Grower CRM is a multichannel CRM, built around WhatsApp and an artificial intelligence agent, that BDA LLC (“BDA”, “we”) provides as a cloud service to businesses (“customers”). This policy explains what personal data we process, why, with whom we share it, how long we keep it, and how to exercise your rights.
1. Who is responsible
BDA LLC, a limited liability company registered in the State of New Mexico, with its address in Albuquerque, New Mexico 87110, USA. Privacy contact: soporte@growercrm.com.
We play two different roles, depending on whose data it is:
- Data of the people who use Grower CRM (business owners and their teams): BDA is the controller.
- Data of each business’s contacts (the people who message the business on WhatsApp, Instagram, Messenger, email or forms): the business is the controller and BDA processes that data on the business’s behalf, only to provide the service. If you are a contact of a business and want to exercise your rights, contact the business; if it does not respond, write to us and we will handle it with them.
2. What data we process
Platform accounts
- Name, email address, password (stored only as a hash) and role in the business.
- Session technical data: IP address and browser (user agent) of each sign-in, to keep the session running and protect it.
Data we receive from WhatsApp (Meta)
When a business connects its WhatsApp Business number, we receive from Meta’s WhatsApp Cloud API:
- Each contact’s phone number or, when Meta does not share it, the business-scoped WhatsApp user ID.
- The contact’s public WhatsApp profile name.
- The content of the messages exchanged (text, images, audio, documents, locations and contact cards) and their status (sent, delivered, read).
- The business account’s technical identifiers: the WhatsApp Business Account (WABA) ID, the phone number ID, the display number and the verified name.
- If the contact came from a click-to-WhatsApp ad: the ad data Meta attaches (ID, headline, body and image of the ad, and the ctwa_clid click ID when the business enables ad measurement).
Other data about each business’s contacts
- What the business records in the CRM: name, email, notes, custom fields, sales stage, amount, tasks and appointments.
- Instagram and Messenger messages, if the business connects those channels: user ID and username, and message content.
- Form submissions: the data the person enters, the exact consent text they accepted, their browser and a truncated IP address (we never store the full IP).
- Email: the messages sent, their delivery status and, for marketing emails, whether they were opened and which link was clicked.
- Marketing consent: when it was given or withdrawn, from which source and with what evidence.
3. How we use it
- To provide the service to the business: receive and send its messages, display its conversations, organize its contacts and sales pipeline, schedule appointments and send the emails the business decides to send.
- The AI agent, if the business turns it on (it is off by default): it replies to contacts on the business’s behalf and, within the business’s rules, may move a contact to another stage, create tasks, offer and book appointments, record an email address or a consent, or hand the conversation over to a person. The business’s team can turn it off for any conversation. The agent identifies itself as an AI virtual assistant: it never pretends to be a person and, if asked, says so and offers to connect the contact with someone on the team. No business can turn this rule off.
- Security and operations: authentication, usage limits, abuse prevention and error diagnosis.
- Platform communications: email verification, password recovery, invitations and service notices.
We do not sell personal data, and we do not use it for our own advertising or to train artificial intelligence models.
AI providers do not keep or train on your data: every request from the agent and from the Grower Assistant requires OpenRouter to route it only to providers that, under its data policy, do not collect the data or use it to train models. If no such provider can serve it, the request is not made.
4. Who we share it with
Only with the providers we need to deliver the service:
| Provider | Purpose | Data |
|---|---|---|
| Meta Platforms (WhatsApp Cloud API, Instagram, Messenger) | Sending and receiving the business’s messages | Messages, contacts’ phone numbers and identifiers |
| OpenRouter (United States), which routes each request to the AI model that serves it | Generating the agent’s replies, if the business turns it on, and the Grower Assistant’s replies when a team member writes to it | For the agent: its instructions, the business’s knowledge base and the latest text messages of the conversation. For the Assistant: what the team member writes to it and what the Assistant looks up to answer (contacts, conversations, tasks, results and business settings) |
| Amazon Web Services (Amazon SES) | Sending platform and business emails | Recipient address, email content and delivery status |
| Hostinger (server in the United States) | Hosting the application, the database and attachments | All service data |
| Zernio | Connecting Instagram and Messenger, if the business enables them | Messages and identifiers on those channels |
| Zoom or Google (Calendar/Meet) | Creating the meeting link for an appointment, if the business connects them | Appointment title with the contact’s name, and the appointment notes |
| Meta (Conversions API) | Reporting to Meta which ad conversations ended in a sale, if the business enables it | Only the ad click ID and, if the business provides it, the amount. Never the phone number or email |
We may also disclose data when required by law or a competent authority, or to defend legal rights.
5. International transfers
Data is hosted in the United States and some providers may process it in other countries. We choose providers that offer contractual data protection safeguards.
6. How long we keep it
- While a business’s account is active, we keep its data to provide the service.
- When a business closes its account, we disconnect its channels immediately and delete its data at its request or within 90 days at the latest.
- Accounts that are created and never verified are deleted after 7 days.
- Backups may retain deleted data during their normal rotation cycle, after which it is gone.
7. Your rights
You can request access to your data, its correction, its deletion or a portable copy, or object to processing or withdraw consent. Write to soporte@growercrm.com from your account’s email address; we respond within 30 days at most. To stop receiving marketing emails, use the unsubscribe link in every email. Step-by-step deletion instructions: Data deletion.
If you are in the European Union, the United Kingdom or a country with an equivalent data protection law, you may also lodge a complaint with your data protection authority.
8. Security
- Encrypted connections with TLS (HTTPS).
- Access tokens for WhatsApp, Instagram, Messenger and other integrations are stored encrypted with AES-256-GCM; API keys are stored only as hashes.
- The database itself isolates each business: one business cannot read another’s data, even if the application has a bug.
- Rate limits on sign-in and registration, and role-based access.
If you find a vulnerability, please report it to soporte@growercrm.com. We appreciate responsible disclosure and respond to every report.
9. Cookies
We only use necessary cookies: the session cookie, to keep you signed in, and one that remembers whether you prefer the light or dark theme. We use no third-party advertising or analytics cookies.
10. Children
Grower CRM is a service for businesses and is not directed to anyone under 18.
11. Changes to this policy
If we make material changes, we will notify you in the application or by email before they take effect. The date above shows the latest version.
12. Contact
BDA LLC · Albuquerque, New Mexico 87110, USA · soporte@growercrm.com