Privacy Policy

Theo, operated by Growth Collective (wearegrowth.co). Last updated: November 2, 2026.

Who we are

Theo is an AI teammate for marketing agencies and the brands they work with. Teams talk to Theo in Slack and in Theo Console. Theo reads the marketing platforms a team connects, reports on performance, answers questions, and prepares drafts (for example ad drafts, email campaign drafts and documents) that people review and approve. Growth Collective ("we", "us") operates Theo.

Who this policy covers

• Our customers' team members: the people who sign in to Theo Console or talk to Theo in Slack.
• People in our customers' data: for example a brand's email subscribers or store customers, when a customer connects a platform that holds that data. For this data we act on our customer's behalf (as a processor or service provider), and the customer decides what is connected and why.

Information we collect

• Account information: name, email address, role and workspace membership, and, when a workspace links them, a person's Slack identity (user id, display name and profile picture).
• Messages and requests: what people ask Theo in Slack channels Theo is a member of, in threads Theo is part of, and in Theo Console chats, plus Theo's answers.
• Connected platform data: when a workspace connects a platform, we access the data that platform's API provides under the permissions granted during the connection. Depending on what is connected this can include advertising accounts, campaigns, creative and performance (Meta, Google Ads, TikTok and similar); store, product and order data (Shopify); email and SMS marketing data such as campaigns, flows, lists, segments, metrics and subscriber profiles (Klaviyo); documents and pages people choose to share (Google Drive, Notion); Slack channel names, members and messages where Theo is present; and other apps a workspace chooses to connect.
• Content you create or upload: files, creative assets, notes, client records, rules and settings.
• Usage and security records: actions taken by people and by Theo are recorded in an audit log, along with the technical logs needed to run and secure the service.

How we use information

• To provide the service: answer questions, report on performance, keep client records, prepare drafts, and, only when a person with the right permission approves, make changes in a connected platform.
• To secure the service: authentication, permissions, audit trails, abuse prevention and troubleshooting.
• To support customers and improve the reliability of the service.

We do not sell personal information. We do not use customer data or connected platform data to train general-purpose AI models, and we do not use connected platform data to advertise our own products.

AI processing

To answer a request, Theo sends the relevant parts of the conversation and the data needed to answer it to AI model providers, who process it on our behalf to generate a response (for example our language model and media analysis providers). Theo's answers can be wrong, so people review drafts and approve changes before anything is published or changed in a connected platform.

How information is shared

• Service providers that host and run Theo: cloud hosting and databases, object storage, a partner for connecting and signing in to third-party apps, and AI model providers. They may use the data only to provide their service to us. We can share the current list of these providers with a customer on request.
• Connected platforms: when a person approves a change, Theo sends it to the platform it is meant for.
• Within a workspace: information is visible to that workspace's members according to their roles.
• Legal reasons: when required by law, or to protect the rights, safety and security of our users and the service.

Storage and security

Platform credentials and access tokens are encrypted at rest (AES-256-GCM) and are never sent to browsers. Each workspace's data is kept separate, and access is enforced by role. Files and media are stored privately and served through short-lived signed links. Data may be processed in the United States and in other countries where our providers operate.

Retention and deletion

• Workspace administrators can disconnect a platform at any time, which deletes its stored credentials immediately and stops further access.
• We keep data for as long as the workspace uses Theo, or as needed to provide the service, meet legal obligations and resolve disputes. When a workspace is closed, we delete or anonymise its data within a reasonable period unless the law requires us to keep it.
• You can request deletion of your data as described on our data deletion page. We honour platform data deletion requirements, including Meta's data deletion callback and Shopify's privacy webhooks.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, and to object to or restrict certain processing. If your information reached us through one of our customers (for example as a brand's subscriber), please contact that customer first; we will help them respond. Contact us at the address below to make a request.

Third-party platforms

Your use of each connected platform stays governed by that platform's own terms and privacy policy. We access only the permissions granted during the connection, and they can be revoked at any time from the platform's own settings or from Theo Console.

Children

Theo is a business service and is not directed to children under 16.

Changes to this policy

We may update this policy as the service changes. We will post the new version here with a new date and tell workspace administrators about material changes.

Contact

Privacy questions and requests: periel@wearegrowth.co