Privacy Policy

This policy explains how Growth Automation collects, uses, shares and protects personal information, and the choices and rights you have. It applies to:

• our customers and their users;
• business professionals whose details are in our database, or who receive outreach we run; and
• visitors to our websites.

Summary

1. Who we are and what this policy covers

1.1 Who we are. "Growth Automation", "we", "us" and "our" mean NAVU LLC, a Wyoming limited liability company doing business as Growth Automation, at 1309 Coffeen Ave, STE 1200, Sheridan, WY 82801, United States. Contact details are in section 15.

1.2 What this policy covers. It covers personal information we handle through:

• our websites (the "Site");
• the Growth Automation platform and related tools (the "Platform");
• our managed outbound services, such as prospect research, audience building, email and social-network outreach, reply handling, lead forwarding and meeting booking (together with the Platform, the "Services"); and
• our own sales, marketing, recruitment and supplier relationships.

1.3 Our role. Privacy laws use two roles:

• a "controller" (or "business") decides how and why information is used;
• a "processor" (or "service provider") handles information on someone else's instructions.

We act in both roles:

• We are the controller for information about Site visitors, our customers and their users, and the business professionals in our business contact database (the "GA Database"). This includes selecting contacts that match a customer's target audience, and providing them to the customer.
• We act for our customers, as their processor or service provider, when we run outreach and related services for them, for example:
• sending messages in the customer's name;
• handling and forwarding replies;
• booking meetings;
• processing information the customer gives us; and
• providing website visitor insights on the customer's own website (section 2.4).

The customer decides to contact you and what to say, and its own privacy policy also applies. If you received a message from one of our customers, you can contact that customer directly. Or contact us, and we'll pass your request on. - In all cases, we keep a record of people who have asked not to be contacted, so we can honour that request (section 11.1).

1.4 What this policy doesn't cover. Third-party websites and platforms, which have their own policies. It also doesn't cover what our customers do with information they hold independently of us.

2. Information we collect

2.1 Customers, users and prospective customers

• Contact and account details: name, work email address, phone number, job title, company, login details, and user role and permissions.
• Billing details: billing contact, billing address, tax identifiers, plan and payment history. Payment card details are handled by our payment processor. We don't store full card numbers.
• Onboarding and campaign information: company profile, target-customer profile, offers, messaging and brand materials, sender details, booking links, customer and do-not-contact lists, and public information from your website.
• Connected accounts: if you connect email, social-network, calendar or other accounts so we can run Services from them, we store the access tokens or connection details needed to operate them. We don't ask for your account passwords.
• Communications: emails, chats, meeting notes, support requests and feedback. If we record a call or meeting, we'll tell you at the start.
• Usage and device information: sign-ins, features used, actions taken, IP address, browser and device type, and diagnostic information that helps us find and fix problems.

2.2 Business professionals (the GA Database and people we contact for customers)

We collect information about people in their professional capacity. It may include:

• Professional identity: name, job title, seniority, department, employer, work location, links to professional profiles, and professional history published by the person or their employer.
• Business contact details: work email address, and work or mobile phone number.
• Company information: company name, website, industry, size, locations, technologies, hiring activity, news and public registrations.
• Business signals and insights:
• facts from public sources that are relevant to a business conversation, such as job advertisements, press releases, public posts, and public engagement with company pages and posts;
• insights we derive, such as how well a role matches a customer's offer, likely seniority and department, and whether an email address is likely to be deliverable.
• Interaction information: messages sent to you, whether you replied and what you said, how your reply was categorised, whether you asked not to be contacted, and meetings booked.
• Suppression information: the minimum needed to make sure you aren't contacted again after you ask us not to.

We don't intentionally collect sensitive information about business professionals, such as health, racial or ethnic origin, religion, sexual orientation, political opinions, union membership, precise location, government identifiers or financial account numbers. If you include sensitive information in a reply, we use it only to handle your message.

2.3 Website visitors

• Information you give us: for example, the details you enter in a form or when you book a call.
• Information collected automatically: IP address, browser and device type, pages viewed, referring website, time on page, and approximate location.
• Organisation identification: we use technology that matches IP addresses to organisations, so we can understand which companies visit our Site. If you fill in a form or book a call, we may link your earlier visits to your details.
• Cookies and similar technologies: see section 10.

2.4 Visitors to our customers' websites

Some customers use our website visitor insights service. For them, we provide technology, operated by us or our partners, that the customer places on its own website.

• What it does: it identifies the organisations that visit. Where the law permits, it may also identify individual business professionals.
• What we do with it: we use the results only to provide Services to that customer, such as adding relevant business contacts to its outreach.
• Who gives notice: the customer is responsible for telling visitors to its website about this technology, and for obtaining any consent required.
• Opting out: you can ask us to stop at any time (section 11.1).

2.5 Other people

We collect information from job applicants, suppliers and partners, and people who contact us, to manage those relationships.

3. Where we get information

• From you: when you sign up, fill in a form, book a call, reply to a message or talk to us.
• From our customers: lists, CRM information, do-not-contact lists, user invitations and campaign instructions.
• From third-party business data providers: companies that license professional contact and company information.
• From public sources: company websites, public registers, job boards, news and press releases, and public professional profiles, posts and engagement.
• From our customers' websites: where a customer uses our website visitor insights service (section 2.4).
• From verification and deliverability services: services that check whether an email address can receive mail.
• From platforms you interact with: for example, your reply to an email or a social-network message.
• From our service providers: for example, analytics, scheduling and payment providers.
• Created by us: categorisations, relevance scores and other insights.

For most people in the GA Database, the source is one or more of the business data providers and public sources above; some records also come from our customers. If you ask, we'll tell you where we got your information, as far as our records show.

4. How and why we use information

About legitimate interests. "Legitimate interests" is a legal basis that lets an organisation use personal information without asking permission first, as long as its reason is genuine and doesn't unfairly override the interests of the people concerned. We rely on it for business-to-business prospecting, which is widely recognised as a legitimate purpose. To limit the impact on you:

• we focus on work-related information;
• we explain how we operate;
• we make it easy to object; and
• we keep records accurate.

You can ask us for more information about our assessment.

5. AI, automated processing and profiling

5.1 What we use AI for. We use AI tools, including models from third-party providers, to help us:

• research companies and roles;
• draft business messages;
• categorise and respond to replies;
• summarise conversations;
• prioritise prospects; and
• answer questions in our Platform.

5.2 Human involvement. Customers approve campaign strategy and messaging, and our team oversees how our automated tools are used. You can ask to speak with a person at any time.

5.3 No significant automated decisions. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects, such as decisions about employment, credit, housing, insurance or access to essential services. Deciding which business professionals receive a business message, or how a reply is routed, isn't that kind of decision. You can object at any time (section 11).

5.4 Automated decisions. Our software uses professional identity and role, company information, public business signals and interaction information to make, or help make, decisions such as:

• which business contacts are offered to a customer or included in a campaign;
• the order in which they're contacted; and
• how replies are categorised and routed.

Some of these steps are fully automated; others are reviewed by our team or the customer. We don't expect any of them to significantly affect anyone's rights or interests, but we describe them for transparency.

5.5 AI providers. We share with AI providers only what's needed for the task. We choose providers and settings intended to prevent them from using that information to train their general-purpose models. We don't sell personal information for AI training.

6. How we share information

• With our customers. We provide contact information and insights from the GA Database to customers who use our Services for business-to-business sales and marketing. When we run outreach for a customer, it can see the messages sent, replies received and lead details.
• With service providers that process information on our behalf, such as:
• hosting, database and infrastructure;
• email, messaging and social-network connectivity;
• data, enrichment and verification;
• AI;
• analytics and monitoring;
• payments, scheduling and accounting;
• communication and productivity tools.

They may use the information only to provide services to us. - With platforms you interact with, such as email and social-network services, which handle information under their own policies. - With professional advisers, such as lawyers, accountants, auditors and insurers. - For legal reasons: to comply with the law or a lawful request, to enforce our agreements, or to protect the rights, safety and security of our customers, the public or us. - In a business transfer: as part of a merger, acquisition, financing or sale of assets. - With your consent or at your direction.

Information customers give us. We use information a customer gives us to provide the Services to that customer, and as our agreement with that customer allows.

De-identified and aggregated information. We may create and use statistics that don't identify anyone. We don't try to re-identify such information.

7. "Selling", "sharing" and targeted advertising (US state law)

• Account information: we don't sell or share the personal information of our customers, users or Site visitors.
• The GA Database: we give our customers business contact information, professional information and related insights in exchange for payment, so they can identify and contact prospective business customers. California and some other US states treat this as a "sale" of personal information. We have sold these categories to our customers in the past 12 months.
• Targeted advertising: we don't use the Site or the Platform to serve targeted (cross-context behavioural) advertising.
• Minors: we don't knowingly sell or share the personal information of anyone under 16.
• Your right to opt out: email privacy@growthautomation.ai with the subject "Do Not Sell or Share My Personal Information", or reply to any of our messages.

8. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, then delete or de-identify it. How long that is depends on:

• the type of information and why we hold it;
• whether we still have a relationship with you or the customer concerned;
• whether the information remains accurate and useful; and
• what the law requires (for example, tax and accounting records), or what we need to establish or defend legal claims.

In general:

• customer account and billing records are kept for the life of the account and as long afterwards as the law requires;
• customer campaign information is kept for the life of the customer relationship and a reasonable period afterwards, unless the customer asks us to delete it sooner;
• GA Database records are kept while they remain accurate and useful;
• website analytics and diagnostic information are kept for limited periods;
• backups are overwritten on a rolling basis; and
• suppression records are kept in minimal form for as long as needed to keep honouring your request not to be contacted.

9. How we protect information

We use administrative, technical and physical safeguards designed to protect personal information, appropriate to its nature and the risks involved. They include:

• encryption;
• access controls;
• separation of each customer's data;
• monitoring; and
• confidentiality obligations for the people who handle it.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we'll notify you and the relevant regulators as the law requires.

10. Cookies and similar technologies

10.1 What we use. Our Site and Platform use cookies and similar technologies (such as local storage, pixels and scripts) for these purposes:

• strictly necessary: to deliver the Site and Platform securely and keep you signed in;
• preferences: to remember settings such as display theme;
• analytics: to understand how the Site is used;
• organisation identification: to understand which organisations visit;
• embedded tools: such as meeting scheduling; and
• diagnostics: to find and fix problems in the Platform.

Some of these are set by third-party providers acting for us. We don't use advertising cookies on the Platform.

10.2 Your choices. You can block or delete cookies in your browser settings, and use opt-out tools offered by analytics providers. Blocking non-essential cookies won't stop the Site working.

10.3 Browser signals. There's no agreed standard for browsers' "Do Not Track" signals, so we don't respond to them. You can opt out of the sale of your information as described in section 7.

11. Your choices and rights

11.1 Stop outreach, or remove yourself from our database

• How: reply to any message from us (for example "unsubscribe" or "remove me"), or email privacy@growthautomation.ai.
• Stopping outreach: we'll stop the outreach we run to you and exclude you from future contact lists we provide. We'll do this promptly, and within the time the law requires.
• Removal from the GA Database: we'll delete your record and keep only what we need to make sure you aren't added back.
• Customers who received your details: they may hold your information independently, so you may also want to contact them. Where practical, we'll let them know about your request.

11.2 Your rights

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you, and get a copy (in some places, a portable copy);
• correct inaccurate information;
• delete your information;
• restrict or object to our processing (for direct marketing, see the right to object at the top of this policy);
• opt out of the sale or sharing of your information, targeted advertising, and certain profiling;
• withdraw consent, where we rely on consent;
• in some US states, appeal our decision on your request (section 11.4);
• complain to us and to a privacy regulator; and
• not be treated differently for exercising your rights.

Where the law doesn't give you these rights, you can still ask, and we'll consider your request. These rights are subject to legal exceptions; for example, we may keep information we need to comply with the law or defend legal claims. If your request is about a message one of our customers asked us to send, see section 11.5.

11.3 How to make a request

Email privacy@growthautomation.ai, or reply to any message we sent you. You don't need an account.

• Verification: we'll ask for enough information to confirm who you are.
• Authorised agents: someone can make a request for you if they have your written permission or a power of attorney.
• Timing: we'll respond within the time the law that applies to you requires, and tell you if we need more time.
• Cost: requests are free, unless they are clearly unfounded or excessive.

11.4 Appeals (US)

If we decline your request, you can appeal by replying to our decision, or by emailing privacy@growthautomation.ai with "Appeal" in the subject line. If you're not satisfied with the outcome, you can contact your state Attorney General.

11.5 Requests about customer data

If your request is about information we process for a customer, we'll pass it to that customer and help them respond. We'll also stop our own outreach to you, as described in section 11.1.

11.6 Complaints

If you have a privacy concern or complaint, please contact us first (section 15). We'll acknowledge it, look into it, and respond in writing. If you're not satisfied, you can complain to a regulator (section 12).

12. Information for specific regions

12.1 European Economic Area, United Kingdom and Switzerland

• Controller: NAVU LLC (Growth Automation), for the purposes described in section 1.3.
• Legal bases: see section 4. Where we rely on legitimate interests, you can object at any time. If the objection is to direct marketing, we'll stop.
• Sources: see section 3. Some sources are publicly accessible; others aren't.
• Rights: access, rectification, erasure, restriction, portability, objection and withdrawal of consent (section 11). You can also complain to your local data protection authority.
• International transfers: see section 13.
• Do you have to give us information? Customers must give us what we need to set up and bill an account. Business professionals don't have to give us anything.

12.2 United States

California: notice at collection and categories of information. In the past 12 months, we've collected the categories below. We use them for the purposes in section 4, and keep them according to the criteria in section 8.

Your California rights: know and access, delete, correct, opt out of sale or sharing, and non-discrimination (section 11). We don't use sensitive personal information for purposes that would give you a right to limit it. We don't offer financial incentives for personal information.

Other US states: several other states have privacy laws. Many don't cover information about people acting in a business role. Where they apply, you have the rights described in section 11, including appeals.

Nevada: you can ask us not to sell your covered information by emailing privacy@growthautomation.ai.

12.3 Australia

We handle personal information in line with the Australian Privacy Principles.

• Kinds of information, how we collect and hold it, and why: see sections 2 to 4. We hold information electronically, including with service providers.
• Direct marketing: you can ask us at any time to stop using or disclosing your information for direct marketing, including marketing by our customers, and to tell you where we got your information. Our direct marketing messages include a way to opt out.
• Anonymity: you can deal with us anonymously or using a pseudonym where that's practical.
• Access and correction: see section 11.
• Overseas disclosure: we're likely to disclose personal information to recipients overseas (section 13).
• Automated decisions: see section 5.4.
• Complaints: see section 11.6. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.

12.4 Canada (including Quebec)

• Our Privacy Officer is responsible for our compliance (section 15).
• Personal information is stored and processed outside Canada, mainly in the United States, and may be accessible to authorities there.
• We use automated tools and profiling as described in section 5. Quebec residents can ask about the personal information and main factors used.
• You can access and correct your information and withdraw consent (section 11). You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

12.5 New Zealand

When we collect information about you from someone else, this policy explains:

• that we collected it, and why;
• who will receive it;
• who we are; and
• your rights to access and correct it.

You can complain to the Office of the Privacy Commissioner.

12.6 Other countries

If you live elsewhere, you can exercise the rights your local law gives you by contacting us (section 15). Where local law requires a grievance or privacy officer, our Privacy Officer fills that role.

13. International transfers

We are a US company, and our main systems are hosted in the United States. Our personnel and service providers are located in a number of countries, so personal information may be accessed from, or processed in, countries other than yours, including the United States and countries in Europe and Asia. These countries may have different privacy laws.

When we transfer personal information out of the EEA, UK or Switzerland, we use safeguards recognised by those laws, such as the European Commission's Standard Contractual Clauses (with the UK and Swiss supplements where relevant), or a recipient's certification under an approved framework. You can ask us for more information about these safeguards. When we disclose personal information overseas, we take reasonable steps to make sure the recipient protects it in line with the laws that apply to us.

14. Children, third-party links and Google data

Children. Our Services are for businesses and aren't directed at children. We don't knowingly collect personal information from anyone under 16. If we learn we have, we'll delete it.

Third-party websites and platforms. Our Site and messages may link to other websites and platforms. Their privacy practices are their own.

Google user data. Where our Services use Google APIs, Growth Automation's use, and transfer to any other app, of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

15. Contact us

Privacy Officer NAVU LLC (Growth Automation) 1309 Coffeen Ave, STE 1200 Sheridan, WY 82801, United States Email: privacy@growthautomation.ai

16. Changes to this policy

We may update this policy from time to time, and we'll post the new version with a new "Last updated" date. If we make material changes, we'll take reasonable steps to let customers know. Where the law requires your consent to a change, we'll ask for it.