Legal

Legal & compliance

All the documents that govern using Growth Wingman, plus a single place to manage cookie preferences and review our compliance posture.

California Consumer Privacy Act

Your California Privacy Rights

Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have specific rights regarding their personal information.

  • Right to know what personal information we collect, use, disclose, and (if applicable) sell or share.
  • Right to delete personal information we have collected, subject to certain exceptions.
  • Right to correct inaccurate personal information we hold about you.
  • Right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising.
  • Right to limit use of sensitive personal information.
  • Right to non-discrimination for exercising any of these rights.

Do we sell or share your personal information?

We do not sell your personal information for money. We may "share" information for cross-context behavioral advertising when you opt in to Marketing cookies (e.g., Meta Pixel) — under California law, that counts as "sharing." You can opt out of this at any time by:

  • Clicking and turning off the Marketing & ad attribution category.
  • Enabling Global Privacy Control (GPC) in your browser — we honor it as a valid opt-out signal automatically.
  • Emailing [email protected] with the subject line "Do Not Sell or Share — California."

How to submit a request

Email [email protected] from the address associated with your account, or use our contact form. We will respond within 45 days as required by law. We will verify your identity before fulfilling deletion or access requests; we do not require account creation to submit a request.

Authorized agents

You may designate an authorized agent to submit requests on your behalf. The agent must provide written authorization signed by you, and we may verify your identity directly.

Categories of personal information we collect

In the past 12 months we may have collected: identifiers (name, email, phone), commercial information (subscription/billing), internet activity (page views, clicks, referrer), geolocation (coarse, from IP), and inferences drawn from the above for service improvement. See our Privacy Policy for full detail.

About cookies

Every cookie we use

By default we only set Essential cookies. Analytics and Marketing categories load only after you opt in via the modal.

Essential

Always on

Required for the site to function — remembers your cookie preference itself, captures UTM parameters from your landing URL for sales attribution, and powers the signup flow. Cannot be disabled.

Name Host Purpose Duration
gw_consent growthwingman.com Stores your cookie preferences so we don't ask every visit. 12 months
gw_utm growthwingman.com Captures UTM parameters from your first landing URL for sales attribution. Session

Analytics

Optional

Helps us understand which pages convert and how visitors navigate the site. Loaded only after you opt in. We do not sell this data.

Name Host Purpose Duration
_ga, _ga_* .growthwingman.com Google Analytics 4 — distinguishes unique visitors and sessions. 2 years
ph_* .growthwingman.com PostHog product analytics (proxied through our domain) — page views, click events, funnel analysis. 1 year

Marketing & ad attribution

Optional

Lets us measure which ads brought you here and reach similar audiences on Facebook and Instagram. Loaded only after you opt in.

Name Host Purpose Duration
_fbp .growthwingman.com Meta Pixel — ad campaign attribution and conversion tracking. 90 days
_fbc .growthwingman.com Meta click ID — stores fbclid from ad clicks for attribution. 90 days

Compliance posture

What's built in by default

Compliance is the product. We do not charge extra for the items below.

TCPA

We honor STOP / HELP keywords across the customer's lifetime, do not initiate to DNC numbers without express consent, and run carrier reassignment lookups before bulk sends.

A2P 10DLC

Brand and campaigns registered with The Campaign Registry before production SMS. Brand name, opt-out instructions, and a privacy link in every new conversation.

AI disclosure

Every call answered by your wingman opens with a clear AI disclosure as required by California, Florida, and other state laws.

Two-party consent recording

Where required by state law, callers are notified that calls may be recorded for quality before recording begins.

CCPA / VCDPA

California, Virginia, and other state-residents have rights to access, correction, deletion, and opt-out of 'sale' of personal information.

Encryption

Calls and SMS encrypted in transit. Recordings stored encrypted at rest. 90-day default retention, configurable per account.

Need a DPA, BAA, security questionnaire, or subprocessor list?