Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:
Lucas Würms (growResonance)
Lindenstraße 15, 88699 Frickingen, Germany
Email: home@growresonance.ai

We are currently not required to appoint a data protection officer under Art. 37 GDPR and § 38 of the German Federal Data Protection Act (BDSG). Please send questions about data protection to the email address above.

2. Overview

growResonance is a platform for companies that want to measure how their brand appears in answers from AI services. We process personal data in two roles:

• As a controller for visits to our website, for inquiries, the free visibility check, the guide for agencies, for your account, billing, the security of the platform and communication with you. This is what this policy describes.
• As a processor for the content that customers process in the platform, such as prompts, data of their own clients, recipients of reports or inquiries from forms that they connect (section 4.7). Our Data Processing Agreement applies to this; the respective customer company is then the controller.

Wherever possible, we use providers that process data in the EU. Providers based or processing data outside the EU are listed in section 6 together with the respective basis for the transfer. Contracts under Art. 28 GDPR are in place with all subprocessors.

3. Visiting our website

3.1 Server logs

When you access our pages, our hosting provider Vercel processes technically necessary connection data: IP address, time, URL accessed, referrer and browser identifier. The purpose is the delivery, stability and security of the website. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure operation. Depending on the plan, Vercel stores these logs for a maximum of 30 days.

3.2 Cookies, local storage and audience measurement

Cookies for sign-in and the secure session, for storing your cookie choice, the choice of the active workspace and location, an order or invitation in progress, and access to password-protected reports and to the guide for agencies (section 3.6) are technically necessary. This includes two cookies for language: gr_site_lang stores the language that you choose with the language switcher on the website (one year); gr_ui_lang stores the language of the application from your profile together with your account identifier (one day). The legal basis is § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(b) and (f) GDPR.

Only with your consent (category “Analytics”) do we use Vercel Web Analytics and Vercel Speed Insights: a cookieless measurement of page views and load times, delivered via our own domain, without profiles across several websites. The legal basis is § 25(1) TDDDG and Art. 6(1)(a) GDPR. Plausible Analytics (Plausible Insights OÜ, Estonia) is technically prepared but not active; if it were activated, it would fall under the same consent. We do not use marketing cookies. You can withdraw your consent at any time via “Cookie settings” in the footer of the page. We log your choice with a salted hash of your IP address in order to be able to prove it (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR).

3.3 Blog and embedded content

We deliver the articles under /blog, including their images, from our own website; the articles do not load any content from third-party servers. We only embed videos in our documentation via youtube-nocookie.com once you click on the preview image; before that, nothing is sent to YouTube (Google Ireland Limited).

3.4 Contact, appointment booking and inquiries

If you write to us by email, we process your information in order to answer your inquiry (Art. 6(1)(b) GDPR for inquiries about a contract, otherwise point (f)).

For contact via WhatsApp and for appointment bookings, we only use links to WhatsApp (WhatsApp Ireland Limited, Meta) and Calendly (Calendly, LLC, USA). Nothing is sent to these providers when our pages load. If you use one of the links, their privacy terms apply there; we receive the message or the booking details and process them in order to reply and to hold the appointment (Art. 6(1)(b) and (f) GDPR).

Via the “Request a quote” form and the waiting list for new features, we process your information (such as name, company, email address, phone number, message) and a salted hash of your IP address to protect against misuse. The legal basis is Art. 6(1)(b) GDPR (pre-contractual inquiry) or point (f) (information about the requested feature).

3.5 Free visibility check

For the check at /check, we process the domain you enter and, in order to send you the result, your email address, your first name, optionally your phone number, the wording of your consent with time stamp, a salted hash of your IP address and the browser identifier. For the analysis, we submit prompts about your domain to language models (section 5) and read publicly accessible information from your website such as title and description. We send the result via Resend. The legal basis for contacting you and sending the result is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by email to home@growresonance.ai. We base the protection against misuse on Art. 6(1)(f) GDPR; if enabled, we use Friendly Captcha for this.

We have no longer offered the free pitch report for agencies since Oct 9, 2026. We only store the information that you provided for it until then (domain, industry, email address and consent) until the periods in section 7 expire and then delete it.

3.6 Guide for agencies “GEO in 14 days”

If you request the guide at /geo-in-14-days, we process your email address in order to send you a personal link to the guide, proposal template and price calculator and, if you answer the question about it, the number of clients that you serve on a retainer. In addition, we store when you requested and opened the link and, to protect against misuse, a salted hash of your IP address and the browser identifier. We send the email via Resend. When you open the link, we set a technically necessary cookie so that you can access the pages again later without the link (§ 25(2) no. 2 TDDDG). Only your browser stores which chapters you have read and which steps you have checked off.

The legal basis for sending the guide and for access is Art. 6(1)(b) GDPR, because you request the guide. We base the protection against misuse and the internal evaluation of which agencies use the guide on Art. 6(1)(f) GDPR; if enabled, we use Friendly Captcha for this. We do not send advertising emails or a newsletter on this basis. You can object and request deletion at any time by email to home@growresonance.ai; the link is then no longer valid.

4. Account, contract and use of the platform

4.1 Registration, sign-in and team

When you register, we process your email address, a password (stored only as a hash) and optionally your name. Sign-in runs via Supabase in Frankfurt am Main. If you use Sign in with Google, Google transmits to us your Google account ID, email address, your name and the address of your profile picture (details in section 4.5). The legal basis is Art. 6(1)(b) GDPR.

We store your consent to the Terms of Service and the Privacy Policy and your confirmation that you are acting as a business together with the time stamp, the version of the Terms of Service, a salted hash of your IP address and the browser identifier in order to be able to prove the conclusion of the contract (Art. 6(1)(b) and (f) GDPR).

If you invite team members, we process their email address for the invitation and, after acceptance, their role in your organization (Art. 6(1)(b) and (f) GDPR).

If you voluntarily upload a profile picture, we store it at Supabase in Frankfurt am Main. Your browser crops the image beforehand; camera data such as the location where the picture was taken is removed in the process. Members of your organization and your workspaces see the picture next to your name. You can replace or remove it at any time in the profile settings; we delete it together with your account (Art. 6(1)(b) GDPR).

4.2 Contract and billing

For the purchase and billing, we process name, email address, billing address, your VAT ID if applicable, plan, term and payments. Stripe handles the payment; we do not receive payment data such as card numbers. The legal basis is Art. 6(1)(b) GDPR, and for the retention of invoices Art. 6(1)(c) GDPR in conjunction with § 147 of the German Fiscal Code (AO) and § 14b of the German VAT Act (UStG). Stripe sends us events such as incoming payments; this data is not passed on to our service for background processes.

4.3 Visibility measurement, texts and AI assistant

For the measurement, we regularly submit the prompts of a workspace to the public user interfaces of ChatGPT, Gemini and Google AI Mode; DataForSEO carries out the queries. We use the APIs of OpenAI and Google (Vertex AI) for the measurement only as a technical fallback. We analyze the answers with Claude. For texts, Content Audit and content optimization, we transmit brand information, settings on tone and content of your pages and of publicly accessible third-party pages to Claude; we obtain the Google top 10 on a topic via DataForSEO. For Prompt Research, keyword groups and internal linking, we calculate text vectors at Voyage AI, without a workspace identifier. We send messages to the AI assistant to Claude together with a summarizing context from your workspace (such as brand description, audiences, competitors, metrics, Search Console and audit results, article titles); contact details of other team members are not included.

We process this content on behalf of the customer company (DPA). Insofar as data about you as a user arises in the process, the legal basis is Art. 6(1)(b) GDPR. We store uploaded images at Supabase in Frankfurt am Main; we do not recognize faces and do not process biometric data. We do not publish generated texts; you export them yourself.

4.4 Technical Audit and website data

For the Technical Audit and the setup, we retrieve the pages of the website you specify. We determine load times and quality scores via Google’s PageSpeed Insights API, to which we transmit the URLs for this purpose. We obtain website icons (favicons) for domains on the server side via a Google service. During setup, your browser displays a preview of the website you entered and its icon directly from that website; its operator receives your IP address in the process.

4.5 Google user data

growResonance only accesses data from your Google account if you use one of the following features and grant access on Google’s consent screen. In each case, we only request the permission that the feature needs, and only read access; we do not change, delete or publish anything in your Google account.

• Sign in with Google (permissions “openid”, “email”, “profile”): Google account ID, email address, name and address of the profile picture. Purpose: creating your account and signing you in; we show the name in invitations to your team and the profile picture in the sidebar.
• Google Search Console (permission “webmasters.readonly”): the list of your properties so that you can select one, and for the selected property clicks, impressions, click-through rate and average position per day, search query, page, country and device, as well as the email address of the connected Google account. Purpose: display on the Google Search Console page and in reports, comparison with your AI visibility, tasks in the AEO Strategy, suggestions in the Content area, prompt suggestions in Prompt Research and context for the AI assistant.
• Google Analytics 4 (permission “analytics.readonly”): the list of your properties and aggregated daily values of the selected property, details in section 4.6. Purpose: display on the Attribution page.

Storage: We store this data at Supabase in Frankfurt am Main. We store the access keys for Search Console and Analytics in encrypted form; they do not leave our servers. We retrieve some Search Console analyses directly from Google and keep them for up to three hours in the cache of our hosting provider Vercel.

Use and sharing: We use the data only to provide and improve the described features in your workspace for you. Our processors for hosting, database and background processes (Vercel, Supabase, Inngest; section 6) process it technically. If you use the AI assistant, the content features or Prompt Research, metrics and individual search queries from Search Console are sent to Claude as context (Anthropic, section 4.3); under its commercial terms, Anthropic does not use data from the API for training. We do not sell the data, do not use it for advertising, do not pass it on to data brokers and do not use it to train AI models, neither our own nor those of others. Beyond that, we only pass it on if the law requires it or you initiate it, for example by sharing a report with Search Console values. People at our company can only read the data with your consent, for security and abuse prevention, or if the law requires it.

Deletion and revocation: You can disconnect Search Console and Analytics at any time in the settings under Integrations. We then delete the connection, the access key and the stored daily values and revoke access at Google as soon as no other connection with the same Google account needs it any longer. Metrics that have already been included in Content Audit results (clicks and position of individual pages over 28 days) are retained until the workspace is deleted. Together with your account, we also delete the data from Sign in with Google. In addition, you can revoke access at any time in your Google account under the connections to third-party apps.

Limited Use: The use and transfer of information that growResonance receives via Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. The legal basis for the processing is Art. 6(1)(b) GDPR.

English summary: growResonance's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. growResonance measures how AI assistants such as ChatGPT, Gemini and Google AI Mode mention brands. Only after you grant access, it uses Google Sign-In (name, email address, profile picture) to create your account and sign you in, reads Google Search Console data (read-only) to show your search performance next to your AI visibility, and reads aggregated Google Analytics 4 data (read-only) to show visits from AI services. We do not sell this data, do not use it for advertising and do not use it to train AI models. You can disconnect at any time; the stored data is then deleted. The German version of this policy prevails.

4.6 Google Analytics 4

If you connect Google Analytics 4, we receive exclusively read access after you grant it at Google (permission “analytics.readonly”). We read the list of properties of your Google account so that you can select one, and aggregated daily values for the selected property: sessions, key events and revenue in total and per source that links to your website from AI services such as ChatGPT or Perplexity. If you have set up the origin per inquiry (section 4.7), we additionally read source, medium and landing page for the inquiry IDs of your forms. We do not retrieve profiles of individual visitors, user IDs or IP addresses. We store the email address of your Google account in order to display the connection; we store the access key in encrypted form at Supabase in Frankfurt am Main.

The sole purpose is to display these values in your workspace (Attribution page). The legal basis is Art. 6(1)(b) GDPR; insofar as the values contain data of third parties, we process it on your behalf under our Data Processing Agreement.

The commitments in section 4.5 apply to this data, including those on Limited Use. You can disconnect at any time in the settings under Integrations; we then delete the stored daily values. In addition, you can revoke access in your Google account under the connections to third-party apps.

4.7 Attribution: inquiries from your forms

If you connect a form on the Attribution page (Typeform, Tally or your own connection via webhook), your form tool sends each submission to an address known only to you. Of a submission, we only store the fields that you map: the answer to the question about the origin (such as “ChatGPT”), a value in euros, an inquiry ID, the name of the form and the time of receipt. We do not store the email address, only a non-reversible identifier calculated from it in order to recognize duplicate inquiries. We discard all other content, such as name, phone number or message, immediately after receipt. So that you can map fields, we remember the field names of the last submission with heavily shortened example values.

This data comes from visitors to your website. We process it exclusively on your behalf under our Data Processing Agreement; your company is the controller. You inform your website visitors in your own privacy policy and obtain any required consents.

For the origin per inquiry, we provide a code snippet that you embed yourself on your website or via Google Tag Manager. When a form is submitted, it generates a random inquiry ID, writes it into a hidden form field and passes it to your Google Analytics. The code snippet does not set any cookies and does not store anything in the browser; whether Google Analytics records the inquiry ID depends on the consent management of your website.

We automatically delete inquiries 24 months after receipt, or earlier if you delete the form source or your account. You can exclude individual inquiries at any time.

4.8 MCP and other connections

Via the MCP connection, you can connect your own AI clients (for example Claude or ChatGPT) and platforms such as Lovable, Bolt or Base44 to your workspace, by signing in with your growResonance account or with a key. When signing in, you choose the workspace and the permission of the connection: “Read only” or “Read and report back”. The connected application can then query the data of this workspace: visibility measurements, prompts and AI answers, competitors, cited sources, sentiment, researched prompts, figures from the connected Search Console, tasks, articles and findings of the Technical Audit. With “Read and report back”, it can additionally mark tasks as done and enter the live URL of an article. We transmit the queried data to the application you connected; you or its provider are responsible for the processing there. For each sign-in, we store the person, the workspace, the permission and the times of consent and of last use, and for each request, which tool was used when and for which workspace. We store keys and sign-in tokens only as a non-reversible hash; you can disconnect connections at any time. The legal basis is Art. 6(1)(b) GDPR.

4.9 Emails, error monitoring and background processes

We send emails about account, trial, billing, invitations and reports via Resend. Reports that you send to other people go to the addresses you specify. Sentry monitors errors on our servers in the EU, with account and workspace identifiers but without IP addresses. We orchestrate measurement runs, audits and reports via Inngest; identifiers, domains, URLs, prompts and intermediate results of these processes are stored there. The legal basis is Art. 6(1)(b) and (f) GDPR.

4.10 Former feature for Reddit and LinkedIn

Until September 2026, a feature found public posts on Reddit and LinkedIn on customers’ topics. The feature has been removed; no new posts are added. Publicly visible author names from stored posts are automatically pseudonymized after 30 days.

4.11 Partner area for sales partners

Sales partners sign in with their own access, which we only grant by invitation. For this, we store name, email address, password (only as a hash), sign-in times and a log of actions in the partner area. To settle the commission, we process the partner’s company details, contact person, address, tax number or VAT ID, account holder and IBAN, as well as the net amounts paid by the referred customers. Of its customers, the partner only sees company, status, monthly amount and its commission, no measurements and no usage. The legal basis is Art. 6(1)(b) GDPR.

If a partner reports a potential customer, we receive the company, website, contact person, email address, phone number and a note from the partner. In doing so, the partner confirms that the customer agrees to be contacted by us about an offer. We use this information to review the report, send an offer and assign the commission to the correct partner (Art. 6(1)(f) GDPR). We retain credit notes to partners in accordance with the retention periods under commercial and tax law.

5. Transparency notice on the use of AI (Art. 50 AI Act)

Artificial intelligence is not an add-on for us but the core of the service. So that you can always recognize what is machine-generated, we disclose its use here in one place, regardless of whether personal data is processed in the process. The basis is Art. 50 of Regulation (EU) 2024/1689 on artificial intelligence (AI Act), whose transparency requirements have applied since Aug 2, 2026.

5.1 Where we use AI

• Visibility measurement: We submit the prompts stored for a workspace to ChatGPT, Gemini and Google AI Mode (via their public user interfaces) and analyze the answers automatically. Mentions, metrics and their classification are the result of an AI system, not of a human analysis.
• Texts in the product: Prompt suggestions, analyses, recommendations, analysis reports, articles, revisions and the answers of the AI assistant are generated by AI models.
• Free visibility check: The process and the analysis are fully automated; the report that you receive by email is AI-generated.
• Our blog: The articles under /blog are created with AI and editorially reviewed before publication.

5.2 What this means for you

AI outputs are probabilistic results. They can be incomplete, outdated or simply wrong, and the same question can lead to different answers on two days; this is inherent in language models. Measurements of AI visibility are therefore samples at a point in time. Please check content that you reuse or publish beforehand (see § 6 of our Terms of Service).

On our public pages, you never talk to an AI chatbot. Inquiries that you send us via a form or by email are answered by a human. You can recognize the AI assistant in the platform as such.

No automated individual decision-making within the meaning of Art. 22 GDPR takes place: our AI generates analyses and texts; it does not make decisions that produce legal effects concerning you or similarly significantly affect you.

5.3 Which models are behind it

We do not train or operate our own models; instead, we use the models of Anthropic, OpenAI and Google (Vertex AI) and, via DataForSEO, the answers of ChatGPT, Gemini and Google AI Mode as their public user interfaces output them. The providers’ registered office, region and basis for transfer are listed in section 6, the data transmitted in section 4.3.

5.4 Human oversight

A person approves our blog articles before they are published. Content created in the product is published exclusively by our customers themselves; we do not publish anything automatically on their behalf. Anyone who publishes AI-generated texts from our product may be subject to their own labeling obligations; the review is the responsibility of the respective publishing party.

6. Recipients and subprocessors

We use the following service providers as processors. For providers based or processing data outside the EU, the basis for the transfer under Art. 44 et seq. GDPR is stated: standard contractual clauses of the European Commission of Jun 4, 2021 (Art. 46(2)(c) GDPR) and, where indicated, the adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR). We make contracts and evidence available to business customers on request.

• Supabase Inc. (USA): Database, sign-in, file storage.
  Data: All account, workspace and usage data, uploaded files, sign-in data. Place of processing: EU (Frankfurt am Main). Legal basis: Data processing agreement; EU standard contractual clauses (Module 2) for any access from the USA.
• Vercel Inc. (USA): Hosting of the website and the application; with consent, audience measurement (Web Analytics) and load time measurement (Speed Insights).
  Data: Connection data (IP address, time, page accessed, browser), content of requests to the application. Place of processing: EU (Frankfurt am Main) for server functions; worldwide network for delivering static files. Legal basis: Data processing agreement; EU standard contractual clauses (Module 2).
• Stripe Payments Europe Ltd. (Ireland): Payment processing, invoices, subscriptions.
  Data: Name, email address, billing address, VAT ID, payment data, contract data. Place of processing: EU; additionally Stripe, Inc. (USA). Legal basis: Data processing agreement (Stripe Data Processing Agreement); EU standard contractual clauses for US components.
• Anthropic PBC (USA): Language model Claude: analysis of the answers, Prompt Research, articles and content optimization, AI assistant and free visibility check.
  Data: Prompts, brand names, competitors, page and article content, messages to the AI assistant with workspace context. Place of processing: USA. Legal basis: Data processing agreement (Commercial Terms); EU standard contractual clauses (Module 2); certified under the EU-U.S. Data Privacy Framework.
• OpenAI (USA): Language model (ChatGPT) via the API: free visibility check; technical fallback for the visibility measurement.
  Data: Prompts and brand names; with batch processing, the requests are stored temporarily at OpenAI until they are evaluated. Place of processing: USA. Legal basis: Data processing agreement (Business Terms); EU standard contractual clauses (Module 2); certified under the EU-U.S. Data Privacy Framework.
• Google Cloud EMEA Limited (Vertex AI) (Ireland): Language model Gemini via the API: free visibility check; technical fallback for the visibility measurement.
  Data: Prompts and brand names. Place of processing: EU (region europe-west4, Netherlands). Legal basis: Google Cloud Data Processing Addendum.
• Google Ireland Limited / Google LLC (Ireland / USA): Google Search Console and Google Analytics 4 (only if you connect them), Sign in with Google (where offered), PageSpeed Insights for the Technical Audit, retrieval of website icons (favicons) for domains.
  Data: Search Console data of your website, aggregated Google Analytics data and the origin of individual inquiries (retrieved via inquiry IDs), Google account ID and email address when signing in, URLs of the checked pages, domain names. Place of processing: EU and USA. Legal basis: Data processing agreement or Google's data protection terms; EU standard contractual clauses (Module 2); Google LLC is certified under the EU-U.S. Data Privacy Framework.
• DataForSEO OÜ (Estonia): Search engine data: Google results and keyword data, answers from ChatGPT, Gemini and Google AI Mode via their public user interfaces for the visibility measurement, Google AI Mode for the free visibility check, Google top 10 for articles.
  Data: Search terms, prompts, article topics, domains, cities and markets; personal data only if you enter such data in prompts yourself. Place of processing: EU (Estonia); the company also names a location in Ukraine. Legal basis: Data processing agreement (DataForSEO Data Processing Agreement).
• Voyage AI (USA): Calculation of text vectors (embeddings) for keyword groups, internal linking, Content Audit and Prompt Research.
  Data: Search terms, page titles and short text excerpts of crawled pages, article sections, prompt suggestions; without workspace identifier. Place of processing: USA. Legal basis: Data processing agreement; EU standard contractual clauses (Module 2).
• Inngest Inc. (USA): Orchestration of background processes (measurement runs, audits, reports, email delivery).
  Data: Identifiers of accounts, workspaces and jobs, domains, URLs, prompts and intermediate results of the processes. Place of processing: USA. Legal basis: Data processing agreement; EU standard contractual clauses (Module 2).
• Resend Inc. (USA): Sending of emails: sign-in, invitations, trial and billing notices, reports (also to recipients you name), results of the visibility check, inquiries.
  Data: Email addresses, names, content and attachments of the emails. Place of processing: EU region for sending; provider based in the USA. Legal basis: Data processing agreement; EU standard contractual clauses (Module 2).
• Functional Software, Inc. (Sentry) (USA): Error monitoring of the servers.
  Data: Error messages with technical details, account and workspace identifiers; no IP addresses. Place of processing: EU (Frankfurt am Main). Legal basis: Data processing agreement; EU standard contractual clauses (Module 2).
• Frosthaus GmbH (Friendly Captcha) (Germany): Protection of the free visibility check against abuse, if enabled.
  Data: Technical characteristics of the request for the verification puzzle; the script is loaded via the jsDelivr network. Place of processing: EU. Legal basis: Data processing agreement.

WhatsApp and Calendly (only if you use their links, section 3.4) and the operators of websites whose content your browser loads directly (sections 3.3 and 4.4) are not processors but independent providers. We only pass data on to authorities if we are legally obliged to do so.

7. Retention period

• Account and workspace data: as long as the account exists. You can delete it at any time in the account settings. After the end of the contract, § 18 of the Terms of Service applies.
• Invoices and accounting records: ten years, other commercial and business letters six years (§ 147 AO, § 14b UStG).
• Records of consent to the Terms of Service and the Privacy Policy: for the duration of the contract and until the limitation periods expire.
• Inquiries from connected forms (section 4.7): 24 months after receipt, earlier if the form source or the account is deleted. Daily values from Google Search Console and Google Analytics 4: as long as the connection exists (section 4.5).
• Cookie consent logs: three years.
• Server logs at Vercel: a maximum of 30 days.
• Results of the free check: 30 days; pitch reports: until the expiry date, usually 30 days.
• Contact details from the check, pitch report, quote requests and waiting list: until you withdraw your consent or until the inquiry has been dealt with, at the latest after 24 months. We keep inquiries that have led to a contract with the contract documents.
• Information from requesting the guide for agencies (section 3.6): 24 months after the request, earlier on request.
• Author names from the former Reddit/LinkedIn feature: pseudonymized after 30 days.

8. Your rights

You have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
• Lodging a complaint with a supervisory authority (Art. 77 GDPR)

Right to object (Art. 21 GDPR): If we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defense of legal claims. You can object to processing for direct marketing purposes at any time without giving reasons.

Please send requests to home@growresonance.ai. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg; however, you can also contact any other supervisory authority.

We need the information marked as mandatory fields for registration and the contract in order to conclude the contract; without it, we cannot set up an account. All other information is voluntary.

9. Changes to this policy

We adapt this policy when the legal situation or features change. The version published on this page at the time applies.