GrowthOS
Privacy Policy
Last updated September 26, 2026
Draft for private testing. Business details and policies must be finalized before public onboarding.
Service operator: Karim Mawji, operating as Markau
About this service
Markau provides the GrowthOS marketing workspace. This policy describes information handled when you sign in, manage a workspace, connect an advertising account or contact support.
Data we process
GrowthOS processes account identity, workspace content, uploaded brand media, provider authorization tokens, campaign configuration, delivery status, and provider-reported metrics to operate the service. We also process sign-in and security events, technical error reports and support correspondence to protect accounts and resolve problems. If you use messaging features, workspace contact details and consent records are also processed. Do not upload information you lack permission to use.
Provider access
GrowthOS never asks for provider passwords. OAuth tokens and account-scoped keys are encrypted and used only for actions the workspace authorizes. We do not sell customer data.
Who receives information
Authorized workspace members can access information according to their assigned roles. Advertising platforms receive the account requests, creative, targeting and campaign instructions needed for the connections and actions you authorize. Their own privacy policies govern their services.
We use OpenAI Sites and Cloudflare for hosting, Supabase for account and workspace storage, Resend for sign-in email, and Sentry for error monitoring. Support correspondence uses our configured mail services. When AI features are enabled and used, relevant instructions, brand information, copy or images are sent to OpenAI for the requested generation or moderation. Feature availability depends on configuration and account access.
Storage and security
The production Supabase project is hosted in Canada. Other service providers may process information outside Québec or Canada. Access controls, encrypted connections, private media storage and encryption of stored provider credentials help protect information. Application error reports are filtered to reduce personal information and omit request bodies. Hosting and monitoring services may process connection details such as IP addresses and approximate location. No service can guarantee that every security incident will be prevented.
Sign-in storage
The app uses browser cookies and local storage to maintain sign-in and workspace preferences. Blocking or clearing this storage may sign you out or prevent features from working.
Retention and deletion
Account and workspace records are retained while needed to provide the service and handle authorized requests. The retention and backup expiry schedule is being finalized before client onboarding; no automatic deletion deadline is promised by this draft. Disconnecting a provider does not delete campaigns or records held by that provider.
Your requests and privacy contact
Contact Karim Mawji, the service operator, at privacy@markau.app to request access, correction, export or deletion, withdraw an authorization, or raise a privacy concern. We verify your identity and authority before disclosing or changing workspace data. See our deletion instructions for the process and the limits of provider disconnection.