GrowthSim (“we”, “us”, “our”) is a financial stress-testing platform for digital agencies. We help you simulate how your business responds to demand shocks, team changes, and cash flow pressure using Monte Carlo analysis, AI-powered recommendations, and scenario modelling.
This document explains exactly what data we collect, why, how we protect it, who we share it with, and what rights you have. We’ve written it to be transparent, not to bury things in legal language.
1. Data Classification Framework
We classify all data into five tiers. Each tier has different rules for access, retention, encryption, and whether it can be used for AI model training. This framework governs every decision we make about your data.
| Tier | What it includes | AI training? | Retention | Encryption |
|---|---|---|---|---|
| 1. Account Data | Name, email, avatar, password hash, OAuth tokens, session data | Never | Until account deletion + 30 days backup | At rest + in transit |
| 2. Content Data | Questionnaire responses, simulation parameters, chat messages | Only with explicit opt-in consent | User-controlled (deletable) | At rest + in transit |
| 3. Derived Data | Simulation results, scores, AI analysis, risk assessments, Monte Carlo statistics | Only with explicit opt-in consent | Tied to source content; deleted when source is deleted | At rest + in transit |
| 4. Usage Data | Feature usage events, click patterns, session recordings, error logs | Aggregated only | 13 months | In transit |
| 5. Anonymised Data | Aggregate benchmarks, industry statistics, anonymised training datasets | Yes (no longer personal data) | Indefinite | Optional |
2. Data We Collect
2.1 Account Data (Tier 1)
Data that identifies you or your organisation.
| Field | Description | Source | Legal basis |
|---|---|---|---|
| Full name | Your display name | You provide | Contract |
| Email address | Login credential and contact | You provide | Contract |
| Profile image | Avatar URL | You provide or Google OAuth | Contract |
| OAuth credentials | Google account link (encrypted access/refresh tokens) | Google OAuth | Contract |
| Session data | Session token, IP address, user agent, expiry (7-day sessions) | System-generated | Contract |
| Organisation profile | Business name, slug, logo, industry, revenue range, employee count, years operating | You provide | Contract |
| Team membership | Role (owner/member), invitation status, last active timestamp | You/admin provide | Contract |
2.2 Content Data (Tier 2)
Business data you actively input into GrowthSim. This is the most sensitive category This is the most sensitive category as it contains your financial and operational details.
Questionnaire Data (60+ fields)
Customer Acquisition & Sales
- Weekly sales-qualified leads (SQLs), with min/max volatility bounds
- Close rate (percentage)
- Average order value (contract revenue)
- Marketing demand capacity (“barely”, “2x”, “5x-10x”, “50x”)
- Demand spike response behaviours (wait, price, quality, hire)
Team Composition
- Staff entries: role, headcount, hours per project, monthly salary, hiring cost, management flag, PTO days, PTO peak months
- Freelancer entries: role, headcount, hours per project, hourly rate, hiring cost, availability days, peak unavailability months
- Management entries: role, headcount, monthly salary, PTO days, PTO peak months
- Overhead costs: named monthly recurring expenses (e.g. “Office rent”, “Software licences”)
Operational Capacity
- Days per assignment, max concurrent projects
- Over-capacity behaviour (deadlines slip, quality drops, overtime, stop sales)
- Productive hours per week, unsustainable hours threshold, max overtime weeks
- Support tickets per client per month, average resolution time, senior escalation rate
Financial & Cash Flow
- Payment terms (upfront, 50/50, net-30, net-60, custom)
- Gross margin percentage
- Prepaid cost percentage
- Burden multiplier (tax/benefits/equipment overhead on salary)
- Overtime fee percentage
- Credit line limit and interest rate
Business Context
- Biggest bottleneck (self-identified)
- Agency type, team location
- Economy correlation sensitivity
- Revenue concentration (top client %, top 3 clients %)
- Key person dependencies count
- Historical turnover (staff and freelancer departures in last 12 months)
- Average sick days per year
- Hiring timeline (search weeks, interview weeks, onboarding weeks)
- Attrition notice period (min/max days)
- Monthly revenue history (for seasonality detection)
- PTO conflict groups (roles that can’t overlap)
AI Chat Messages
- Every message you send to the AI copilot
- Every AI response (text content, tool invocations, evidence annotations)
- Chat session metadata (mode, title, linked simulation)
- Tool call results (queries against your own simulation data)
2.3 Derived Data (Tier 3)
Data generated by processing your content data. Your Organisation owns this data. GrowthSim retains the right to use anonymised and aggregated patterns derived from Derived Data to improve our models and the Service, provided such data has been irreversibly anonymised and cannot be traced back to your Organisation. See our Terms of Service, Section 9 for full details on intellectual property and data ownership.
Simulation Results (Monte Carlo output)
- Risk scores (0-100): scale readiness, delivery stability, team capacity, financial resilience, support readiness
- Daily metrics (365 data points): cash balance, revenue, costs, profit, backlog, team utilisation, ticket wait time, hiring pipeline, each with 10th/50th/90th percentile bands
- Monte Carlo statistics: mean/stddev final cash, Value-at-Risk, Conditional VaR, probability of cash crunch, histogram of outcomes
- Events: demand spikes, SLA breaches, cash crunches, team overload (with probability, severity, and financial impact)
- Sensitivity analysis: which input parameters have the most impact on outcomes
- AI-generated insights: categorised recommendations by severity and role
- Worst-run autopsy: detailed trace of stochastic draws and decisions in worst/median/best iterations
- Cash insights: minimum safe balance, recommended reserves, risk level
Simulation Configuration
- Scale factor, duration, start month/year, random seed
- Monte Carlo mode (quick/full), iteration count
- What-if scenario metadata (original values, modifications, origin marker)
- Threshold parameters (backlog warning, SLA breach, cash crunch, team overload)
2.4 Usage & Telemetry Data (Tier 4)
How you interact with GrowthSim. Only collected with your analytics consent.
| Event | What we track | Properties |
|---|---|---|
| session_started / ended | When you open and close the app | Timestamp, session ID |
| sim_started / completed / failed | Simulation lifecycle | Simulation ID, status |
| questionnaire_started / saved | Form progress | Questionnaire ID, status |
| ai_chat_message_sent / received | Chat interaction volume | Session ID (not message content) |
| Page views, clicks, scrolls | Navigation patterns (autocapture) | URL path (not content) |
| Session recordings (30% sample) | Screen replay with all text and inputs masked | Interaction patterns only |
Privacy protections on usage data
- IP tracking disabled
- All text content masked in session recordings
- All form inputs masked in session recordings
- Rage click and dead click detection (UX quality, not surveillance)
- Client-side deduplication (1.2s window)
2.5 Billing Data
| Data | Description | Stored by |
|---|---|---|
| Subscription status | Plan (free/pro/max/mad_max), billing interval, seat count, trial dates | GrowthSim + Stripe |
| Token ledger | Allocated tokens, used tokens, on-demand usage, AI budget/cost (in microcents) | GrowthSim |
| Token transactions | Per-deduction audit trail: type, amount, cost, reference to simulation or chat | GrowthSim |
| Stripe metering events | On-demand token consumption, AI token usage (per-model input/output) | Stripe |
| Payment information | Processed by Stripe — we never see or store your card number | Stripe only |
3. How We Use Your Data
| Purpose | Data tiers | Legal basis | Details |
|---|---|---|---|
| Providing the service | Tiers 1-3 | Contract (Art. 6(1)(b)) | Running simulations, generating results, powering the AI copilot, managing your account and team |
| Processing payments | Tier 1 + Billing | Contract (Art. 6(1)(b)) | Subscription management, token metering, invoicing via Stripe |
| Product improvement | Tier 4 (aggregated) | Legitimate interest (Art. 6(1)(f)) | Understanding feature usage to improve the product. You can opt out via analytics consent |
| AI model training | Tier 5 only (anonymised) | Consent (Art. 6(1)(a)) | Training and improving GrowthSim’s AI models. Requires separate, explicit opt-in |
| Security & fraud prevention | Tiers 1, 4 | Legitimate interest (Art. 6(1)(f)) | Rate limiting, bot detection, CSP violation monitoring, session security |
| Legal obligations | Billing data | Legal obligation (Art. 6(1)(c)) | Tax records, billing history (7-year statutory retention) |
4. AI & Machine Learning
This section is critical. We believe AI-powered financial benchmarking will be transformative for agencies. To build those models, we need data. But we will never take that data without your explicit, informed, freely-given consent.
4.1 AI Chat Copilot (Inference \u2014 No Training)
When you use the AI chat copilot, your messages and simulation context are sent to Anthropic’s Claude API for real-time analysis. This is inference, not training:
- Your data is processed for the immediate request only
- Anthropic does not retain your data beyond request processing
- Anthropic does not use your data to train their models
- We have a Data Processing Agreement with Anthropic enforcing zero-retention
- Prompt caching (1-hour ephemeral TTL) improves performance but data is not persisted
What the AI copilot can access
- Your simulation results, scores, metrics, and events
- Your questionnaire inputs (summarised in system prompts)
- Your current page context (which dashboard page you’re on)
- Your billing plan and token balance
- Previous messages in the current chat session
What the AI copilot cannot access
- Other users’ data
- Other organisations’ data
- Raw data from other businesses on the platform
4.2 AI Model Training (Separate Consent Required)
AI model training is entirely separate from using the AI copilot. You can use the copilot without consenting to training. Refusing training consent does not limit any product functionality.
What we want to build
Over time, we aim to build financial benchmarking models that can tell agencies: “Businesses like yours typically have margins of X%, churn rates of Y%, and are most vulnerable to Z.” This requires learning from aggregated patterns across many businesses.
How it works
- You opt in via a standalone checkbox (not bundled with Terms of Service)
- Your Tier 2 (content) and Tier 3 (derived) data enters an anonymisation pipeline
- The pipeline strips all direct identifiers (business name, user name, email)
- Financial figures are generalised to ranges (e.g. revenue $847,329 → $500K-$1M band)
- Data is aggregated into cohorts (industry × size × region) with a minimum cohort size of 20
- Only the resulting Tier 5 anonymised data is used for training
- Raw, identifiable business data never enters a training pipeline
Your controls
- Opt-in only: The training consent checkbox is unchecked by default
- Not a condition of service: You can use every GrowthSim feature without opting in
- Withdraw any time: Toggle off in account settings; we stop using your data in future training
- Transparency: We will publish what anonymisation techniques we use and what data categories are included
- No retroactive use: We will not train on your data from before you consented
What “anonymised” means, specifically
We follow the Article 29 Working Party Opinion 05/2014 standard. Data is only considered anonymised when it passes all three tests:
- Singling out: No individual business can be isolated from the dataset
- Linkability: No two records can be linked to the same business
- Inference: No business attributes can be deduced from remaining data
We apply: k-anonymity (k ≥ 5), suppression of outlier businesses, generalisation of financial figures to bands, and aggregation into cohorts of 20+. Sole traders and very small agencies receive additional protection because their business data may constitute personal data under GDPR.
5. Third-Party Services (Sub-Processors)
We share your data with these third-party services. Each operates under a Data Processing Agreement.
| Service | Role | Data shared | Retention | DPA status |
|---|---|---|---|---|
| Stripe | Payment processor | Email, name, Stripe customer ID, subscription plan, seat count, metered usage events | Per Stripe policy + 7yr statutory | Required |
| Anthropic | AI processor | Chat messages, simulation context summaries, page context (per-request only) | Zero retention (per-request processing only) | Required |
| Mixpanel | Analytics processor | User ID, event names, event properties, session recordings (masked). No simulation data, no questionnaire data, no chat content | Per Mixpanel retention (typically 2 years) | Required |
| Identity provider | OAuth redirect (Google sends us: email, name, avatar) | N/A (authentication only) | Per Google terms | |
| Resend | Email delivery | Recipient email, team name, inviter name (for invitation/magic link emails) | Transient (delivery only) | Required |
| Hosting provider | Infrastructure | All data at rest (encrypted) | Duration of service | Required |
| Database provider | Infrastructure | All PostgreSQL data (encrypted) | Duration of service | Required |
What we do NOT share with third parties
- Your raw questionnaire responses (financial inputs)
- Your simulation results or scores
- Your AI chat conversation history
- Your billing transaction details
- Any data for advertising or commercial resale purposes
6. Data Security
Technical Measures
- Encryption in transit: TLS 1.2+ on all connections (browser ↔ server, server ↔ APIs, server ↔ database)
- Encryption at rest: Database encrypted at rest; OAuth tokens encrypted with AES-256-GCM
- Password hashing: Industry-standard hashing via better-auth (never stored in plain text)
- Session security: 7-day expiry, 24-hour refresh cycle, secure cookies (HttpOnly, SameSite=Lax, Secure prefix)
- CSRF protection: Origin header validation, Fetch Metadata checks, first-login protection
- Rate limiting: Per-user and per-business rate limits on all sensitive endpoints (auth, simulations, AI chat)
- Content Security Policy: Strict CSP headers with violation reporting
- Role-based access control: Owner/member roles; business-scoped data isolation
- Webhook security: Stripe webhooks verified via signature; idempotent processing prevents double-charges
Organisational Measures
- Access controls: Only authorised team members in your workspace can view your data
- Infrastructure: EU-based servers; your data does not leave the European Economic Area
- Incident response: We will notify affected users within 72 hours of discovering a data breach, as required by GDPR Article 33
7. Your Rights (GDPR)
As a data subject under GDPR, you have the following rights:
| Right | What it means | How to exercise |
|---|---|---|
| Access (Art. 15) | Request a copy of all data we hold about you | Account Settings → "Download my data" (JSON export) |
| Rectification (Art. 16) | Correct inaccurate personal data | Edit in Account Settings or email us |
| Erasure (Art. 17) | Delete your account and all associated data | Account Settings → "Delete account" (cascades to all data) |
| Restriction (Art. 18) | Restrict processing while a dispute is resolved | Email [email protected] |
| Portability (Art. 20) | Receive your data in a machine-readable format | Account Settings → "Download my data" (JSON) |
| Object (Art. 21) | Object to processing based on legitimate interest | Email [email protected] or toggle off in Settings |
| Withdraw consent (Art. 7(3)) | Withdraw consent for analytics or AI training at any time | Account Settings → Privacy toggles |
Account deletion cascade
When you delete your account, we permanently remove:
- Your user profile, sessions, and OAuth credentials
- All chat sessions and messages
- All questionnaires and simulation results (if you are the sole owner)
- All token transactions and billing records (except statutory retention)
- Your Mixpanel profile (via GDPR deletion API)
- Your Stripe subscription is cancelled
Anonymised data exception: If you previously consented to AI training, data that has already been irreversibly anonymised and incorporated into aggregate datasets (Tier 5) cannot be deleted because it is no longer personal data and cannot be traced back to you. This is consistent with GDPR Recital 26.
8. Data Retention
| Data category | Retention period | Reason |
|---|---|---|
| Account data | Until account deletion + 30 days | Service provision + backup recovery window |
| Questionnaire data | Until you delete it | Service provision (you control) |
| Simulation results | Until you delete them or delete your account | Service provision (you control) |
| AI chat history | Until you delete sessions or delete your account | Service provision (you control) |
| Analytics events | 13 months (local backup); per Mixpanel retention (external) | Product improvement (legitimate interest) |
| Session recordings | Per Mixpanel retention policy | UX improvement (with consent) |
| Billing records | 7 years after account closure | Legal/tax obligation |
| Consent records | Indefinite (append-only audit trail) | Legal accountability (proving consent was given/withdrawn) |
| Redis stream data | Ephemeral (auto-expires after processing) | Inter-service transport only |
| Rate limit buckets | Minutes (auto-reset per window) | Abuse prevention |
| Anonymised aggregates | Indefinite | No longer personal data under GDPR |
10. Our Role Under GDPR
| Processing activity | Our role | Explanation |
|---|---|---|
| Running simulations on your data | Data Processor | We process your data on your behalf, per your instructions |
| Providing the AI copilot | Data Processor | Your data is processed for inference only, at your request |
| Product analytics | Data Controller | We determine the purpose (product improvement) — consent-gated |
| AI model training | Data Controller | We determine the purpose (model improvement) — separate consent required |
| Billing and payments | Data Controller | We determine billing logic; Stripe processes payments |
Data Processing Agreement (DPA): Available on request for organisations that require it. Contact [email protected].
11. Integration Data (Future)
This section is a placeholder. When we launch integrations with third-party platforms (CRM, HR, accounting), this section will be replaced with a dedicated Integration Data Addendum covering:
- What data is pulled from each integration and why
- Consent requirements per integration (separate from core product consent)
- How third-party data (your clients’ and employees’ data) is handled
- Data classification tier for integration data
- Retention and deletion policies per integration
- Updated sub-processor list
Each integration will have its own data card displayed during the connection flow, disclosing exactly what fields are accessed before you authorise.
We will not launch any integration without updating this policy first.
12. Changes to This Policy
We will notify you of changes as follows:
- Material changes (new data categories, new processing purposes, new sub-processors): 30 days advance email notice + in-app banner
- Non-material changes (clarifications, formatting, typo fixes): Updated effective date + changelog below
- New consent-required processing: Explicit opt-in flow before activation. You will never be opted into new processing without action
Changelog
| Date | Version | Change |
|---|---|---|
| Launch date | 1.0 | Initial publication |
13. Contact
For any questions about this policy, your data, or to exercise your rights:
- Email: [email protected]
- Response time: Within 48 hours for general queries; within 30 days for formal data subject requests (as required by GDPR)
- Supervisory authority: You have the right to lodge a complaint with your local data protection authority if you believe we are processing your data unlawfully