Data Processing Agreement
This Data Processing Agreement ("DPA") is between GrowthTracker ("Processor") and the customer ("Controller") and forms part of the Terms of Service. It applies when GrowthTracker processes personal data on behalf of the customer.
1. Definitions
Personal Data: Any information relating to an identified or identifiable natural person entered into the Service by the Controller (e.g., lead names, emails, phone numbers).
Processing: Any operation performed on personal data, including storage, retrieval, and deletion.
2. Roles
The customer (Controller) determines the purpose and means of processing. GrowthTracker (Processor) processes data only as instructed by the Controller and as necessary to provide the Service.
3. Data We Process on Your Behalf
- Lead names, phone numbers, email addresses
- Business names and categories
- Notes, follow-up records, and deal values entered by users
- User account information (team members)
4. Our Obligations
- Process data only as instructed by the Controller
- Implement appropriate technical and organizational security measures
- Not sell or share personal data with third parties for their own use
- Assist the Controller in responding to data subject requests
- Notify the Controller within 72 hours of becoming aware of a data breach
- Delete or return data upon termination of the agreement
5. Sub-processors
We use the following sub-processors to provide the Service:
- Google Firebase / Google Cloud — database storage and authentication (USA)
- Payment processor — billing and subscription management
We will notify you of any changes to sub-processors that may affect your data.
6. Security
We implement the following security measures:
- Data encrypted in transit (HTTPS/TLS)
- Firebase security rules restricting data access by organization
- Authentication required to access all data
- No cross-tenant data access
7. Data Transfers
Data may be stored on servers in the United States. By using the Service, you consent to this transfer. Google Firebase is certified under applicable data protection frameworks.
8. Termination
Upon termination of your account, we will delete your personal data within 30 days unless retention is required by law.
9. Contact
Data protection inquiries: support@growthtracker.fyi