Privacy Policy for Managed Cold Email Infrastructure
Last updated: 19.10.2026
Docsify OU, operating under the GrowthBand brand ("GrowthBand," "we," "us," or "our"), provides a managed cold email infrastructure service (the "Service"). This Privacy Policy explains what personal data we process in connection with the Service, our customer portal and our website, why we process it, who helps us process it, and what choices you have.
1. Our Role
1.1 Controller. We are the controller for personal data about our customers and their users: account, billing, portal, support and website data.
1.2 Processor. For personal data that our customers send or receive through the Service, such as recipient email addresses, sending events and replies, the customer is the controller and we act as processor on its behalf. The customer decides whom to contact, with what content and on what legal basis.
1.3 Data Processing Agreement. Customers who need a separate Data Processing Agreement can request one at support@growth.band.
2. Data We Process
| Category | Examples | Purpose | Our role |
|---|---|---|---|
| Account & Billing | Company name, contact names, business email, billing address, VAT/tax ID. Card details are handled by Stripe; we do not store card numbers. | Create and manage your account, issue invoices, process payments | Controller |
| Portal Users | Name, email, role, sign-in and authentication events, profile photo if uploaded | Give your team access to the portal and keep it secure | Controller |
| Support Communications | Messages you send us by email or Slack | Answer questions and resolve issues | Controller |
| Mailbox Sender Details | Sender names and addresses used on the mailboxes we set up for you | Provision and operate your mailboxes | Processor |
| Recipient & Campaign Data | Recipient email addresses and domains; sending, delivery, bounce and reply events; reply subject and text; reply category | Manage sending limits, monitor deliverability, produce reports, classify replies | Processor |
| Operational Logs | IP addresses, request and error logs, diagnostic metrics | Secure, monitor and maintain the Service | Controller |
| Website Data | Analytics cookies and usage data | Measure how our website performs | Controller |
We receive recipient and campaign data from your connected sending tool through its API and webhooks. Your campaigns are sent by your sending tool. We use recipient data only to provide the Service to you and never to build contact lists or contact recipients ourselves.
3. How We Use Data
- Provide, maintain and secure the Service
- Set and adjust sending limits and monitor deliverability
- Produce reports and analytics for you in the customer portal
- Process payments and manage subscriptions
- Respond to support requests
- Comply with legal obligations, such as tax and accounting
We never sell personal data. We do not use customer or recipient data for advertising, and we do not use it to train AI models.
4. AI Processing
We use AI models to classify replies, for example as interested, not interested or out of office, so that reports and deliverability monitoring reflect real outcomes. For this purpose, reply text is sent to the AI model providers listed in Section 5 through their business APIs. We do not use your data to train AI models.
5. Sub‑Processors
We use the following sub‑processors to provide the Service:
| Sub‑processor | Location | Purpose |
|---|---|---|
| Supabase | EU (Ireland) | Database, authentication and file storage |
| Vercel | EU (Dublin), global edge network | Application hosting |
| Trigger.dev | US | Background job processing |
| DigitalOcean | EU | Server hosting for event intake workflows |
| Cloudflare | Global | Webhook intake and archive |
| Google Workspace | EU/US | Mailbox hosting |
| Microsoft 365 and Azure | EU/US | Mailbox hosting |
| Domain registrars and mailbox provisioning partners | EU/US | Domain registration, DNS and mailbox provisioning |
| OpenAI | US | AI processing |
| Google (Gemini API) | US | AI processing |
| Anthropic | US | AI processing |
| OpenRouter | US | AI model routing |
| Stripe | EU/US | Payment processing |
| Slack | EU/US | Customer support communications |
| Resend | US | Service notification emails |
| Google Analytics | EU/US | Website analytics |
We maintain written agreements with each sub‑processor requiring data protection at least equivalent to GDPR, and we update this list when our sub‑processors change. Sending tools that you connect to the Service are chosen and contracted by you and are not our sub‑processors.
6. International Transfers
Where personal data is transferred outside the European Economic Area, we rely on:
- Adequacy decisions (Art. 45 GDPR), including the EU‑U.S. Data Privacy Framework for certified recipients
- Standard Contractual Clauses (Art. 46 GDPR)
7. Data Retention
- Account and billing data – for the duration of your subscription and seven (7) years after it ends, as required by Estonian accounting law.
- Recipient and campaign data – for the duration of your subscription and afterwards until you ask us to delete it. We delete it within thirty (30) days of a verified request.
- Portal user accounts – until you or the user asks us to delete them.
- Support communications – as long as needed to resolve the request and keep a record of our relationship.
- Operational logs – as long as needed for security and troubleshooting.
- Backups – database backups are kept for seven (7) days, so deleted data leaves our backups within that period.
8. Security
We use industry‑standard administrative, technical and organizational measures, including:
- Encryption in transit (TLS 1.2+) and at rest
- Hosting of our database in the European Union
- Database‑level access controls that keep each customer's data separate, so portal users see only their own company's data
- Role‑based staff access, limited to what each person's work requires
- Infrastructure monitoring and automated alerts
If a personal data breach affects your data, we will notify you without undue delay after becoming aware of it.
9. Your Rights
Depending on your location, you may have the right to access, correct, delete or port your personal data, and to object to or restrict certain processing. To exercise these rights for data where we are the controller, contact support@growth.band.
If you received an email sent through the Service, the sender is our customer and controls your data. Contact the sender directly, or write to us and we will forward your request to them.
10. Cookies & Tracking
Our website uses minimal first‑party cookies for essential functions and Google Analytics to measure website performance. The customer portal uses only the cookies needed to keep you signed in. We do not use cookies for third‑party behavioural advertising.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will post the revised version here and update the "Last updated" date. Continued use of the Service after the changes take effect constitutes acceptance of the revised Policy.
12. Contact Us
If you have any questions about privacy or data protection, please contact:
Docsify OU
Kaupmehe tn 7‑120
10114 Tallinn, Estonia
Email: support@growth.band