Privacy Policy

Who we are

In this policy, “Orgrowth”, “we”, “us” and “our” mean Orgrowth Limited, a company registered in New Zealand (NZBN 9429053921451). We are responsible for the information described in this policy.

What the Orgrowth app is

The Orgrowth app (app.orgrowth.ai) is an analytics dashboard with content tools. Creators and businesses who are our clients sign in and connect their own Instagram professional account, either through the Facebook Page it is linked to or directly with Instagram. The app then shows them how their posts and reels perform, with reports, content insights and planning tools built from that data. On Facebook and Instagram, our app appears as “Content Dashboard”.

The app is only available to our clients and the team members they invite. It is not a public service. The Meta connection is only ever used to read the accounts a client connects. Separately, a client can save publicly available posts by other creators as references for their own content; those come from public web pages and third party data providers, never through a client’s Meta connection or any Meta permission.

Information we read from Instagram and Facebook

When a client connects an account, Meta asks them to approve the permissions below. We only read data for the accounts the client chooses to connect, and only the data listed here.

Instagram account profile

• Account ID, username and account name
• Profile picture
• Follower count, following count and number of posts
• Bio

Posts and reels

• Captions
• Media type, media URLs (links to the photos, videos and thumbnails) and the post’s permalink
• When each post was published
• Like and comment counts

Post and account insights

• Views, including views on Facebook where Meta reports them
• Reach
• Likes, comments, saves and shares
• For reels, average watch time and the share of viewers who scrolled away in the first seconds
• Daily account reach, daily account views and daily follower changes

Facebook Login for Business

When a client connects through Facebook, we also read:

• The client’s app scoped Facebook user ID, so we can act on deletion requests Meta sends us
• The Facebook Pages the client chooses to share with us, and the Instagram account linked to each
• The selected Page’s name, ID and follower count

Permissions we request

• Facebook Login for Business: instagram_basic, instagram_manage_insights, pages_show_list and pages_read_engagement
• Instagram Login: instagram_business_basic and instagram_business_manage_insights

These are read permissions only. Through Content Dashboard we do not request permission to publish content, manage comments, send or read messages, or run ads.

Other information we hold

• Account details: the email addresses of the client and any team members they invite, so they can sign in with a magic link.
• Usage records: when each person signs in and uses the app, and what the AI features cost to run for each client, so we can support clients and keep the service affordable.
• Content you give us: brand information, notes, topics, voice notes, scripts and other material a client writes in or uploads to the app. For an uploaded document (PDF, Markdown or text) we keep the text extracted from it, not the file.
• What the app makes for you: the scripts, carousels, briefs, captions and insights our AI features generate, so you can come back to them.
• YouTube: if a client gives us their YouTube channel, we read the channel’s public statistics and video details through the YouTube Data API, and transcripts from YouTube’s public captions (or our own transcription when there are none). Google’s use of that data is covered by the Google Privacy Policy.
• Reference posts: publicly available posts by other creators that a client saves as references, including their captions, public statistics and our transcript of the audio. These come from public web pages and our data provider Apify, never from a client’s Meta connection.
• Tools you choose to connect: if a client connects Notion, Calendly, GoHighLevel, ManyChat, Beehiiv, Klaviyo or Shopify, we read what that tool needs to show in the app, such as bookings, leads, newsletter or email statistics and orders. Each connection is optional and the credentials are encrypted.
• Calls with us: if you have a call with our team, it may be recorded and transcribed with Fireflies, and we use the transcript to prepare your plan and follow ups.
• Requests you make: deletion and disconnection requests, kept as a record that we acted on them.

How we use information

We use the Instagram and Facebook data described above to show each client their own performance analytics and content insights, in their dashboard and in the reports we prepare for them. That includes:

• Showing post, reel and account performance over time
• Highlighting which content performs best and why
• Using AI tools to analyse the client’s own posts, captions and reel audio (which we transcribe) so we can suggest what to make next
• Supporting the client when they ask us for help with their account

We use account details to let people sign in and to contact clients about the service.

How we use AI

Many features in the Orgrowth app use artificial intelligence. Content the AI writes is labelled “AI generated” in the app. AI can make mistakes, so please read and check everything before you publish it.

Features that use AI

• The short form and YouTube scriptwriters, and carousel drafts
• Daily briefs and weekly trend briefs
• Captions, titles and hashtags for the optional publishing feature
• Transcribing your reels and videos, and the reference posts you save
• Content insights about what performed and why, and a summary of your writing voice
• Niche news research, and the first draft of a new client’s brand brain during onboarding

Who provides the AI

• Anthropic (Claude) writes and analyses: scripts, carousels, briefs, captions, insights and summaries.
• Google (Gemini) transcribes audio and video and analyses video content.
• Perplexity, directly and through OpenRouter, researches news in a client’s niche. We send it topics and keywords about the niche, not personal information.

We send each provider only what the feature needs, such as your brand brain, the posts and transcripts the feature is working from and what you typed. We use their business services through their APIs, not their consumer apps. Our team may also use Claude through a secure, read only connector to the app to help prepare a client’s reports.

We do not use AI to make decisions about you that have legal or similarly significant effects. If something you type into the app reads as though you may be in crisis, the app pauses that request and shows you free support services instead of generating anything.

Optional publishing through Zernio

The app has an optional publishing feature that lets a client schedule their own videos to their own Instagram, Facebook, TikTok and YouTube accounts. It does not use Content Dashboard or any of the permissions above. Instead, the client connects each account in a separate sign in flow run by our publishing provider, Zernio, and Zernio publishes the post. A client can disconnect those accounts in the app at any time.

We only publish posts the client, or our team on the client’s instructions, has scheduled or approved, and automations the client asks us to switch on. One such automation copies a client’s Instagram reels to their own TikTok account; when it is on, we send the client’s own reel video to Zernio so it can be posted there.

What we never do

• We never post, comment, like, reply or send messages on anyone’s behalf through Content Dashboard or the Meta permissions listed above. That connection is read only.
• We do not sell data, and we do not rent or trade it.
• We do not use data from Meta for advertising, ad targeting or building profiles of people for marketing.
• We do not show one client’s data in another client’s dashboard, and we do not use the Meta connection to collect information about the individual people who follow or engage with a client.

Who we share information with

We do not sell information and we do not share data from Meta with anyone except the service providers that host and process it for us so we can run the app. Every provider below acts on our instructions for the purpose listed, and only receives what that purpose needs.

Providers that process client data for every client

• Vercel: hosts the app and runs its server code.
• Supabase: our managed Postgres database, and storage for copies of post covers and profile pictures.
• Trigger.dev: runs background jobs such as the daily sync, transcription and briefs.
• Anthropic: AI writing and analysis, as described in How we use AI.
• Google: AI transcription and video analysis (Gemini), and public YouTube data (YouTube Data API).
• Perplexity and OpenRouter: niche news research, with no personal information sent.
• Apify: collects publicly available posts and profile statistics from Instagram and other public sites, for a client’s references and public profile details.
• Resend: sends sign in links and service emails.
• Meta (Instagram and Facebook) and Google (YouTube): the platforms we read a client’s own data from, through the connections described above.
• Notion: where we keep each client’s Brand HQ and brand brain with them, and the source we sync a brand brain from when a client connects their own Notion page.
• Fireflies: records and transcribes calls with our team.

Providers used only when a client turns the feature on

• Zernio: publishing to Instagram, Facebook, TikTok and YouTube, hosting the videos to be posted, and reading TikTok statistics for accounts connected through it.
• Calendly and GoHighLevel: reading bookings and contacts, to show which content led to a call.
• ManyChat: receiving leads from Instagram DM automations.
• Beehiiv: reading newsletter statistics and adding subscribers from lead forms.
• Klaviyo and Shopify: reading email campaign statistics and orders for online store clients.

Our own marketing

• Vercel Analytics, PostHog and Wistia: visit and video statistics for our own website and sales pages. They are not used inside the app.

We may also disclose information if New Zealand law requires us to, or to protect our rights or the safety of others. If Orgrowth is ever sold or restructured, information may transfer to the new owner, who will be bound by this policy.

Requests from public authorities

If a government agency, regulator or law enforcement body asks us for personal information, including information we receive from Meta:

• we review the legality of every request before we respond, and take legal advice where needed;
• we disclose only the minimum information the request lawfully requires; and
• we keep a record of each request, our response, the legal reasoning behind it and who was involved.

We have not received any national security request for personal information.

Storage and security

• Access tokens from Meta, and the keys for every other tool a client connects, are encrypted at rest with AES 256 GCM before they are stored. When a client connects through Facebook, we store only the access token for the Page they select; their personal Facebook user token is held, encrypted, in a cookie for up to ten minutes while they choose a Page, and is never stored. Tokens are never shown in the app, written to logs or sent by email.
• Data is stored in a managed Postgres database and is encrypted in transit.
• Copies of post covers and profile pictures, which are already public on Instagram, are kept in storage at web addresses that are not listed anywhere but are not password protected, so the app and your Brand HQ can show them. Videos uploaded for publishing are stored by Zernio in the same way so they can be posted. Uploaded documents are not kept as files; we keep only their text, in the database.
• Access to a client’s data is limited to that client’s own team and the Orgrowth staff who support them. Every page and every request inside the app is checked against the signed in person’s access before any data is returned, and sign in, AI and public form requests are rate limited to prevent abuse.

No system is perfectly secure, but we take reasonable steps to protect information from loss, misuse and unauthorised access. If a privacy breach is likely to cause serious harm, we will tell the people affected and the Office of the Privacy Commissioner, as the Privacy Act 2020 requires.

How long we keep information

We keep a client’s data while their account is active. When Meta sends us a deletion request, we act on it automatically as soon as it arrives, as described below. When a client asks us to delete their data, from the Account and data page or by email, we delete the stored access tokens and the client’s data within 30 days. When a client’s service with us ends, we delete them within 90 days. The only exception is information we must keep by law, such as invoices and business records, which never includes data from Meta.

• Deleting an uploaded document in the app erases its text straight away. We keep a note that a document existed and how often it was used.
• Videos uploaded for publishing stay with Zernio until its own retention period removes them, even if the post is deleted in the app. Ask us and we will have them removed.
• Rate limiting counters hold only a scrambled (hashed) form of an IP address or email, and are deleted after a day.
• Records of deletion and disconnection requests are kept as proof that we acted on them.

How to disconnect your account

You can stop our access at any time, in any of these ways:

• In the app: open Account and data from the menu under your email address, or the Instagram card in Integrations, and choose Disconnect Instagram. We delete the stored access token straight away.
• In Facebook: go to Settings, then Business Integrations (or Apps and Websites), find “Content Dashboard” and remove it.
• In Instagram: go to Settings, then Apps and websites, find “Content Dashboard” and remove it.
• By email: email ash@orgrowth.ai and we will remove the connection for you and confirm by email.

Once access is removed we can no longer read any new data from the account. If you connected through Facebook, Meta tells us when you remove the app and we delete the stored access token for your account straight away. To have the data we already hold deleted as well, follow the next section.

How to request deletion of your data

You can ask us to delete the data we hold about you or your Instagram or Facebook account in three ways. Instructions and request status are also on our data deletion page.

1. Through Facebook or Instagram

Remove “Content Dashboard” in your Facebook settings (Business Integrations, or Apps and Websites) or in Instagram (Settings, then Apps and websites), and choose to request deletion of your data. Meta then sends our deletion callback a signed request that identifies your account. We check Meta’s signature, and for every Orgrowth account you connected through Facebook we immediately:

• Delete the stored Meta access token
• Remove the link to your Facebook Page and your stored profile picture
• Delete the Instagram posts, reels, insights and follower history we synced for that account
• Delete the stored copies of that account’s post covers and profile picture
• Give Meta a confirmation code and a status link for the request, which Meta shows to you

We keep only your Instagram username and account ID on our client record, so we can recognise the account if you reconnect. Ask us and we will remove those too.

If you connected with Instagram Login rather than through Facebook, Meta’s request may not identify your Orgrowth account to us automatically. Removing the app still stops our access straight away; to make sure your data is deleted, also email us as described below.

You can check the status of a deletion request at any time at https://app.orgrowth.ai/data-deletion, using the confirmation code Meta gives you (the link Meta shows you already includes it).

2. In the app

Signed in clients can open Account and data from the menu under their email address and choose Request deletion. This covers the whole workspace: connected account data, scripts, briefs, carousels, uploaded documents and the team’s sign in access. We email you a receipt straight away, delete the data within 30 days, and email you again once it is done.

3. Email us

Email ash@orgrowth.ai from the address you use with Orgrowth, or include your Instagram username, and ask us to delete your data. We will confirm by email once it is done, within 30 days.

Website visitors and email subscribers

On orgrowth.ai we collect your name and email address when you fill in a form, for example to join our newsletter, unlock a free guide or book a call. We use them to send you what you asked for and our newsletter. Every email has an unsubscribe link, and you can ask us to remove you at any time. Our email platforms store your address so we can send these emails.

We also record which pages are visited and which links were followed, together with the website or campaign that sent the visitor, so we know which content is useful. We use Vercel Analytics for anonymous usage statistics, which does not identify you.

Cookies and browser storage

The Orgrowth app loads no advertising, tracking or third party analytics scripts. It sets these first party cookies:

• Sign in (brandos_session, 30 days): keeps you signed in. Essential.
• Connecting Facebook (brandos_fb_connect, up to 10 minutes): holds your encrypted Facebook token while you choose a Page. Essential.
• Staff view (brandos_member_view): only set for Orgrowth staff, to view the app as a client sees it. Essential.
• Layout preferences (sidebar_state, 7 days, and bb_view, 1 year): remember whether the sidebar is open and which brand brain view you chose. Functional; they hold nothing about you.
• Tracked links (bos_session, 2 years): set when someone opens one of our or a client’s tracked links (for example orgrowth.ai/go/…) or our booking link. It holds a random visitor ID so we can tell which piece of content led to a sign up or booked call. It is not shared, not used for advertising and does not identify you by name.

orgrowth.ai: the website keeps a random visitor ID and a note that you have subscribed in your browser’s local storage, so it can count unique visits and skip the sign up form next time. Vercel Analytics does not use cookies.

You can clear cookies and local storage in your browser settings at any time.

Your privacy rights

Under the New Zealand Privacy Act 2020 you have the right to ask for access to the personal information we hold about you, and to ask us to correct it. You can also ask us to delete it. Email ash@orgrowth.ai and we will respond within 20 working days.

If you are not happy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Office of the Privacy Commissioner.

International transfers

We are based in New Zealand, but some of our service providers store or process data on servers outside New Zealand, including in the United States. When that happens we take reasonable steps to make sure the information is protected in a way that is comparable to the protection in the New Zealand Privacy Act 2020.

Children

Our website and app are for businesses and adults. They are not directed at children, and we do not knowingly collect information from anyone under 16. If we learn that we hold information about someone under 16, we will delete it. If you think we do, email ash@orgrowth.ai.

Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date at the top of this page, and if the change is significant we will tell our clients by email before it takes effect.

Contact us

For any question about this policy or your information, contact:

See also our Terms of Service.