Privacy Policy

Last updated: 28 October 2026

This policy explains how GrowifyLabs collects, uses and protects personal data when you visit growifylabs.com, work with us, hear from us about a content placement, or exchange emails with one of the mailboxes our GrowifyLabs Outreach app connects to.

1. Who we are

This website is operated by GrowifyLabs, a trading name of Dirk Schembri that holds VAT MT28214733. We are based in Malta.

We are the data controller for the personal data described in this policy. You can contact us about it at info@growifylabs.com.

2. Who this policy covers

Visitors to growifylabs.com.
Our clients and prospective clients, including people who use our client portal.
Website owners and editors we contact about content placements on their websites (business-to-business outreach).
People whose emails are handled by GrowifyLabs Outreach, our Google API integration (see section 4).

3. Data we collect

Website visitors

Technical data. When your browser requests a page, our host receives your IP address, browser and device details, the page requested, the page you came from and the time. This is needed to deliver the website and keep it secure.
Analytics data. We use Google Analytics, connected through Google's Site Kit plugin, to understand how the website is used: the pages viewed, how long you stay and read, your approximate location, your device and browser type, and how you reached us. Google Analytics uses the cookies listed in section 9.
Fonts and videos. Our pages load fonts from Google Fonts, and our articles embed YouTube videos in YouTube's privacy-enhanced mode. When these load, Google receives your IP address and browser details.

The website has no contact form and no comments, and you do not need an account to read it.

Clients and prospective clients

Contact details: your name, business email address and company details, and what you tell us when you contact us by email or on LinkedIn.
Billing details: the company name, billing address and VAT number we invoice, our invoices and payment records.
Project data: information about your websites, campaigns and goals, any access you give us to your accounts or tools, and the reports and deliverables we prepare for you.
Client portal account: if you use our client portal at growifylabs.wayfront.com, your account details and the orders, messages and files in it.

Website owners and editors we contact (outreach)

Business contact details published on websites: your name, business email address and website.
Our correspondence with you.
The prices and terms offered for content placements, and what we agree.
If we agree a placement and pay you, the payment details you give us (such as a PayPal address or bank details) and your invoices.

4. How we use Google user data

GrowifyLabs Outreach is our own app. It connects only to Gmail accounts that GrowifyLabs controls and uses for outreach. It does not connect to anyone else's Google account.

Data the app accesses

Email messages, threads, drafts and labels in GrowifyLabs-controlled Gmail accounts used for outreach, accessed through the Gmail API with the scope https://mail.google.com/. This includes the emails you exchange with those mailboxes.

How we use it

To draft outreach and follow-up emails.
To check whether an email was sent.
To detect replies and bounced emails.
To record the status of each conversation in our internal tracking sheet.

A person reviews every email before it is sent.

Where it is stored and processed

Google Workspace: Gmail and Google Sheets.
Make (make.com), which runs the workflow in its EU region.
Anthropic's Claude API, which receives message excerpts to generate drafts.

We share Google user data only with the providers listed above, which act on our instructions. We never sell it, never use it for advertising or profiling, and never use it to develop, improve or train generalised artificial intelligence or machine-learning models.

People read this data only to review drafts and handle replies, for security purposes, or where the law requires it.

Retention and revoking access

We keep outreach records for up to 24 months after our last contact, unless a business relationship exists (see section 8). The holder of a connected Google account can revoke the app's access at any time at https://myaccount.google.com/permissions.

Limited Use

GrowifyLabs' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Lawful bases

Under the GDPR we rely on these lawful bases:

Contract: to provide our services to clients, and to take steps you ask for before an agreement.
Legitimate interests: business-to-business outreach about content placements, keeping our website and systems secure, and analytics where consent is not required.
Consent: for cookies that are not strictly necessary.
Legal obligation: keeping accounting and tax records.

These providers process personal data for us, on our instructions:

Google: Google Workspace (Gmail, Google Sheets and Google Drive) and Google Analytics, through Site Kit.
Make: runs our outreach workflow, in its EU region.
Anthropic: the Claude API, which generates email drafts.
Wayfront: our client portal at growifylabs.wayfront.com.
PayPal and banks: payments to vendors.
GoDaddy: website hosting.

We may also disclose personal data where the law requires it. We do not sell personal data.

7. International transfers

Some of our providers process data outside the European Economic Area, for example in the United States. These transfers are covered by the EU Standard Contractual Clauses, or by the EU-US Data Privacy Framework where the provider is certified under it.

8. How long we keep data

Website visitors: our host keeps server logs for a short period. Google Analytics keeps analytics data for the retention period set in our Analytics account.
Clients: for as long as we work together. After an engagement ends, we keep what we need for our accounting and tax records and to deal with any questions or claims about our work.
Outreach contacts: up to 24 months after our last contact, unless a business relationship exists. If you ask us not to contact you again, we keep the details needed to respect that on our do-not-contact list.
Accounting records: as long as Maltese law requires.

9. Cookies

The website sets these cookies when a page loads:

_ga: Google Analytics. Distinguishes one visitor from another. Kept for up to 2 years.
_ga_Y90HWGPZWP: Google Analytics. Keeps track of your visit. Kept for up to 2 years.

If you play a YouTube video in one of our articles, YouTube may set its own cookies under Google's policies. Our client portal at growifylabs.wayfront.com runs on Wayfront's platform and sets the cookies it needs to sign you in. If you sign in to this website's admin area, which only GrowifyLabs does, WordPress sets its own sign-in cookies.

Managing cookies

You can block or delete cookies in your browser settings; the website works without them. You can also stop Google Analytics from collecting data about your visits with Google's opt-out browser add-on.

10. Your rights

You have the right to:

access the personal data we hold about you;
have inaccurate data corrected (rectification);
have your data erased;
restrict how we use it;
object to how we use it, including for outreach: if you object, we stop contacting you immediately and add you to our do-not-contact list;
receive your data in a portable format;
withdraw your consent at any time, where we rely on consent.

To make a request, email info@growifylabs.com.

You also have the right to complain to Malta's data protection authority, the Information and Data Protection Commissioner (idpc.org.mt).

11. Security

We protect personal data with access-controlled accounts, two-factor authentication, least-privilege access and encrypted transmission.

12. Children

Our services are for businesses and are not directed at anyone under 18.

13. Changes to this policy

We update this policy when our services, tools or legal requirements change. The date at the top shows when it was last updated.

14. Contact

For any question about this policy or your personal data, email info@growifylabs.com.

1. Who we are

2. Who this policy covers