Privacy Policy

1Scope#

This Policy applies to visitors to turgo.ai, prospective and current business customers, account users, business contacts, event participants, job applicants and other individuals who interact directly with Turgo. The Services are designed for business use and are not intended for personal, family or household use.

2Personal Data we collect#

• Account and identity data: name, business email, role, company, profile information, authentication identifiers and workspace membership.
• Contact and sales data: information you provide when requesting a demo, communicating with sales/support, attending an event or responding to a survey.
• Billing data: subscription, invoice and transaction metadata. Payment card details are processed by our payment provider and are not stored by Turgo except for limited billing metadata we receive.
• Service and device data: IP address, browser/device information, login events, security logs, usage telemetry, feature interactions, API activity and diagnostic data.
• Content you provide: prompts, files, feedback and other information you submit to Turgo. Where that content is Customer Data processed on behalf of a Customer, the DPA applies.
• Connected-service data: information made available through integrations that you or your organization authorize, subject to the permissions granted.
• Recruiting data: CV/resume information and related application materials where you apply for a role.

3Customer Data and our role as processor#

Business Customers may upload or connect lead records, CRM data, messages, files, call recordings/transcripts, campaign information and other Customer Data. For that processing, Customer determines the purposes and means of processing and Turgo generally acts as processor or subprocessor to the extent those roles apply. Our DPA describes the relevant obligations, including security, subprocessors, data-subject assistance, deletion/return and international transfers.

4Why we use Personal Data#

5AI processing and model training#

Turgo uses third-party AI Providers identified in our Subprocessors & Third-Party Integrations notice. We use business/API offerings and contractual or technical controls designed to prevent Customer Data from being used to train providers' general-purpose models unless the Customer expressly authorizes that use. Provider retention can vary by service, configuration, security requirements and law; a no-training commitment is not the same as a zero-retention commitment.

Turgo does not use Customer Data to train or fine-tune Turgo general-purpose AI models unless the Customer expressly opts in or otherwise agrees in writing.

6Google Workspace and Google API data#

When you connect Google Workspace services, Turgo accesses Google user data only through the permissions you authorize and for the feature you request. Turgo's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We request only the scopes reasonably necessary for the enabled feature.
• We do not use Google Workspace user data to train or improve generalized AI models.
• Where an AI feature requires inference, only the information reasonably necessary for the requested function is sent to an approved provider.
• We use technical and contractual controls to restrict provider use of such data.
• You can revoke Google permissions through your Google account settings.

7How we disclose Personal Data#

We may disclose Personal Data to service providers and subprocessors that help us operate Turgo, including cloud infrastructure, AI processing, communications, security, support, analytics and payment providers. The current list of relevant providers is available on our Subprocessors page.

We may also disclose information to professional advisers, regulators or authorities where required by law; in connection with a merger, financing, acquisition, reorganization or sale of assets; or at your direction through a connected Third-Party Platform.

We do not sell Customer Data. Website advertising or measurement technologies may, depending on applicable law and configuration, constitute "sharing" or targeted advertising. Where required, Turgo provides applicable consent or opt-out controls through its cookie/consent mechanisms.

8Cookies and similar technologies#

Turgo uses necessary technologies to operate the Website and may use analytics, measurement and advertising technologies subject to your consent choices where required. See our Cookie Policy for more information.

9International data transfers#

Turgo and its providers may process Personal Data in the United States, India, the European Economic Area and other countries in which our providers operate. Where a restricted transfer requires safeguards, Turgo uses an applicable legal mechanism, which may include adequacy decisions, the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

Growstack Inc. also participates in the applicable U.S. Department of Commerce Data Privacy Framework program(s) for which it maintains an active certification. Where Turgo relies on a Data Privacy Framework certification, the applicable DPF Principles govern eligible transfers. If there is a conflict between this Policy and applicable DPF Principles for such data, the DPF Principles control. Information about the program and participating organizations is available at dataprivacyframework.gov.

10Data retention#

We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected and for legitimate business, security, contractual and legal requirements. Retention periods differ by category. For example, account and subscription records may be retained for the life of the account plus legally required recordkeeping periods; security and audit logs follow defined operational schedules; and Customer Data is returned, deleted or anonymized in accordance with the DPA, service configuration and applicable backup cycles.

We may retain limited suppression, fraud/security, billing/tax and legal-hold records where necessary to comply with law, enforce rights or prevent prohibited re-contact.

11Security#

Turgo maintains technical and organizational measures designed to protect Personal Data, including access controls, encryption, security monitoring, secure development practices, supplier management, incident response and business-continuity controls appropriate to the Services. Growstack Inc. maintains ISO/IEC 27001:2022 and ISO/IEC 42001:2023 certifications for the applicable certified scope. Growstack Inc. has also been independently assessed by Ampcus Cyber Inc. for GDPR compliance; Certificate No. AC-US-GDPR-26-00138 was issued August 14, 2026 and is valid through August 13, 2027. The Ampcus certificate is an independent compliance assessment and states that it is for promotional use only and is not a legally binding document. More information is available on our Security & Compliance page.

12Your privacy rights#

Depending on where you live and how Turgo processes your Personal Data, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or review of certain automated decisions, and to lodge a complaint with a supervisory authority. U.S. state privacy laws may also provide rights to know, delete, correct, opt out of certain sales/sharing or targeted advertising, and limit certain uses of sensitive information.

To submit a privacy request, contact info@turgo.ai. We may need to verify your identity and authority before completing a request. If Turgo processes the relevant information solely on behalf of a business Customer, we may direct the request to that Customer.

13Children#

Turgo is a B2B service and is not directed to children. We do not knowingly collect Personal Data from children for their own use of the Services. Customers must not use Turgo to unlawfully target or profile children.

14Data Protection Officer and international representatives#

Data Protection Officer / privacy contact: info@turgo.ai.

Where applicable law requires Growstack Inc. to designate an EU, UK or other local representative, Turgo maintains the applicable designation and provides the representative's contact details to data subjects and supervisory authorities as required by law. Requests may be directed to info@turgo.ai for routing to the appropriate representative.

Turgo will update this Policy and its regulatory records when these contacts or designations materially change.

15Changes to this Policy#

We may update this Policy to reflect changes in law, our Services or our privacy practices. We will post the updated version with a new "Last updated" date and provide additional notice where required by law or where a change materially affects your privacy rights.

16Contact#

Privacy questions: info@turgo.ai
Security matters: info@turgo.ai
General/legal notices: info@turgo.ai
Growstack Inc. d/b/a Turgo.ai, 4030 Wake Forest Road, Suite 349, Raleigh, NC 27609, USA.