Privacy policy

Version 5, in effect from October 16, 2026

Who we are

Growth Punch, Inc. is a Delaware corporation. We grow local service businesses: our AI assistant answers the calls they miss, and we can run their websites and ads. This policy explains what we keep about the people we deal with, why we keep it, for how long, and who else sees it. It covers growthpunch.io and the service we run for business owners.

Some parts described here, such as checkout, demos and letters, start when Growth Punch opens to new customers.

Questions about privacy: privacy@growthpunch.io.

If you own or help run a business that uses Growth Punch

This part covers owners, and the co-owners and bookkeepers they add.

What we keep

• What you give us at checkout: your name, mobile number and email; your business’s name, legal name, address, Employer Identification Number (EIN) and the phone number your customers call; and the people you add to your account.
• Your payment method, when you pay us. Stripe, our payment company, holds it. We keep only Stripe’s reference to it, never your full card or bank account number.
• What the accounts you connect send us. For example, if you share your calendar with us, we read it to book jobs into your open times.
• What you do on your pages and in your texts to us, such as an answer you give or a setting you change.

Why

To run your service, tell you about each call and message, answer you and bill you. We use your business’s legal name, EIN and address to register your business with phone carriers, so we can text people in its name.

Information from your accounts is used only for your business. We never use one business’s information to set another business’s ads, budgets or offers.

How long we keep it

• Your name, your business’s name and your email: while you’re a customer, then 7 years with our billing records.
• Your phone numbers: while you’re a customer, and 90 days after you leave. If you texted STOP, we keep the number on our do-not-text list for 5 years, or 10 years for Virginia numbers and numbers whose state we can’t tell.
• If one of your phone lines still sends calls to us after those 90 days, we keep only what we need to pass its calls on (the numbers, your business’s name, one owner’s mobile number and email) until that line is handed back to you, moved or released.
• Your business’s legal name, EIN and address: while your business is registered with phone carriers to send texts, and 90 days after that ends.
• Your consent to texts or calls: while you use it, and 5 years after its last use, to prove you gave it.
• Your acceptance of our agreement and your payment records: 7 years.

When you leave, we email every named owner a copy of your account’s information. We delete the rest of your account’s information 90 days after your last paid day, except the records listed above that we keep longer.

If you call, text or write to a business that uses Growth Punch

When a business uses Growth Punch to answer its phone or messages, that business decides what happens to your information, and its own privacy page explains it. We handle your information for that business: to answer you and pass your message or request to the business. Where the business uses our booking or follow-ups, we also book the time you ask for, or follow up only in the way you agreed.

We also use calls and messages to improve our service. Anything we learn from one business’s calls reaches another business only with names, numbers and addresses taken out, and never a business that serves the same area.

What we keep

Your phone number; your name, address and what you need, as you tell us; the call recording and its transcript; your texts, form entries and emails; and what you agreed to and when.

The assistant is an AI and says so at the start of every call. Calls it answers are recorded, and it tells you so first.

Who sees it

The business’s owners and the people they name, and the companies listed below under “Companies that help us run the service.” People at Growth Punch listen to a call, or read a transcript or message, only to check or fix how the assistant handled it.

For a business whose Google ads we already run, when someone who clicked one of its ads calls or writes, we tell Google that the click led to a call or a job, so the business can measure and improve its ads. Google gets the click’s code and that result, never a name, phone number or email address. This is not yet offered to new customers. That business’s own privacy page explains it.

We never send a caller’s phone number, name or email address to an ad platform.

How long we keep it

• Call recordings and transcripts: up to 12 months while the business uses Growth Punch.
• Your messages and contact details: while the business uses Growth Punch.

Both are deleted within 90 days after the business stops using Growth Punch. Two records last longer: a record of what you agreed to, such as getting texts, kept 5 years after its last use, to prove you agreed; and, if you asked not to be texted or emailed, a note of that, kept 5 years, or 10 years for Virginia numbers and numbers whose state we can’t tell, so we keep honoring it.

Deleting it

Ask the business, or email privacy@growthpunch.io and name the business. We delete your information within 10 business days and tell you when it’s done. We keep only the note not to contact you.

If you visit growthpunch.io

We use Google Analytics, a Google service, to count visits to our website and see which pages lead to sign-ups. When you open one of our pages, Google’s code runs in your browser and sends Google the page’s address, details of your browser and device, such as its type and screen size, and your IP address, which every request carries. It keeps a random identifier in your browser (a cookie), so it can tell a return visit from a first one. The pages that carry Google’s code hold no form and show nothing about you, so Google gets no name, phone number or email address of yours from them, and nothing from our texts or your account.

The code that loads it tells Google not to use your visits to personalize ads and turns off Google signals, Google’s feature for linking visits across devices. Google may still use what it receives under its own terms, which it explains in How Google uses information from sites or apps that use our services. Under California law, letting Google collect this can count as sharing your personal information for advertising.

You have the right to opt out of the sale or sharing of your personal information, and we honor it for every visitor. Use Your Privacy Choices, linked at the bottom of every page, or let your browser send Global Privacy Control: we honor that signal on its own, with no banner and nothing to click. Some browsers send it by default and others offer it as a setting or an extension; globalprivacycontrol.org lists them. Either way, Google’s code no longer loads for you in that browser, and we delete the identifier it kept there. If you visit from the European Economic Area, the UK, Switzerland or Canada, Google’s code doesn’t load at all.

These pages load no script from any other company, Google’s included: this privacy policy, our terms, our messaging terms and Your Privacy Choices.

Our hosting company, Vercel, logs each request to our site, including your IP address and browser type. We use those logs to keep the site working and safe.

If you write to us, we use what you send to answer you.

If we’d like your business as a customer

To show a business what we do, we may build it a demo from its public website, using only what anyone can see there. We may also mail letters to business addresses and send emails, and each one says how to stop them.

We never text a business we’re trying to win as a customer, and we call one only when its owner books a call with us.

We keep a prospect’s details for 12 months after our last contact. A demo is deleted 7 days after it’s built, or 30 days after if its owner books a call. If you ask us to stop, we keep only your email or postal address, your business’s name and the date you asked, so we never contact you again.

Texts from Growth Punch

If you agree to texts from Growth Punch, our Messaging terms explain what we send, how often, and how to stop.

For everyone who gets texts from Growth Punch:

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

That covers your mobile number, your consent to texts and everything else we keep about you as a person; Google Analytics on our website, described above, never receives any of it. Your business’s own details, such as its name and the number its customers call, go into its ads and website, because that is the work you hire us to do.

Who else gets information from us

• Companies that help us run the service, listed below.
• Accounts you or the business connect, such as a calendar. We send them what the service needs, and each one handles it under its own terms.
• A court or a government agency, when the law requires us to.

We sell nobody’s personal information.

We share information with the companies that help us run the service, such as the company that delivers our texts. All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties. In plain words: we never sell your agreement to get our texts, or pass it on for anyone else to use.

Companies that help us run the service

• Twilio carries our calls and texts. It sees phone numbers, calls and texts, including our texts to owners.
• Retell runs the voice assistant. It sees call audio and transcripts. The assistant’s AI model, today one of OpenAI’s, reads the conversation’s text through Retell.
• Supabase is our database and file storage. It holds everything we keep.
• Vercel hosts our sites. It sees requests as they pass through, and keeps the logs described above.
• Anthropic provides the AI model that reads messages and records and writes within our templates. It sees the text it works on.
• Resend sends our email. It sees the emails we send.
• Google Workspace is our email inbox. It sees the emails you send us.
• Stripe is our payment company. It sees owners’ payment details when they pay us, never callers’ information.
• ScrapingBee reads public websites for demos. It sees public web pages only.
• Google Analytics counts visits to our website, as described above. It sees the pages you open there, your browser and device details, your IP address and the identifier it keeps in your browser, unless you turn it off.

We tell owners about a new company that will handle their information 30 days before it starts. An owner who objects may cancel, as always.

Your choices

• To see what we keep about you, fix it, or delete it, email privacy@growthpunch.io. We delete within 10 business days and tell you when it’s done. We keep only a note not to contact you and, for an owner, the consent, agreement, payment and call-routing records listed above.
• Owners can turn texts off any time by replying STOP. Everything then comes by email.
• To turn off Google Analytics on our website, use Your Privacy Choices or your browser’s Global Privacy Control.

Copies that outlast a deletion

A deleted database record can stay in our database host’s daily backups, which our plan keeps for 7 days. Twilio keeps a short record of a deleted call recording, such as its date and length, for up to 40 days.

If something goes wrong

If we find a security problem that affects your information, we tell you as soon as we find out. If you contacted a business that uses Growth Punch, we tell that business at once and help it tell you.

Changes to this policy

We post each new version here with its date. If a change takes away anything this policy promises owners, every named owner gets a summary of what changed 30 days before it takes effect, by email, and by text if they get our texts. An owner may cancel before then and pays only for the days served. A change the law forces takes effect when the law says, with the same notice as soon as we can give it.

Contact

Growth Punch, Inc.
Email: privacy@growthpunch.io

Earlier versions

Version 4, in effect from July 18, 2026; version 3, from April 1, 2026; version 2, from March 27, 2026; version 1, from March 19, 2026. For a copy of any of them, email privacy@growthpunch.io.

Working with third parties (Google’s guide)