Privacy Policy

Effective date: 11 October 2026 · Last updated: 23 October 2026

This policy explains how LevelUpGrowth (“LevelUpGrowth”, “we”, “us”), the operator of levelupgrowth.io and the LevelUpGrowth platform (the “Service”), collects, uses and protects personal data. LevelUpGrowth is operated by Level Up Growth FZE LLC, a Free Zone Entity licensed by the Ajman Nuventures Centre (ANC) Free Zone, Government of Ajman, United Arab Emirates (licence no. 2629521929888), registered at BC-894540, 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates. Level Up Growth FZE LLC is the controller of the personal data described here, except where a business that uses LevelUpGrowth decides what happens to its own customers’ records (section 2).

1. How to contact us

Level Up Growth FZE LLC
BC-894540, 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates
Licence no. 2629521929888, issued by the Ajman Nuventures Centre (ANC) Free Zone, Government of Ajman, United Arab Emirates

For any privacy question or request, email [email protected], or use the contact form at levelupgrowth.io/contact, choose Support, and start your message with “Privacy”. If you have an account, you can also ask in the app. To delete data we received from Facebook, Instagram or WhatsApp, see Data deletion.

2. What we collect

You give us

• Account details — name, email address and password (stored only as a one-way hash), and your workspace and business details.
• Content you create — websites, articles, images, videos, social posts, campaigns, client records, calendar entries, files you upload, and the messages you send to Sarah and the AI team.
• Billing — payments are handled by Stripe. We never receive or store full card numbers.

Your customers give you, through us

When people use the contact form, booking form or chatbot on a website you run with LevelUpGrowth, we store what they submit (for example their name, contact details and message) in your client records, on your behalf. You decide what happens to those records and can delete them in Clients.

Collected automatically

• Usage and device data — pages visited, actions taken, IP address and browser type, used to run and secure the Service.
• Cookies — see the Cookie Policy. A tracked link on your website sets a first-party cookie (lug_ref, 30 days) so a later enquiry can be tied to the link that brought the visitor.
• levelupgrowth.io uses no third-party advertising or analytics trackers.
• Websites built with LevelUpGrowth record where visitors click or tap and how far they scroll, per device, to show the website owner a heatmap. This uses no cookies, no keystrokes, no session recording and no personal data, honours Do Not Track and Global Privacy Control, and can be switched off by the website owner. These events are kept for 90 days.

3. How we use it

• To provide the Service and your workspace.
• To produce the AI work you ask for (see section 4).
• To take payments and manage your plan and credits.
• To measure the results of your marketing for you, from sources you connect (for example Google Search Console) and links you share.
• To secure the Service, prevent abuse and meet legal obligations.
• To send you operational messages about your account and the work in it.

4. AI processing

To do the work you ask for, the text of your request and the relevant parts of your workspace are sent to third-party AI model providers that work for us under contract, which return a result. They process that content only to return the result, and they may not use your content to train their models. Work is shown to you for review, and actions that cost credits or publish anything run only after your approval or within a plan you approved.

5. Facebook, Instagram and WhatsApp (Meta)

What we receive when you connect a Facebook Page

When you choose Connect Facebook, Meta asks you to grant permissions. LevelUpGrowth asks only for these: public_profile, pages_show_list, pages_read_engagement, pages_manage_posts, pages_read_user_content, pages_manage_engagement and pages_manage_metadata. With them we receive:

• the list of Pages you manage, so you can choose one;
• for the Page you choose: its ID, name, category, picture and follower count, and a Page access token;
• the list of permissions you granted;
• the posts we publish for you, with their Facebook identifiers;
• comments people leave on your Page — the commenter’s name and Facebook ID as Meta provides them, and the text — delivered by Meta’s webhook as they arrive;
• a one-way, salted hash of your Facebook user ID, kept only so we can act on a deletion request Meta sends us. We do not store your Facebook user ID itself, your Facebook password, or your personal Facebook access token.

Why, and how we use it

• To let you choose the Page LevelUpGrowth works with.
• To publish the posts you approve, when you choose.
• To show you new comments and draft replies. A reply is posted only after you approve its exact words.
• To receive new comments as they happen (Meta’s webhook for your Page).
• When a comment looks like an enquiry, to add the person to your client records so you can follow up.

How the token is protected

The Page access token is stored encrypted at rest and is used only to perform the actions above for your Page.

How long we keep it

We keep the Page details and the token while the Page is connected. When you disconnect the Page, the stored token and the permissions are deleted immediately. Comments we received stay in your workspace until you delete them or ask us to delete your Meta data (see Data deletion).

How to disconnect

• In LevelUpGrowth: Social → Facebook → Disconnect.
• In Facebook: Settings & privacy → Settings → Business integrations, then remove Level Up Growth. Facebook then tells us, and we delete the data we received through that connection.

Instagram and WhatsApp Business messaging

A business that uses LevelUpGrowth can connect its Instagram professional account (through the Facebook Page it is linked to) and its own WhatsApp Business number (through Meta’s WhatsApp signup). These connections are being introduced in stages and are switched on only for businesses we enable while Meta reviews them. Where they are on, this is how they work.

What we receive.

• Instagram: the connected account’s ID, username, profile picture and follower count; its recent posts (ID, caption, link and date), so comments can be shown with the post they belong to; the posts we publish for the business; comments people leave on its posts (the commenter’s username and Instagram ID, and the text); and direct messages people send to the account (the sender’s profile name and Instagram ID, and the text).
• WhatsApp: the connected number’s display number, verified business name and quality rating; the messages customers send to that number (the text, or a note of the type of any photo or file, which we do not download); the customer’s phone number and WhatsApp profile name; the replies and approved templates the business sends; and delivery statuses (sent, delivered, read or failed).
• For both, a business access token, stored encrypted at rest, which no screen or API ever shows.

Why, and how we use it. Only to run these features for the business that connected them: to show its messages and comments in its CRM, on the client record of the person who wrote; to draft replies; to send the replies and posts the business approves; and to show whether a message was delivered and read. A person at the business approves every reply before it is sent, and nothing is sent automatically. We never message anyone first: WhatsApp templates go only to people who have written to the business, one approved message at a time, and there is no bulk sending.

AI drafting. To draft a reply, the message and the relevant parts of the business’s workspace are sent to third-party AI model providers that work for us under contract. They process that content only to return the draft, and they may not use it to train their models. A draft is a suggestion: the business reads it, can change it, and decides whether it is sent.

Who decides. The business that connected the account decides what happens to its customers’ messages; we process them on its behalf. If you wrote to a business on Instagram or WhatsApp, contact that business first about your messages.

How long we keep it, and deletion. We keep the connection and its token while the account or number is connected. Disconnecting deletes the stored token immediately. Messages and comments stay on the business’s client records while its account is active, until the business asks us to delete them or a deletion request is made through our Data deletion page, which covers Instagram and WhatsApp as well as Facebook.

No selling. We do not sell this data, use it for advertising, or share it with anyone except the service providers that run these features (section 7). Meta Platforms, Inc. provides Instagram and WhatsApp and the systems that carry these messages; Meta’s own terms and privacy policies apply to its platforms, and Meta may charge the business directly for some WhatsApp messages.

Features that are not enabled

Facebook Messenger and Facebook Lead Ads are not enabled. We do not request Facebook Page messaging, lead-ads or ad-management permissions, and we do not receive that data.

6. Google Search Console and Google Analytics

What we receive when you connect Google

When you choose Connect Google, Google asks you to grant read-only access. LevelUpGrowth asks only for these: Google Search Console (read-only, webmasters.readonly) and Google Analytics (read-only, analytics.readonly). With them we receive:

• the email address of the Google account you connected;
• the list of Search Console properties you can see, so you can choose the one for your website;
• for the property you choose, its search performance by date: pages, search queries, clicks, impressions, click-through rate and average position;
• for the Google Analytics property you choose, its name and ID, and totals for your website, such as visitors, sessions, page views, traffic sources, top pages, devices, countries and engagement. These are totals for your website, never information about an individual visitor;
• an access token and a refresh token.

We never change anything in your Google account.

Why, and how we use it

Only to give the business that connected it reports on its own website, and so Sarah and the AI team can advise it: which pages and searches to work on, and whether the work is paying off. To do this, the relevant figures are sent to third-party AI model providers that work for us under contract. They process them only to return the result, and they may not use them to train their models.

How it is protected

The tokens are stored encrypted at rest, are never shown on any screen and are never logged. Search Console figures are stored in the business’s workspace. Analytics figures are fetched from Google when you open the report, and we do not keep a copy.

How long we keep it, and deletion

We keep the connection while Google is connected. Disconnecting deletes the stored tokens and the connected email address immediately. Search figures already imported stay in your workspace so your past reports keep working, until you delete your workspace or ask us at [email protected] to delete them. You can also remove LevelUpGrowth’s access at any time in your Google Account, under Security → Your connections to third-party apps & services.

No selling

We do not sell Google data, use it for advertising, or transfer it except to provide these features. Our staff do not read it, except with your permission, for security, or where the law requires it.

Google’s rules

LevelUpGrowth’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Service providers

We share data only with the providers that run the Service, and only what each needs:

Provider	What for
Stripe	Payments and subscriptions
AI model providers	AI text, image and video generation, under contract; no training on your content
Railway	Hosting for our AI service
DigitalOcean	Hosting, databases and file storage
Cloudflare	Content delivery, DNS and security
Postmark	Account and transactional email
DataForSEO	Search data for SEO work
Our ICANN-accredited registrar partner	Domain registration, when you buy a domain. Domains are registered in our company name and held for you (Domain Services Terms), so your personal details are not sent to the registry.
Expo	Push notifications for the companion app
Sentry	Error monitoring
Google	Search Console and Analytics, only if you connect them (section 6)
Meta	Facebook, Instagram and WhatsApp, only if you connect them (section 5)

These providers may process data outside your country. A list of our sub-processors is available on request at [email protected].

8. How long we keep data

We keep your data while your account is active. You can delete content, client records and connections yourself at any time. To have your workspace deleted, contact us (section 1). Some records, such as billing and tax records and security logs, are kept for as long as the law or the security of the Service requires.

9. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or restrict some processing, and to receive a copy of your data. To use these rights, contact us (section 1). People who contacted a business that uses LevelUpGrowth should first contact that business, which decides what happens to their records; we help it act on the request.

10. Security

Connections are encrypted in transit (HTTPS). Passwords are stored only as one-way hashes, and connection tokens are encrypted at rest. Within a workspace, each person has a role (owner, admin, member or viewer) that limits what they can do. No method is perfectly secure; we work to protect your data.

11. Children

The Service is for businesses and is not directed to children.

12. Changes

We will post changes to this policy here and update the date at the top.