Privacy Policy

1. Who we are

GrowVenom is a marketing software platform for businesses. It is operated by Able Biolabs LLC, 3000 Pegasus Park Drive, Suite 1330, Dallas, TX 75247, United States (“GrowVenom”, “we”, “us”). You can reach us about anything in this policy at hello@growvenom.ai.

This policy explains what personal information we collect through the GrowVenom website and application, how we use it, who we share it with, how long we keep it, and the choices and rights you have. It covers information we receive from platforms you connect to GrowVenom, such as Instagram and LinkedIn.

Our role: two kinds of data

GrowVenom is sold to businesses (our “customers”). We handle two kinds of personal information:

• Information about the people who use GrowVenom, such as account holders and invited team members. We decide how this information is used, and this policy governs it.
• Information our customers put into GrowVenom, such as brand documents, product details, photos, voice recordings, and content about real people used to create AI personas. We process this on the customer’s behalf and under the customer’s instructions, as a service provider (in GDPR terms, a processor). The customer is responsible for having a lawful basis and any consents needed to give it to us. If you are an individual whose information a customer has uploaded, please contact that business first; we will help them respond to you.

2. Information we collect

Information you give us

• Account information: name, email address, password (stored only as a hash by our authentication provider), multi-factor authentication settings, the workspaces you belong to and your role in each.
• Workspace and brand information: business name, brand profile, products, audiences, tone and compliance settings, and the briefs, instructions and edits you enter.
• Files you upload: brand documents, images, logos, fonts and other reference material.
• Persona material: if you create an AI persona based on a real person, the photos and voice recordings you upload for that person, and the consent attestation you give (see Section 5).
• Billing information: if you buy a subscription or credits, our payment processor, Stripe, collects your payment card details directly. GrowVenom does not receive or store full card numbers. We keep the Stripe customer and subscription identifiers, what you bought, and your credit balance and credit history.
• Communications: messages you send us, and your email notification preferences.
• Consent records: when you accept our terms or policies, or attest that you have consent to use a person’s likeness or voice, we record which document or wording version you accepted, when, and the IP address and browser user agent of the request.

Information created when you use GrowVenom

• Generated content: the posts, captions, images, videos, scripts and synthetic voice audio GrowVenom produces for your workspace, and records of how each was generated.
• Usage and metering records: which features you used, jobs you ran, credits reserved, spent or refunded, and approvals and publishing actions taken.
• Technical information: IP address, browser and device type, request logs, and error reports needed to run, secure and debug the service.

Information from Google sign-in

If you choose “Sign in with Google”, Google shares your name, email address and profile picture with us so we can create and sign in to your account. See Section 4.

3. Information from connected platforms

You can connect social media accounts to GrowVenom. We access them only after you authorize us through the platform’s own sign-in screen, only for the workspace that connected them, and only to provide features you use. Today GrowVenom connects to Instagram and LinkedIn.

Instagram (Meta)

You can connect an Instagram professional (business or creator) account, either with Instagram login or through a Facebook Page linked to that account. Depending on the method, we receive:

• account identifiers, username, and profile picture of the Instagram account;
• for the Facebook method, the identifiers and names of the Facebook Pages you manage that are linked to it;
• information about media published on the account, and insights such as reach, impressions, engagement and follower counts;
• access tokens that let us publish content you approve and retrieve those insights.

We use this data to publish the content you approve, show you analytics about your account and posts, and improve the content GrowVenom plans for your workspace. We do not use it for advertising, we do not sell it, and we do not use it to build profiles of the people who view or interact with your posts.

LinkedIn

You can connect LinkedIn so GrowVenom can post to LinkedIn organization (company) pages you administer. We receive:

• your LinkedIn member identifier, name, email address and profile picture (through LinkedIn’s sign-in);
• the identifiers and names of the organization pages you administer;
• information about posts on those pages and their engagement and follower statistics;
• access tokens that let us publish content you approve and retrieve those statistics.

We use this data only to publish approved content to the pages you choose and to show you analytics for them. We do not use it for advertising or sell it.

Access tokens and disconnecting

Platform access tokens are stored in an encrypted secrets vault and are used only for the workspace that connected them. You can disconnect a platform at any time in Brand Manager → Channels (owner or admin), or revoke GrowVenom’s access from the platform’s own settings. Disconnecting deletes the stored tokens, stops all further access, and cancels scheduled posts for that account. Analytics already retrieved for that account (account metrics, posts and post metrics, and webhook events) are kept for 30 days, so reconnecting within that time loses nothing, and are then deleted automatically. You can ask us to delete them sooner (see Section 10).

Content that has already been published to a platform lives on that platform and is governed by its policies. Deleting it from GrowVenom does not remove it from the platform.

4. Google user data

GrowVenom’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Today the only Google user data we receive is the name, email address and profile picture Google shares when you sign in with Google. We use it only to create your account, sign you in and identify you in your workspace. We do not request access to your Gmail, Google Drive, Google Analytics, Google Ads or other Google account data. We do not sell Google user data, use it for advertising, use it to train AI models, or let people read it except with your permission, for security purposes, or where the law requires. If we add a feature that requests other Google data, we will update this section before it launches and ask for your permission through Google’s consent screen.

5. Photos, voices and AI personas

GrowVenom can create AI personas: synthetic presenters for marketing videos. A persona can be fully synthetic, or based on a real person using photos and voice recordings the customer uploads.

• Consent is required. Before GrowVenom will create a likeness or clone a voice of a real person, the customer must confirm that it has that person’s permission. We store that attestation, its wording version, the time, and the IP address and user agent of the request. Customers must obtain the person’s written consent that meets the law where the person lives, including any biometric privacy law such as the Illinois Biometric Information Privacy Act.
• How it is processed. Photos and recordings are sent to AI providers (see Section 7) to generate images, video and synthetic speech for that persona. A voice clone is a voice model created by our voice provider from the recordings. GrowVenom does not use photos or recordings to identify people, does not build face-recognition templates, and does not sell, lease, trade or otherwise profit from anyone’s biometric data.
• Retention. Persona photos, recordings and voice models are kept only while the customer uses the persona. Deleting a persona removes it from your workspace. Deleting a workspace erases its persona records after the 7-day grace period. Voice models held by our voice provider, and persona files held in our media storage, are deleted on request, and we delete persona material in any event no later than three years after the person’s last interaction with GrowVenom or when the purpose for collecting it has been fulfilled, whichever comes first. To request deletion of persona material, email hello@growvenom.ai.Signed releases are the exception. The signed likeness or voice release a customer uploads is kept after a persona or workspace is deleted, as evidence that the person consented, in the same way as the consent records described in Section 9. We delete a signed release only on an explicit request from the person it belongs to, or a legal request; email the address above.
• If you are the person in a persona and did not agree to it, contact us at hello@growvenom.ai. We will suspend the persona while we look into it.

6. How we use information

We use personal information to:

• provide GrowVenom: create accounts, run your workspace, generate content, publish what you approve, and show analytics;
• meter usage, sell subscriptions and credits, process payments, and refund credits for failed jobs;
• send service emails, such as sign-in and password reset messages, approval reminders and billing notices;
• check generated content against the compliance rules configured for your workspace before it can be approved;
• keep the service secure, prevent abuse and fraud, and enforce our terms and policies;
• diagnose errors and improve reliability and features;
• comply with law, respond to lawful requests, and establish or defend legal claims.

We do not use customer content or connected-platform data to train AI models, and we do not sell or license it to anyone for training. We do not show third-party advertising in GrowVenom and do not use your information for targeted advertising. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

7. AI providers and other service providers

GrowVenom uses third-party AI models to generate text, images, video and speech. To do that we send them the prompts we build from your brand information and instructions, and, for images, video and voice, the reference files involved. Our AI providers include OpenAI and Anthropic (text and images), Google (image and video models), ElevenLabs (speech and voice cloning), and model-hosting platforms fal.ai and Replicate, through which we use models from providers such as ByteDance, xAI and Kuaishou.

These providers process data under their own API terms. The API terms of our main text providers, OpenAI and Anthropic, state that they do not train their models on API inputs by default. Some providers keep inputs for a limited time for abuse monitoring.

We also use service providers for hosting (Railway), database, authentication and file storage (Supabase), media storage (Google Cloud Storage), payments (Stripe), transactional email (Resend), error monitoring (Sentry) and AI request tracing (LangSmith). The current list, with what each receives, is on our sub-processors page.

8. How we share information

We share personal information only:

• with the service providers described above, who may use it only to provide services to us;
• with the platforms you connect, when you instruct us to publish content or retrieve data (for example, a post you approve is sent to Instagram or LinkedIn);
• with other members of your workspace, who can see workspace content according to their role;
• when required by law, legal process or a government request, or to protect the rights, safety or property of GrowVenom, our users or others;
• in connection with a merger, acquisition, financing or sale of assets, subject to this policy’s commitments; or
• with your consent or at your direction.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months. Each workspace’s data is kept separate from every other workspace’s.

9. How long we keep information

• Account information: while your account exists. When you delete your account, your sign-in record and memberships are deleted.
• Workspace content (brand information, uploads, generated content, personas, analytics and connection records): while the workspace exists. A deleted workspace’s records, uploaded files, and the generated images and videos kept in our media storage (Google Cloud Storage) are permanently erased after a 7-day grace period, described below. Signed likeness and voice releases are the exception, listed below.
• Analytics from a disconnected platform account: deleted 30 days after you disconnect it, unless you reconnect it first.
• Consent records (which legal documents were accepted, and likeness or voice consent attestations) and the signed likeness or voice releases uploaded with them: kept after account and workspace deletion so we can show that consent was given and defend legal claims. A signed release is deleted earlier only on an explicit request from the person it belongs to, or a legal request. Once the account is deleted, the record keeps the document or wording version, the time, the IP address and user agent, and a one-way hash of the email address, and is no longer linked to the account.
• Access tokens: deleted when you disconnect the platform or delete the workspace.
• Billing and credit records (purchases, invoices, credit grants, spend and refunds): kept for 7 to 8 years after the transaction, including after workspace deletion, to meet tax, accounting and audit obligations. These records are linked to an anonymized workspace identifier once the workspace is deleted. Stripe keeps its own payment records under its own obligations.
• Deletion requests: a record that a deletion request was made and completed is kept so we can show we honored it.
• Logs and error reports: kept for limited periods set by our hosting and monitoring providers, then deleted.
• Backups: our database provider keeps backups on a rolling schedule. Deleted information can remain in a backup until that backup expires. It is not restored to the live service. Deleted media files stay recoverable in our media storage for 7 days before they are permanently removed.

10. How to delete your information

1. Disconnect a platform: Brand Manager → Channels (owner or admin), or remove GrowVenom from the platform’s app settings. The account’s analytics are deleted 30 days later unless you reconnect it. Removing GrowVenom in Facebook or Instagram settings also sends us an automatic deletion request, and we then erase the tokens, connection record and analytics for that account straight away.
2. Delete a workspace: a workspace owner can delete the workspace in its settings. The workspace is closed immediately and can be restored for 7 days. After that its records, uploaded files, generated media and connection tokens are permanently erased, except the billing, credit and consent records described above.
3. Delete your account: you can delete your own account in your account settings. If you are the only owner of a workspace, transfer ownership or delete the workspace first.
4. By email: send a request to hello@growvenom.ai from your account email. This is also how to ask us to delete analytics for a disconnected account sooner, or persona material held by our providers. We complete verified requests within 30 days.

Step-by-step instructions are on our data deletion page, and you can check on a Meta deletion request on the deletion status page. A workspace owner can also download a copy of workspace data before deleting it.

11. Security

We protect information with measures including encryption in transit, encryption at rest provided by our infrastructure providers, an encrypted vault for platform tokens, per-workspace data isolation enforced in the database, role-based access within workspaces, optional multi-factor authentication, and restricted internal access. No system is completely secure, and we cannot guarantee the security of information. If we learn of a security breach affecting your personal information, we will notify you and authorities as the law requires.

12. Your choices and rights

Wherever you live, you can ask us to access, correct, export or delete personal information we hold about you by emailing hello@growvenom.ai. Many of these actions are also available in the app. We will verify your request, usually by confirming it comes from your account email, and respond within the time the law requires. You can unsubscribe from non-essential emails using the unsubscribe link in those emails; we will still send messages needed to run your account.

Cookies: GrowVenom uses only strictly necessary cookies and browser storage, and no advertising or analytics trackers. See our cookie notice.

13. Notice for California and other US state residents

This section applies to residents of California and other US states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon), to the extent those laws apply to us. Some of these laws do not cover information about people acting in a business capacity; we offer the rights below anyway.

Categories we collect

In the past 12 months we have collected these categories of personal information, from the sources described in Sections 2 and 3:

We use and disclose these categories for the purposes in Section 6 and keep them for the periods in Section 9. We use sensitive personal information only to provide the services you request, for security, and for other purposes the law permits without offering a right to limit, so we do not offer that right.

Your rights

Depending on your state, you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• delete personal information we collected from you;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information, or its use for targeted advertising or profiling (we do none of these);
• not be discriminated against for exercising these rights.

To exercise a right, email hello@growvenom.ai. We will confirm receipt within 10 business days and respond within 45 days, which the law allows us to extend once by 45 more days if we tell you. An authorized agent may make a request for you with your signed permission, and we may ask you to verify your identity directly. If we deny your request, you can appeal by replying to our decision with the subject line “Privacy appeal”. We will answer within the time your state’s law requires, and if we deny the appeal you may contact your state attorney general.

Global Privacy Control

We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of your personal information. Because we do not sell or share personal information, honoring the signal does not change how GrowVenom works for you.

14. Users in the European Economic Area, United Kingdom and Switzerland

GrowVenom is offered primarily to businesses in the United States. If data protection law of the EEA, UK or Switzerland applies to our processing of your personal information, Able Biolabs LLC is the controller for the account information described in this policy, and we rely on these legal bases:

• Contract: to create your account and provide GrowVenom;
• Legitimate interests: to secure the service, prevent abuse, improve features and communicate with customers, balanced against your rights;
• Legal obligation: to keep billing records and respond to lawful requests;
• Consent: where we ask for it, which you can withdraw at any time.

You have the right to access, correct, delete, restrict or object to processing of your personal information, to data portability, and to withdraw consent. You may also complain to your local data protection authority. For content our customers upload, we act as a processor and will help the customer respond to your request.

We and our providers process information in the United States and other countries whose laws may differ from yours. Where required, we rely on appropriate safeguards for transfers, such as the Standard Contractual Clauses included in our providers’ data processing terms.

15. Children

GrowVenom is a business tool for people 18 and older. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. Customers must not upload photos, voices or other personal information of children to create personas. If you believe a child’s information has been provided to us, contact us and we will delete it.

16. Changes to this policy

We will update this policy when our practices change, and the version and effective date at the top of the page will change with it. If we make a material change, we will tell account holders by email or in the app before it takes effect. We will not apply a material change to information we already hold without your consent where the law requires it.

17. Contact us

Questions, requests or complaints about privacy: hello@growvenom.ai, or write to Able Biolabs LLC, 3000 Pegasus Park Drive, Suite 1330, Dallas, TX 75247, United States.