Privacy Policy

This policy explains what personal data Sindal Technology International Limited (“Sindal”, “we”, “us”) collects, why we collect it, who we share it with, and what rights you have. It applies to this website, to GrowOS, and to any Sindal customer account used to subscribe to GrowOS.

We are the data user (data controller) for the personal data described here.

1. What we collect

1.1 Account and organisation information

When you create a Sindal customer account or a GrowOS account we collect your name, email address, the password you choose (stored only as a cryptographic hash, never in readable form), your preferred language, and the details of the business you register — business name, industry, contact channels, opening hours and business address where you provide them. If you invite colleagues, we store their email address and their role within your organisation.

1.2 Content you give us

GrowOS works from materials you supply: photographs of your shop, your products and your work, your logo, brand information, and the written directions you give about what you want produced. We store these materials, the marketing content generated from them, and the record of the work — drafts, revisions, approvals and the conversation with your marketing assistant.

1.3 Facebook and Instagram data obtained with your authorisation

If you connect a Facebook Page or an Instagram professional account, we receive data from Meta only after you complete Meta's authorisation flow and grant the requested permissions. What we then receive and store is:

• the identifiers, names and profile images of the Pages and Instagram accounts you connected, and the access tokens needed to act on them;
• the posts published to those accounts through GrowOS, together with their publication status and identifiers;
• comments and direct messages received on those accounts, including the sender's platform name and identifier and the content of the message, so that GrowOS can show them to you and reply on your behalf;
• basic performance figures for the content published through GrowOS.

We use this data only to provide the GrowOS service to you. We do not use it for advertising targeting, we do not build profiles of the people who message you for any purpose beyond handling their message, and we do not sell it or transfer it to data brokers. You may withdraw our access at any time from your Facebook or Instagram settings, or by asking us to disconnect the account. When access is withdrawn we stop receiving new data from Meta and delete the stored access tokens.

1.4 Payment information

Payments for GrowOS subscriptions are processed by a third-party payment provider. Card details are entered on a page hosted by that provider. Sindal never receives, processes or stores your full card number, card expiry or security code. What we store is limited to: your billing contact details, the identifiers the payment provider assigns to your customer and subscription records, your plan, your subscription status and billing period, and, where the provider supplies it, the card brand and last four digits shown for your reference. Invoices and payment history are held by the payment provider and reached through a link from your account.

1.5 Technical data

Our servers record the usual technical information needed to operate and secure the service: IP address, browser and device type, pages or endpoints requested, time of request, and error diagnostics. We use this for security, abuse prevention, troubleshooting and capacity planning.

2. Why we use it

• To provide GrowOS: producing your marketing content, publishing it to the accounts you connected, and handling comments and messages on your behalf.
• To operate your account: authentication, organisation membership, support.
• To take payment and manage your subscription, trial and renewals.
• To keep the service secure: fraud and abuse prevention, audit records of commercially significant actions such as sign-ups, role changes and plan changes.
• To comply with legal, accounting and tax obligations in Hong Kong.
• To communicate with you about the service — service notices, billing notices and replies to your enquiries.

We do not sell personal data, and we do not use your business content or your customers' messages to advertise to anyone.

3. Automated content generation

GrowOS uses artificial intelligence to draft marketing content. To do this, the materials and directions you supply are sent to the AI service providers we use for text, image and video generation. These providers process the material to return a result to us. Generated content is presented to you for review; content is published to your connected accounts on your instruction and under the settings you have chosen. No automated decision is made about you that produces legal effects.

4. Who we share data with

Infrastructure and service providers

Hosting, storage, email delivery, error monitoring and the AI providers described above, each acting on our instructions and bound to protect the data.

Payment provider

Our third-party payment provider, for the purpose of taking payment and managing subscriptions. Card data is collected by them directly, not by us.

Meta Platforms

When GrowOS publishes content or replies on your behalf, that content is sent to Facebook or Instagram through Meta's official interfaces. Meta's own handling of that data is governed by Meta's terms and privacy policy.

Legal and professional

Where we are required to disclose by law, or where necessary to establish, exercise or defend legal claims, and to our auditors and professional advisers.

Some of these providers are located outside Hong Kong. Where personal data is transferred outside Hong Kong we take steps to ensure it remains protected to a comparable standard.

5. How long we keep it

We keep account, organisation and business content for as long as your account is active. After an account is closed we delete or anonymise the content within 90 days, except where we must keep records longer for accounting, tax or legal reasons — billing and transaction records are kept for seven years as required under Hong Kong law. Access tokens for connected Facebook and Instagram accounts are deleted as soon as the connection is removed. Security and audit logs are kept for up to 12 months.

6. How we protect it

Data is stored on servers under our control in Hong Kong. Access is restricted to the people who need it to operate the service. Traffic to our services is encrypted in transit. Passwords are stored only as cryptographic hashes. Databases are not exposed to the public internet. We keep encrypted backups and test our ability to restore them. No system is perfectly secure, but we treat customer and end-user data as confidential and design accordingly.

7. Your rights

Under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong you have the right to ask whether we hold personal data about you, to obtain a copy, and to request correction of data that is inaccurate. You may also ask us to delete data we no longer need to keep. To make a request, email privacy [at] sindaltech.com, identifying yourself and describing what you want. We will respond within 40 days as the Ordinance requires. We may need to verify your identity before acting on a request.

Requesting deletion of data obtained from Facebook or Instagram

To have data we obtained from your connected Facebook Page or Instagram account deleted, remove GrowOS's access from your Facebook or Instagram settings and email privacy [at] sindaltech.com stating the account concerned. On receipt we delete the stored tokens and associated platform data. Closing your GrowOS account has the same effect.

8. Children

GrowOS is a business tool. It is not directed at children and we do not knowingly collect personal data from anyone under 18.

9. Cookies

This website uses no cookies and no analytics or advertising trackers. Where you sign in to a Sindal account or to GrowOS, we set a session cookie that is strictly necessary to keep you signed in. It is not used for tracking or advertising.

10. Changes to this policy

If we change this policy we will update the effective date at the top of this page. Where a change materially affects how we handle your data we will also notify account holders directly.

11. Contact

Questions about this policy, or requests concerning your personal data, should be sent to privacy [at] sindaltech.com.