• With Your Consent: We may share your information for any other purpose disclosed to you at the time of collection or with your consent.

4. Cookies and Tracking Preferences

Most web browsers are set to accept cookies by default. You can adjust your browser settings to remove or reject cookies. Please note that disabling cookies may affect the functionality of the Service.

You may opt out of certain tracking technologies as follows:

• Google Analytics: Install the Google Analytics Opt-Out Browser Add-On.
• Meta Pixel: Adjust your ad preferences in your Facebook account settings, or use the Digital Advertising Alliance opt-out tool.
• General Advertising Opt-Outs: Visit www.aboutads.info/choices or www.networkadvertising.org/choices to opt out of interest-based advertising from participating companies.
• Mobile Devices: You may limit ad tracking on iOS through Settings > Privacy > Tracking, and on Android through Settings > Privacy > Ads.

Please note that opting out of tracking does not mean you will no longer receive advertising; it means the ads you see may be less relevant to you.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When your information is no longer needed for these purposes, we will delete or anonymize it in accordance with our data retention policies. Anonymized or de-identified data that cannot reasonably be used to identify you may be retained and used indefinitely for analytics, benchmarking, and product improvement.

6. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, alteration, and disclosure. These measures include encryption of data in transit and at rest, access controls, and regular security assessments. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

7. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information. If you believe we have collected information from a child under 18, please contact us at the address below.

8. Your Privacy Rights

8.1 California Residents (CCPA/CPRA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to request deletion, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising your rights. We do not sell personal information as defined under the CCPA. To exercise your rights, contact us using the information in Section 13.

8.2 Other U.S. State Privacy Laws

Residents of states with applicable consumer privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) may have similar rights to access, correct, delete, and opt out of certain processing of their personal information. To exercise any applicable rights, please contact us using the information in Section 13.

8.3 Canadian Residents

If you are located in Canada, your personal information may be processed and stored in the United States and subject to U.S. laws. We make reasonable efforts to align with the principles of the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation. You have the right to access and request correction of your personal information by contacting us.

8.4 United Kingdom and EEA Residents

If you are located in the United Kingdom or the European Economic Area, you may have rights under the UK GDPR or EU GDPR, including the right to access, rectify, erase, restrict processing, data portability, and object to processing. Our legal bases for processing include contract performance, legitimate interests, and consent. To exercise your rights, contact us using the information in Section 13.

9. International Data Transfers

The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to these countries.

10. Third-Party Links and Services

The Service may contain links to third-party websites, services, or applications that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through the Service.

11. HIPAA and Protected Health Information

The Service is designed for healthcare providers and professionals who may use the Service to manage, store, process, or transmit information that includes or relates to Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"). This may include patient names, contact information, appointment details, treatment inquiries, communication records, billing information, and other data that could identify an individual in connection with healthcare services.

Influx acts as a Business Associate (as defined under HIPAA) with respect to PHI that clients process through the Service. The handling of PHI is governed by the Business Associate Agreement ("BAA") set forth in the Influx & Growthstack Platform Terms of Use & Services Agreement. Influx implements administrative, technical, and physical safeguards designed to protect PHI in accordance with HIPAA and HITECH requirements.

If you are a Covered Entity or Business Associate under HIPAA, you must not use the Service to process PHI unless you have an active platform subscription agreement with a signed BAA in effect. You are solely responsible for determining whether your use of the Service involves PHI, for ensuring appropriate consents and authorizations are in place, and for configuring your devices and systems with appropriate security measures.

This Privacy Policy does not modify or supersede any HIPAA obligations between the parties. If there is a conflict between this Privacy Policy and the BAA regarding the handling of PHI, the BAA controls. The third-party platform providers upon which the Service is built also operate under appropriate data processing and business associate agreements to ensure HIPAA-compliant handling of PHI throughout the technology stack.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Effective Date" at the top of this page and, where appropriate, providing additional notice through the Service or via email. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Influx Marketing, Inc.
Email: legal@influxmarketing.com
Website: www.Growthstack.app

Last Updated: March 26, 2026