Legal

Privacy Policy & Cookie Policy

Effective date: 23 October 2026

In short

  • We keep what we need to run your account, check your site, write your articles and posts, and bill you.
  • Stripe handles payments. We never see your card number.
  • Analytics and advertising tools load only after you accept them in the cookie banner. You can change your choice at any time in Cookie settings.
  • We do not sell your personal data.
  • You can ask for a copy of your data, or for it to be corrected or deleted: write to kiryl@itgrows.ai.

1.Who we are

ItGrows.ai is operated by Magiscan Inc., 919 North Market Street, Wilmington, DE 19801, USA. We are the controller of the personal data described here. This policy covers the itgrows.ai website and both of our products: AI visibility for businesses, and LinkedIn & X posts.

If you are in the EU or UK, contact us at kiryl@itgrows.ai.

2.What we process, and why

Your account

What
Your email address and name; how you sign in: with a code sent by email, or with Google or LinkedIn, which give us your name and email; a password hash if you set a password; your plan and its status; your Stripe customer id.
Why
To create and run your account, sign you in and know which plan you have.
Legal basis
To provide the service you signed up for: our contract with you.

Your website, for AI visibility

What
The site address you enter, and the public pages of that site we fetch, such as the home page, robots.txt and sitemaps. From them we note what the business does, its brand names, language and city, and the questions its buyers ask.
Why
To run the quick check, the detailed report and the weekly re-check, and to check the site the way AI crawlers see it.
Legal basis
To provide the service you signed up for: our contract with you. For the quick check without an account: our legitimate interests in giving you the result you asked for.

The AI assistants’ answers

What
The questions we ask, the answers ChatGPT, Claude, Gemini and Perplexity give, the businesses they name and the sites they cite. These are stored per website, so every account that adds the same site sees the same measurements. Answers are about businesses but can mention people by name.
Why
To show you whether, and how, the assistants name your business, and what changed since last time.
Legal basis
To provide the service you signed up for: our contract with you.

The quick check and the free post preview

What
For the quick check: the site address you enter and your IP address. For the free post preview on the LinkedIn & X page: your IP address; what you type goes to the AI model that writes the preview and is not stored.
Why
To limit the number of quick checks and previews per visitor and to prevent abuse. IP addresses are removed after 90 days.
Legal basis
Our legitimate interests in keeping the quick check and the preview available and safe.

Articles and access to your site

What
The articles we write for you, your edits, the articles you publish early or stop, cover images, the launch checklist for your site and the steps you mark as done. To publish, we store the access you give us: a WordPress username and application password, a Shopify or Webflow token, or the settings of the blog we host for you.
Why
To write, show you and publish the articles on your plan.
Legal basis
To provide the service you signed up for: our contract with you.

LinkedIn & X

What
The access tokens you grant when you connect an account, and for X also refresh tokens; account identifiers: your LinkedIn member or organisation id and page name, your X user id, username and display name; your topics, drafts, edits, images and published posts; your posts’ statistics: impressions, likes, comments, shares.
Why
To draft posts in your voice, publish the posts in your queue, and show how they perform. When you disconnect an account, its tokens are deleted at once. You can also revoke access in LinkedIn’s or X’s own settings.
Legal basis
To provide the service you signed up for: our contract with you.

Payments

What
Stripe collects your card details; we never see or store your card number. We receive the payment status, plan, amounts and invoices. For LinkedIn & X subscriptions, if you came from our ad and accepted cookies, the Google Ads click id is saved with the subscription.
Why
To charge for the plan you chose, keep billing records and know which ads lead to paying customers.
Legal basis
To provide the service you signed up for: our contract with you. Keeping billing records: legal obligation. The ad click id: your consent, given in the cookie banner.

Emails

What
Your email address and the emails we send through Resend: sign-in codes, report-ready emails, weekly updates on the plan, notices that articles are ready to review, and account and trial emails for LinkedIn & X, which can include an offer.
Why
To run the service and keep you informed about your account. Every weekly update has an unsubscribe link; your report stays in your account.
Legal basis
To provide the service you signed up for: our contract with you. Trial reminders and offers: our legitimate interests.

Messages you send us

What
What you type into our contact forms: name, company, email, website and your message.
Why
To answer you. Messages are stored and emailed to us.
Legal basis
Our legitimate interests in answering the people who write to us.

How the site is used

What
Our own analytics: the pages you view, the buttons and links you click, the referring site, host only and not the full address, campaign tags in the link such as utm, your browser’s user agent, and your account id when you are signed in. Only after you accept cookies: a random id kept in your browser, and the ad click id in the link, gclid or fbclid. For counting unique visitors we keep a hash of your IP address and browser that changes every day, not the IP address itself, and remove it after 90 days. Third-party analytics and advertising tools are listed under Cookies.
Why
To understand which pages work, fix what does not, and measure our advertising.
Legal basis
Our own analytics: our legitimate interests. The random id in your browser, the ad click id, and third-party analytics and advertising tools: your consent, given in the cookie banner.

We do not sell your personal data.

3.Cookies and similar tools

These are the cookies and browser storage items our site uses:

Sign-in cookie
Keeps you signed in. Essential. Lasts until you sign out or it expires.
cookie_consent
Stored in your browser. Remembers what you chose in the cookie banner. Essential.
itg_anon, itg_seen, itgrows_welcome_tracked, itg_trial_fired
Only after you accept. Stored in your browser: itg_anon is a random id for our own analytics; the others mark the current visit and a sign-up or trial already counted, and are cleared when you close the tab.
itg_gclid
Only after you accept. A cookie that keeps the Google Ads click id for 90 days, so we can tell which sign-ups and payments came from our ads.
Google Ads tag
Advertising, loaded only after you accept. Measures whether visitors from our ads sign up or pay; Google sets its own cookies. Before you accept, nothing is sent to Google.
Contentsquare
Analytics, loaded only after you accept. Records how pages are used: clicks, scrolling and page movement, which can include a replay of a visit.
Microsoft Clarity
Analytics, loaded only after you accept. Heatmaps and recordings of how pages are used. Microsoft sets its own cookies.
Vercel Analytics
Analytics, loaded only after you accept. Counts page views, referring sites and device types.

On your first visit a banner lets you accept or decline cookies, and remembers your choice. The analytics and advertising tools, the Google Ads tag, Contentsquare, Microsoft Clarity and Vercel Analytics, load only after you accept; until then none of them is loaded. If you decline, they do not run.

You can change your choice at any time: open Cookie settings.

You can also delete cookies and site data at any time in your browser settings.

4.Who helps us process data

We share data only with the companies that help us run ItGrows, and only for that purpose:

Stripe
Payments, subscriptions, invoices and the billing portal. Stripe handles your card; we never see the card number.
Resend
Sends our emails: sign-in codes, reports, weekly updates, article notices and account emails.
Vercel
Hosts the website and the app, and provides Vercel Analytics.
Google Cloud
Hosts our database and the servers that run the checks and write the articles, in the United States.
Anthropic, OpenAI, Google Gemini, Perplexity
Their APIs answer the buyer questions we use to measure AI answers. Anthropic also helps research and write articles; Google Gemini, with OpenAI as a backup, writes LinkedIn and X drafts, images and the free post preview. We send them what the task needs: questions about your business, facts from your public site, your topics and drafts, and what you type into the free post preview.
Google Ads
Advertising measurement, see Cookies.
Contentsquare, Microsoft Clarity
Analytics of how our pages are used, see Cookies.
Telegram
Internal notifications to our team about sign-ups, payments and messages, with the name, email and website involved.
LinkedIn, X
When you connect them: we publish your posts through their APIs and read your posts’ statistics.
Google, LinkedIn sign-in
If you sign in with them, they tell us your name and email address.
Your website platform
WordPress, Shopify or Webflow, when we publish articles to your site with the access you gave us.

Each of them handles data under its own terms and privacy policy. We may also disclose data when the law requires it, or to protect our rights and our users.

5.International transfers

Magiscan Inc. is a US company. Your data is processed in the United States: our database and servers are there, and most of the providers above process data there. If you are in the EU, the UK or Switzerland, your data is transferred to the United States.

Where required, we rely on the Standard Contractual Clauses offered by our providers.

6.How long we keep data

  • Account data: while your account exists; it is removed when you delete the account (see below). The answers we collected about a website and its quick-check results belong to the website and are kept without a time limit.
  • IP addresses saved with quick checks and free post previews, and the daily visitor hash: 90 days. The result of a quick check stays with the website, like the AI assistants’ other answers.
  • Usage analytics: 24 months.
  • Messages you send us through our contact forms: 24 months.
  • Billing records: as long as tax law requires.
  • LinkedIn and X tokens: deleted as soon as you disconnect the account.
  • Deleting your account from the LinkedIn & X dashboard, or by writing to kiryl@itgrows.ai, first cancels all your subscriptions, trials included; if one cannot be cancelled, the account is kept. Then it deletes: your account and its sign-in codes; your connected LinkedIn and X accounts with their tokens; your posts, drafts, topics and briefs, and their statistics; your image library; your connected sites with their access details; your articles; your AI visibility data: the sites you follow, your plans, launch steps and launch emails; and the usage analytics and messages recorded under your account, or in the same browser before you signed in. The AI assistants’ answers about a website are stored per website and stay with it, with no link to your account. Stripe keeps your invoices as billing records. To have your image files erased from our image server too, or your Reddit planner projects removed, write to us.

7.Your rights

Under the GDPR, the UK GDPR and similar laws, you have the right to:

  • get a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict or object to processing, including processing based on our legitimate interests;
  • receive your data in a structured, machine-readable format;
  • withdraw your consent at any time, without affecting what was done before;
  • complain to your local data protection authority.

To use any of these rights, write to kiryl@itgrows.aifrom the email address on your account. We answer within one month. Some things you can do yourself: edit or stop articles in your cabinet, disconnect LinkedIn or X, unsubscribe from weekly emails, delete your account in the LinkedIn & X dashboard, change your choice in Cookie settings, and clear cookies in your browser.

8.Security

All traffic to ItGrows is encrypted with HTTPS. Your articles, connected accounts and access details are available only to your account and to the ItGrows team that runs it. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

9.Children

ItGrows is for people aged 18 and over. We do not knowingly collect data from children.

10.Changes to this policy

We may update this policy. We will tell you about important changes by email or in your dashboard, and the date at the top will change.

11.Contact

Privacy questions and requests: kiryl@itgrows.ai
Magiscan Inc., 919 North Market Street, Wilmington, DE 19801, USA