Security

Encryption

• All traffic between your browser and our servers is encrypted with HTTPS (TLS).
• The database is encrypted at rest by our infrastructure provider, Supabase.
• Integration credentials (ikas client secret, Google and Meta access tokens) are additionally encrypted with AES-256 inside the database. The encryption key is kept in a separate server environment, not in the database, and these credentials are never sent back to your browser.
• Your payment details never reach us: payments are processed by Lemon Squeezy.

Isolation between brands

• Row Level Security rules apply to every table: a user can only access brands they own or were invited to.
• This isolation is verified with automated tests against a real database on every code change.

Account security

• You can enable two-factor authentication (TOTP) in Settings. When enabled, your data cannot be accessed without the second step even if your password is compromised; this is enforced on the server.
• Google and Meta connections request only the permissions they need; when you disconnect an integration, access is revoked on the provider's side as well.

Access by our team

• The admin panel is only reachable with two-factor authentication and from restricted networks.
• When viewing an account is needed for support, access lasts at most 15 minutes and is logged.
• Administrative actions are written to audit logs.

Backups and monitoring

• The database is backed up daily; backups are kept encrypted for 30 days and the restore process is tested.
• Unauthorized access attempts, unusual error spikes and failed requests are monitored automatically and reported to our team regularly.

AI analyses

• For AI analyses, your store's aggregate metrics (revenue, orders, traffic, funnel and, if connected, total ad spend and conversions per ad channel), top page paths and search queries are sent to the analysis provider.
• Personal data of your customers, such as names, emails, phone numbers or addresses, is not sent to AI providers.
• The AI providers we use do not use the data we send to train their models.

Data deletion

• You can delete your account in Settings. Your account and all brand data are permanently deleted 30 days after the request; you can cancel within that period.
• On a deletion request, any subscription is cancelled and access granted to connected integrations is revoked.
• You can download a copy of your data as JSON from Settings at any time.

Incident notification

• If a security incident affects your personal data, we notify the Turkish Personal Data Protection Board within 72 hours under Law No. 6698 (KVKK) and inform affected users without undue delay.

Reporting a vulnerability

If you believe you have found a security vulnerability in Growtyx, please email hello@growtyx.com with the subject "Security". Steps to reproduce and the potential impact help us a lot.

We will respond within 3 business days and keep you informed about the fix.

We will not take legal action against good-faith research that does not access, modify or delete user data and does not disrupt the service. Please do not disclose an issue publicly before it is fixed.

Out of scope

• Denial of service (DoS/DDoS) and load testing
• Social engineering, phishing and physical attacks
• Attempts to access other users' accounts or data
• Automated scanner output without a demonstrated impact

Service providers

We rely on third-party providers for infrastructure, payments, email and AI to deliver the service. Their categories are described in our Privacy Policy; to request the current list, write to hello@growtyx.com.