Privacy Policy

Last updated 22 Oct 2026 · Version 2

This is a draft, not yet read by a lawyer. Parts of it may change before it is final.

Draft written by Etroy, to be read by a lawyer before it is final. Text in [square brackets] is still to be filled in.

1. Who is responsible

Etroy Business Solution ("Etroy", "we"), 1143/A, Bashundhara Riverview, Hasnabad, South Keraniganj, Dhaka, Bangladesh, runs Etroy Growth at https://etroygrowth.etroybd.com. Questions about your data: etroybusinesssolution@gmail.com.

Two kinds of data are kept here, and the responsibility differs:

• Data about you as a user (your account, your workspace): Etroy decides how it is used, as this policy says.
• Data a business collects about its own customers through the service (leads, chats, bookings, the emails it sends them): the business is responsible for it and decides what is done with it. Etroy keeps and handles it only on the business's behalf, to provide the service, and for nothing else.

2. What we keep, and why

• Your account: name, email address, language, password (stored only as a hash that cannot be turned back into the password), and, if you turn on two-step sign-in, its secret (stored encrypted). To let you sign in and keep your account safe.
• Your workspace: its name, its people and their roles, its settings, and a record of who changed what and when. So the business knows what was done in its workspace.
• Your websites: the addresses you add; what our crawler read on their public pages (titles, descriptions, headings, links, the words of each page, problems found); whether the pages answer; page speed results from Google PageSpeed Insights. To make your reports, alerts and your knowledge base.
• Google Search Console, if you connect it: read-only access to the website you choose, and from it the searches, pages, countries and devices with their clicks, impressions and positions. To show you how people find your website.
• Google Calendar, if a member connects it: when that member is busy (not what their events are), so the booking page does not offer those times; and the meetings booked through the service, which it adds to that member's own calendar.
• Google Analytics, if you connect it: read-only access to the Google Analytics property you choose, and from it, for each day, the number of sessions, users, engaged sessions and key events by channel (such as search, social or direct). These are totals: nothing about any single visitor. To show how people reach your website and to count in your reports.
• Facebook and Instagram (Meta), if you connect them: the Pages you choose, with the Messenger messages and comments people send them and the posts made through the service; the ad accounts you choose, with their campaigns, ads and each day's spend, impressions, clicks and leads; the ads written and approved in the service; and, if you give its ID, your Meta Pixel's daily count of each event (totals only). To answer people, to make and report on posts and ads, and for the suggestions in section 3.
• WhatsApp Business, if you connect it: the messages sent to and received from leads, the message templates, whether each was delivered and read, and what Meta charged. For the business to talk with its leads.
• A business's own mail account, if it adds one: its server details, with the password stored encrypted. So emails go out from the business's own address.
• Leads: what a business records about the people who contact it, or who come in through its website, chat or booking page: name, email, phone, company, what they wrote, the page they came from, consent to be emailed, notes, tasks and the history of what happened. For the business to follow up with them.
• Chats on a business's website: what a visitor answers and writes in the chat, the page it was opened on and its language. A visitor needs no account. The chat sets no cookie; it keeps a random number in the browser so the visitor can find the conversation again.
• Emails sent through the service to leads (replies, follow-ups, booking confirmations): what was sent and when, and anybody's request for no more emails, which is kept for good so it is always honoured.
• Selling: the business's prices and its quotations and proposals to leads; a lead opens a proposal by a private link, and their answer and own words are kept. The business's portfolio of past work, which its chat may point to once approved.
• Complaints and feedback: what a person complained about, in their own words, how serious it is and how it was handled; and the weekly feedback a client who agreed gives (a score and words).
• Email campaigns: who each campaign went to and whether it was sent. Only leads who agreed to emails and did not ask to stop receive them.
• Competitors' websites a business names: what our crawler read on their public pages (titles, descriptions, headings), reading politely and obeying their robots.txt. Business information, not personal data.
• The knowledge base: the questions and answers a business approves for its chat, with each version and who changed it.
• AI use: for each request to the AI, which feature, which model, how much it cost, and its result (suggestions, ideas, drafts). So a business sees what it spent and why.
• Your website's connector, if you set one up: a secret your website uses to sign requests, stored encrypted.
• A business's own AI key, if Etroy allows it and the business adds one: stored encrypted, and never shown again after it is saved.
• Technical records: the session cookie that keeps you signed in and a cookie that protects forms; the web server's records of requests. No advertising or tracking cookies.

3. The AI

Some features use an AI service: SEO suggestions, keyword and blog ideas, drafts of the knowledge base, the chat's answers and the answers drafted for Messenger and WhatsApp, the questions about a project and whether a lead is hot, warm or cold, drafts of emails, quotations, proposals, replies to complaints, posts and ads, and suggestions about ads, audiences, marketing and the topics competitors cover. For these, the service sends the AI only what the task needs: the public text and figures of your website, the approved knowledge base and a visitor's question, or a lead's details and history for an email draft.

• The AI service is OpenAI or Anthropic, chosen by Etroy; or the service of the business's own key, if it has one. Requests ask the service not to keep them for later use where it allows this, and under their published terms for business use these services do not use such data to train their models.
• Nothing the AI writes is sent to anybody or published by itself: a person reads and decides, except the chat's answers, which come only from the entries a business has approved, and say so when the answer is not known. A business's owner may switch on automatic replies, posts or ad changes, each within limits the owner sets, and can stop them all at once; every automatic action is recorded and can be undone where possible.
• Suggestions about ads, audiences and marketing are counted from the business's own figures and name the figures they rest on; they change nothing by themselves.
• A business sets a monthly limit for its AI; without one, the AI is off for it.

4. Data from Google

Etroy Growth's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Search Console (read-only): used only to show your own workspace its reports.
• Analytics (read-only): the daily totals in section 2, used only to show your own workspace its reports and recommendations.
• Calendar (when you are busy, and adding the meetings booked through the service): used only for that workspace's booking page.
• Drive (only files the service itself created): used only by Etroy to keep its own encrypted backups in Etroy's Google Drive. It is not used with your Google account.

We do not sell Google data, use it for advertising, use it to train AI, or show it to anybody outside your workspace. Disconnecting gives the access back to Google; you may choose to delete the numbers already read at the same time.

5. Who else handles it

We do not sell personal data. It passes only to the services the product runs on:

• Our hosting provider, on a server in Singapore, where the service, its database and its email sending run. [Name the provider before the lawyer reads this.]
• The AI service in use (OpenAI or Anthropic, or the one a business chose with its own key), for the features in section 3.
• Google, for the Google services you connect, for PageSpeed Insights (public website addresses only), and for Etroy's encrypted backups.
• Meta (Facebook, Instagram and WhatsApp), for the Pages, ad accounts, Pixel and WhatsApp number a business connects, and for the messages, posts and ads sent through them.
• Cloudflare, if its robot check is switched on for a chat's contact step.

6. How long we keep it

• Search Console numbers: sixteen months, as Google keeps them.
• Google Analytics, ad and Pixel numbers: while the workspace keeps them; disconnecting Google Analytics can delete its numbers at the same time.
• Website checks: each check is kept so you can see what changed; the details of older checks are reduced over time. Uptime checks: thirteen months.
• Leads, chats, bookings and the knowledge base: while the workspace keeps them; the business can delete them.
• Your account and workspace: while you use the service. A workspace's owner can download all of its data, and can delete the workspace: it closes at once, and its data is deleted after 30 days, during which we can restore it if asked. People's own accounts are not deleted with a workspace; write to us to have yours deleted.
• Backups: every night, kept fourteen days on the server. A copy encrypted before it leaves the server is kept off it: each night's for fourteen days, one a week for eight weeks, one a month for twelve months. Deleted data leaves the backups as they age out. [The copy off the server is being set up; remove this note once it runs.]

7. Keeping it safe

The service runs over HTTPS only. Secrets, access tokens and AI keys are stored encrypted. Backups are encrypted before they leave the server, with a key only Etroy holds. One workspace can never see another's data; this is tested every time the software changes. Etroy's own staff must use two-step sign-in.

8. Your choices

• You can see and change your account details in your profile.
• To get a copy of your data, to correct it or to have it deleted, write to etroybusinesssolution@gmail.com. A workspace's owner decides for the workspace's data.
• If a business holds data about you as its customer, ask that business first; we help it answer.
• Every email sent to a lead carries a link to ask for no more emails.

9. Changes

When this policy changes, the version number above changes, and everybody using the service is asked to accept the new version before going on.