Privacy Policy

ProductCTO, the trading name of Tanninen Consulting e.U., Millergasse 37, 1060 Vienna, Austria, is the data controller for personal data processed through its software products, including Growhold, Antwort and Scopedom (each a "Service"), and through productcto.com.

Data protection contact: hello@productcto.com

• Account data: name, email address, password hash, and the workspace or organisation you belong to.
• Content you provide: what you type, upload or generate while using a Service.
• Usage data: pages viewed, features used, and technical records such as IP address, browser and timestamps.
• Payment data: billing name, address, country, VAT number and subscription status. Card details go directly to Stripe and are never stored by us.

• To provide the Service you signed up for, and to bill you for it: performance of a contract.
• To keep the Service secure, prevent abuse and fix problems: our legitimate interest.
• To understand how the product is used and improve it: our legitimate interest.
• To send product and marketing email: your consent, withdrawable at any time.
• To meet accounting and tax obligations: legal obligation.

We do not sell personal data, and we do not use your content to train AI models.

We use a small number of processors, each bound by a data processing agreement and permitted to use the data only to provide their service to us:

• Supabase and Neon, for databases and authentication
• Vercel, for hosting
• Stripe, for payments
• PostHog, for product analytics
• AI model providers, including Anthropic, OpenAI and Mistral, for generating outputs
• Email delivery providers, for account and product email

Some of these operate outside the EU. Where they do, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

Account and content data is kept while your account is active, and deleted within 90 days of account closure unless we must keep it longer. Invoices and related records are kept for seven years for tax purposes. Analytics data is kept for up to 24 months.

Under the GDPR you may request access to your data, correction, deletion, restriction of processing, a portable copy, and you may object to processing based on legitimate interests. You can withdraw consent for marketing at any time. Write to hello@productcto.com and we will respond within one month.

You may also complain to a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna.

We use cookies that are necessary to sign you in and keep your session, and analytics cookies to see how the product is used. Necessary cookies cannot be switched off. You can block or delete cookies in your browser, though the Service may not work properly without the necessary ones.

Data is encrypted in transit and at rest, access is limited to those who need it, and we review our providers' security practices. No system is perfectly secure; if a breach affects your rights, we will notify you and the supervisory authority as required.

We may update this policy. Material changes will be announced in the Service or by email before they take effect, and the date at the top always shows the current version.