Privacy Policy

GrowthFolks Network is operated by Farframe OÜ, a private limited company registered in Estonia (registry code 17596971, VAT number [vat-number]), Ahtri tn 12, 15551 Tallinn, Estonia. Farframe OÜ is the controller of the personal data described in this policy.

For any question about your data, email info@growthfolks.io.

• Account: your full name, email address, and password. Passwords are stored only as a secure hash. Until you confirm your email with a one-time code, your sign-up details are kept as a pending registration.
• Client profile: company name, logo, website, country, city, street, company size, founding date, and whether you hire as a company.
• Agency profile: agency name, logo, tagline, description, website, presentation image, office locations and addresses, team size, founding date, hourly rates, minimum project size, services, portfolio projects and their images, and whether you accept referral jobs.
• Legal details: the legal name and registered address you add to send or sign documents.
• Activity: jobs, invitations, proposals and their attachments, saved jobs and saved searches, contracts, logged hours, payment records and invoices, reviews and private ratings, and notifications.
• Messages: the messages and files you send, when you read messages, whether you are online, and when you were last seen.
• Documents: documents sent for e-signature, the signers' names and emails, and the signed copies.
• Agency verification: the documents you upload to verify your agency (a certificate of incorporation, a proof of business address, a tax registration, and optional client references), the status of the review, and the reviewer's comments.
• Billing (agencies): commission charges and their payments, and Stripe customer and payment references. Card details are entered on Stripe's pages and stay with Stripe; we only see the card brand and last four digits.
• Profile views: when a signed-in user opens an agency's public profile, we record one view per viewer per day. Agencies only see the number of views.
• Account restrictions: the dates of any restriction and the reason we gave.
• Early access waitlist: the email address you leave to be told when the platform opens.
• Technical data: your IP address, used to limit the number of requests and possibly recorded in server logs, and error reports with your browser type and the page address. Error reports are set up not to include your name or email.

We also calculate some data from your activity: client hiring statistics, agency Job Success scores, badges, completed projects, total earned, and agency recommendations for jobs.

• To provide the platform under our Terms of Service: accounts, profiles, jobs, proposals, messages, contracts, documents, reviews, and notifications (performance of a contract).
• To keep payment and accounting records (legal obligation).
• To keep the platform secure, prevent abuse, enforce our terms, fix errors, count profile views, and calculate Job Success, badges, statistics, and recommendations (legitimate interests).
• To tell you when the platform opens, if you joined the early access waitlist (consent, which you can withdraw at any time by emailing us).
• To establish or defend legal claims (legitimate interests).

We do not send marketing emails, sell personal data, or use it for advertising. Job Success, badges, and recommendations are calculated automatically from platform activity; contact us if you believe a calculation about you is wrong.

• Anyone, including visitors without an account: agency profiles (except the email, legal name, and registered address) and whether the agency is verified, published jobs with the client's city, country, company size, the date they joined, their rating, review count, and hiring statistics (but not the client's name), and published reviews.
• Users you deal with: the client of a job sees your proposal; people you chat with see your messages and files, whether you are online, when you were last seen, and when you read their messages; both sides of a contract see its terms, logged hours, payment records, and documents.
• Our administrators: to run the platform, investigate breaches of our terms, and help resolve disputes. This includes access to accounts, conversations, contracts, and payments. They also review the documents agencies upload for verification; nobody else can open those documents.
• Our service providers (section 5), only for the services they provide to us.
• Authorities, where the law requires it.

• [hosting-provider]: servers and the database, in the United States.
• DigitalOcean: storage for uploaded files and signed documents, in the United States.
• Stripe: payments for commission. Stripe receives the agency's name and account email.
• Zoho: Zoho Sign handles e-signatures, from Zoho's EU data centre. Zoho Sign receives the documents and the data in them, including the signers' names and emails.
• Resend: sends our emails from its EU region in Ireland.
• Sentry: error monitoring, in the EU.
• GeoNames: place search when you enter a location. It receives only the text you type.

Our servers and file storage are in the United States, and some of our service providers process data there. When personal data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the Standard Contractual Clauses approved by the European Commission. Contact us for more information.

• Account, profile, and activity data: for as long as your account exists. What happens when you delete your account is described on the Delete Your Account page.
• Contracts, payment records, invoices, commission charges, and signed documents: 7 years, to meet accounting obligations and handle legal claims, including after your account is deleted.
• Agency verification documents: until you replace or delete them, and otherwise for as long as your account exists.
• Sign-in cookies: up to 7 days (see section 9).
• Sign-up and password reset codes: stored only as hashes; they stop working when they expire.
• Early access waitlist email: until you ask us to remove it.
• Server logs: [log-retention-period].
• Backups: [backup-retention-period].

Under the GDPR you have the right to:

• access your personal data and get a copy of it;
• correct inaccurate data (you can edit most of it yourself in your profile and settings);
• have your data deleted (see Delete Your Account);
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable format (we send it as a JSON or CSV file);
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, email info@growthfolks.io from the email address of your account. We reply within one month, free of charge.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority where you live or work.

We only use cookies the platform needs to work. We do not use analytics or advertising cookies. A banner asks you to accept or reject cookies in each browser you use. The cookies below stay on whichever you choose, because the platform cannot work without them.

• gtn_access: keeps you signed in; 15 minutes.
• gtn_refresh: renews your sign-in; 7 days.
• gtn_profile: basic details of your session (account ID, role, last-seen time, and which profiles you have) so pages show correctly; 7 days.
• gtn_early_access: remembers that you opened the platform with an early access link; 30 days.
• gtn_cookie_consent: remembers that you answered the cookie banner and which answer you chose; 12 months.

Your browser's local storage keeps interface state, such as whether the saved searches panel is open. It stays on your device.

• Connections to the platform are encrypted with HTTPS.
• Passwords and one-time codes are stored only as hashes.
• Sign-in tokens are kept in cookies that scripts on the page cannot read.
• Signed documents, chat attachments, and agency verification documents are kept in private storage and are available only through the platform.
• Other uploaded files (proposal attachments, logos, and project images) are stored at hard-to-guess addresses. Anyone who has the link to such a file can open it, so share links with care.

If a personal data breach puts your rights at risk, we will notify the Estonian Data Protection Inspectorate within 72 hours where the law requires it, and inform you without undue delay.

The platform is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data about children.

We may update this policy from time to time. Material changes will be highlighted on this page and, where appropriate, sent to you by email.

Questions about this policy or your data: info@growthfolks.io.