Privacy Policy

1. Who we are

WITTI Grow ("we", "us", "our") is a product of WITTI Technology Limited, a company registered in Hong Kong. Our website is wittigrow.com. For privacy inquiries, contact us at privacy@wittisms.com.

2. What data we collect

When you use WITTI Grow, we may collect:

• Account information: email address, name, password (hashed), and profile picture from Google OAuth.
• Website data: publicly available information from URLs you submit for marketing audits.
• Social media data via Meta APIs: when you connect your Facebook or Instagram account, we access your Pages list, Page engagement metrics, and the ability to publish posts on your behalf. Specifically:
  • pages_show_list — to display your Facebook Pages for selection
  • pages_read_engagement — to show you analytics about your Page performance
  • pages_manage_posts — to publish approved marketing content to your Pages
  • instagram_basic — to access your connected Instagram account information
  • instagram_content_publish — to publish approved content to your Instagram account
• Google Ads data via the Google Ads API: when you connect your Google Ads account, we request a single scope, https://www.googleapis.com/auth/adwords. Google publishes no narrower one, so the same permission that lets us build a campaign also lets us change and remove one. We use it to:
  • Read the list of Google Ads accounts your signed-in Google user can access — with each account's name, currency, time zone and manager (MCC) flag — so you can pick which one to use.
  • Create — always in PAUSED status — Search campaigns, ad groups, Responsive Search Ads and keywords inside the Google Ads account you selected, with the daily budget and location targeting you chose.
  • Enable or pause a campaign, an ad group or an individual ad when you use those controls in WITTI Grow. Enabling a campaign also enables its ad groups and ads, and starts spending your budget.
  • Permanently remove an individual ad, or an entire campaign, when you use the Delete action in WITTI Grow and confirm it. Removal cannot be undone in Google Ads, and it also deletes our own record of that campaign.
  • Read your campaign, ad group and ad status, budgets, live ad copy and keywords, and up to roughly 90 days of daily performance figures, so the dashboard reflects your real account rather than what we last wrote to it.
  • Ask Google's keyword planning service for keyword suggestions and bid estimates while you are drafting a campaign.
  WITTI Grow never creates, enables, pauses or removes anything in your Google Ads account on its own initiative or on a schedule. Every one of those actions is triggered by a signed-in member of your workspace clicking it, and the two destructive ones are behind a confirmation step. Reading is the exception: we re-read your account automatically once a week and whenever you open the Ads page, so that the dashboard stays current — those automatic checks never write anything. We request no other Google scope (no Drive, Gmail, or profile data beyond the sign-in email above), and we do not send your Google Ads data to any AI model. The full, itemised description is on our Google Ads API integration page.
• Usage data: pages visited, features used, and API usage for billing purposes.

WITTI Grow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Ads data for advertising, do not sell it, and do not transfer it to others except as needed to provide the WITTI Grow features you request, to comply with applicable law, or as part of a merger or acquisition.

3. How we use your data

• To generate marketing strategies and content for your business
• To publish approved content to your connected social media accounts
• To display analytics and performance metrics from your connected platforms
• To send you notifications about your marketing plan (email)
• To improve our service and fix issues
• To measure how the product is used — which pages and features people reach, and where they stop — so we can improve it

We never sell your data to third parties, and we never use your content or your business data to train AI models. That is a promise about us: to produce your posts, images and reports we send the necessary content to the AI providers listed in section 5, and each of them handles it under their own terms, which we do not control. We do use analytics cookies to measure how people find and move through WITTI Grow — see section 8.

4. Data storage and retention

Your data is stored securely on Google Cloud Platform (Firebase/Firestore) in data centers that comply with SOC 2, ISO 27001, and GDPR standards.

• Account data is retained while your account is active
• Generated content is retained for the duration of your subscription
• Social media tokens are encrypted and stored only as long as your platform connection is active
• Audit data for anonymous users is retained for 90 days

5. Third-party services

We use the following third-party services to operate WITTI Grow:

• Google Firebase: authentication, database, and file storage
• Google Ads API: connecting your Google Ads account to create paused Search campaigns, and to enable, pause or remove campaigns and ads when you ask us to
• Meta Platform APIs: Facebook and Instagram integration (publishing, analytics)
• Anthropic (Claude): AI-powered strategy generation
• Google (Gemini): AI-powered analysis and written content
• Volcano Engine (Doubao / Seedream, ByteDance): AI-powered image generation. Your image briefs are processed on servers in mainland China.
• Resend: transactional email delivery
• Stripe: payment processing (when applicable)
• Google Analytics: measuring how the product is used
• Meta Pixel: measuring which advertising brings people here — used only while we are running ads
• Google Ads conversion measurement: counting sign-ups that came from our own Google advertising — used only while we are running ads

Each service processes data according to their own privacy policies. We only share the minimum data necessary for each service to function.

6. Your rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and all associated data
• Disconnect any connected social media platform at any time
• Export your generated content
• Revoke Meta API access — you can do this from your Facebook Settings > Business Integrations
• Revoke Google Ads access — disconnect it in your WITTI Grow platform settings, or remove WITTI Grow at myaccount.google.com/permissions. Revoking stops all further Google Ads API access and we delete the stored Google tokens.

To exercise any of these rights, email privacy@wittisms.com or use the account settings in your dashboard.

7. Data deletion

When you delete your account or disconnect a platform, we delete the associated data within 30 days. You can also request immediate deletion by contacting us. For Meta platform data specifically, we comply with Meta's data deletion requirements and will delete all data obtained via Meta APIs upon disconnection or account deletion. Likewise, for Google user data obtained via the Google Ads API, disconnecting Google Ads or deleting your account removes the stored Google OAuth tokens and the campaign records created through WITTI Grow within 30 days; campaigns already created in your Google Ads account remain under your control there and can be deleted directly in Google Ads.

8. Cookies

We use essential cookies for authentication (session cookies) and locale preferences.

We also use analytics cookies to measure how visitors find and move through WITTI Grow — which pages they reach and where they stop — so we can see which parts of the product work and which do not. We use Google Analytics for this, with Google Signals and ad personalisation turned off. When we run advertising, we also use advertising-measurement cookies (the Meta Pixel, and Google Ads conversion measurement) to measure which campaigns bring people here. Google Ads conversion measurement sets Google click-identifier cookies (_gcl_*) and reports a completed sign-up to Google's advertising domain. It is used to count conversions from our own advertising only; ad personalisation is turned off, and we do not build remarketing audiences.

This is measurement of our own product. We do not sell your data, and we do not use it to train AI models (section 3). Section 5 lists every third-party service we use, and this page is updated before a new one goes live. You can block or delete these cookies in your browser settings; the product will still work.

9. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes via email or a notice on our website. Your continued use of the service after changes constitutes acceptance.

10. Governing language

This Privacy Policy is published in English and in Traditional Chinese. The Chinese version is provided for convenience only. In the event of any inconsistency or conflict between the two versions, the English version shall prevail.