Privacy Policy
Last updated 23 September 2026 · Delegated AI Inc (GrowthXL)
This Policy includes the specific disclosures required by the laws of California, Colorado, Connecticut, Oregon, Texas, Virginia and other states with comprehensive consumer privacy laws. Questions? Email care@growthxl.ai.
1. Quick summary
- We collect contact information, business information, payment information and online activity data.
- Through the App we also process the texts, calls and contact details that our business customers exchange with the people who contact them, their leads. That data belongs to the business; we process it on the business's behalf.
- We use information to deliver our Services, to market to prospective customers, and to run our business.
- We share information with service providers, advertising partners, and as the law requires. App data is never shared with advertising partners, and the App contains no advertising or analytics SDKs.
- We do not sell personal information for money. We do share certain website information with advertising partners for cross-context behavioural advertising, and you can opt out at any time.
- We record our sales, onboarding and support calls. Calls placed inside a business's account are recorded only if that business has turned recording on; it is off by default.
- You have rights to access, delete, correct and limit how we use your information. Section 13 explains how to use them.
2. Mobile communication policy
2.1 Messages we send you
We value your privacy and are committed to protecting your personal information. When you give us your mobile number, you consent to receive SMS messages about our services, including notifications, account communications and, if you opt in, marketing offers. Your mobile opt-in will not be shared with third parties for their marketing.
- Opt out: reply STOP to any message at any time.
- Help: reply HELP for support.
- Frequency: message frequency varies with your interactions with us.
- Cost: standard message and data rates apply under your carrier's terms.
Your phone number may be processed by our messaging and CRM service providers solely to deliver the messages you have consented to receive.
2.2 Messages sent through a business's account
Our business customers use the Platform and the App to text and call their own leads from a business phone number we provision for them. Those messages are sent by the business, not by Delegated AI Inc, and the business is responsible for having the consent it needs to contact its leads. Every conversation honours opt-out keywords automatically: a lead who replies STOP, or a similar keyword such as UNSUBSCRIBE or CANCEL, is unsubscribed from that business's number and receives no further texts from it unless they opt back in by replying START. Message frequency depends on the lead's conversation with the business. Standard message and data rates apply.
3. Information we collect
| Category | Examples |
|---|---|
| Identifiers | First and last name, email, phone number, postal address, IP address, account username, business name |
| Commercial information | Services purchased, subscription details, billing history |
| Financial information | Payment card information, processed by Stripe, and billing address |
| Internet activity | Pages visited, links clicked, time on site, referring URL, device and browser data |
| Geolocation, approximate | City and state derived from IP address. We do not collect precise geolocation |
| Audio recordings | Our sales, onboarding and support calls; calls placed inside a business's account where that business has enabled recording, and voicemails left for the business |
| Professional information | Job title, trade or industry, business size |
| Inferences | Profiles built from the above to judge fit for our Services |
| Sensitive personal information | Account login credentials and payment card information |
| App account data | Your name, work email and mobile number used to sign in and verify you; which business accounts you can access and your role in them |
| App content, processed for the business | The names and phone numbers of the business's leads; texts and photos exchanged with them through the business's number; call records; voicemails; call recordings where enabled |
| App device data | A push-notification token, the device platform and App version, and when you last used the App |
| Usage metering | The number of text segments and call minutes used by the business, billed to its account |
We do not knowingly collect precise geolocation, racial or ethnic origin, religious beliefs, sexual orientation, immigration status, genetic data, biometric data, health information, or information about children under 16.
The App does not collect your location, your address book, your phone's own SMS or call log, your browsing history, or health or financial information, and it contains no advertising, analytics or tracking SDKs. The microphone is used only during a call you place or answer in the App. The photo library is accessed only when you choose a photo to attach to a message.
4. Where we get your information
- Directly from you, when you fill out a form, book a call, sign up, contact us or sign in to the App.
- From your device, through cookies, pixels and similar technologies on our Sites, and through the push-notification token your device issues if you allow notifications.
- From our business customers, when a business adds you as an owner or staff member, or when a business's leads contact it and their messages reach us through the business's number.
- From advertising partners such as Meta and Google, which deliver our advertising.
- From service providers, including our CRM and messaging platform, our payment processor and our telephony carrier.
- From publicly available sources, such as business directories and public records.
5. How we use your information
- To provide and operate the Services and the App: account creation, billing, support, delivering the business's texts and calls, push notifications, and metering usage for billing.
- Sales and marketing: responding to enquiries, following up on leads, sending promotional email and SMS where consented, and retargeting on advertising platforms. App data is not used for marketing.
- Analytics and improvement: understanding how the Sites and Services are used, diagnosing problems and developing features.
- Advertising: measuring ad performance, building lookalike audiences and retargeting visitors to our Sites. This counts as "sharing" under California law, see Section 7. It does not apply to the App.
- Quality assurance and training: reviewing recordings of our own sales, onboarding and support calls.
- Security and fraud prevention: detecting and preventing fraudulent or unauthorised activity, including logging every access to a business's account by our staff.
- Legal compliance: complying with law, court orders and regulatory requirements, including telecom messaging rules.
- Business operations: accounting, recordkeeping, audits and corporate transactions.
We will not use your sensitive personal information for purposes other than those permitted by California law without first offering you the right to limit that use.
6. How we share your information
| Recipient | Purpose |
|---|---|
| Service providers for the Sites and Services: our CRM and messaging platform, payment processor, hosting providers, email and SMS senders, analytics providers | To deliver the Services on our behalf, under written contract |
| Telephony carrier | To deliver text messages and calls on our behalf |
| Advertising partners such as Meta and Google | To deliver and measure advertising for our Sites. This counts as "sharing" under California law. App data is never shared with advertising partners |
| Professional advisers: lawyers, accountants, auditors | For legal, accounting and compliance purposes |
| Acquirers | In connection with a merger, acquisition, financing or sale of assets |
| Government authorities | Where required by law, subpoena or court order |
We require service providers to use personal information only for the purposes we authorise, under contractual obligations of confidentiality and security.
Between a business and its leads. When you contact one of our business customers, your messages, calls and contact details are shown to the owner and staff of that business, and to the Delegated AI Inc staff assigned to that account. We process that information as a service provider to the business.
7. Sale and sharing of personal information
We do not sell personal information for money.
We do share the following categories collected on our Sites with advertising partners for cross-context behavioural advertising, which is treated as a "sale" or "sharing" under California, Colorado, Connecticut and other state laws:
- Identifiers, such as online identifiers and IP address
- Internet activity, such as pages visited and ads clicked
- Inferences
You can opt out at any time by emailing care@growthxl.ai with the subject line "Opt Out of Sale/Sharing", or by enabling a Global Privacy Control signal in your browser, which we honour automatically for residents of states that recognise universal opt-out signals.
We do not sell or share any information collected inside a client account, and we do not knowingly sell or share the personal information of consumers under 16.
8. Cookies, pixels and tracking technologies
We use cookies, pixels and similar technologies on our Sites to keep you logged in and remember preferences (essential), to measure traffic and performance (analytics), and to deliver and measure advertising. The App uses none of these: it stores only your session and preferences on your device, sends nothing to advertising or analytics providers, and does not track you across other companies' apps or websites.
You can manage cookies through your browser settings, through a Global Privacy Control signal, or through the industry opt-outs at optout.aboutads.info and optout.networkadvertising.org. We do not use session replay on our Sites.
9. Call recording
9.1 Calls with Delegated AI Inc
We record sales, onboarding and support calls for quality assurance, training, recordkeeping and dispute resolution. At the start of each call we give a verbal notice that it is being recorded. By continuing the call after that notice you consent to being recorded. If you would rather not be recorded, tell us at the start and we will end or pause the recording. Recordings are stored securely, accessible only to authorised personnel and our service providers, and retained as described in Section 11.
9.2 Calls placed or received inside a client account
Calls between a business and its leads are recorded only where the business's owner has asked us to enable recording. Recording is off by default. Where it is on, the business is responsible for giving any notice and obtaining any consent required by the laws that apply to it and to the person it is calling, and several states require the consent of every party. Recordings and voicemails are encrypted at rest and available only to the business's owner and staff and the Delegated AI Inc staff assigned to the account. A business can ask us to turn recording off at any time.
10. The GrowthXL app
The App is provided to businesses that are Delegated AI Inc customers, so their owners and staff can text and call their leads from the business's phone number. Accounts are created by us for our customers; there is no public sign-up.
- Who is responsible for what. For your own login and device data, Delegated AI Inc is the controller. For the business's leads and their conversations, the business is the controller and we act as its processor.
- Permissions. The App asks for the microphone during calls, notifications for new messages and calls, and the photo library only when you attach a photo. It does not request location, contacts or access to your phone's own SMS or call log.
- No tracking. The App does not track you across other companies' apps or websites and contains no advertising or third-party analytics.
- Staff access. Delegated AI Inc staff assigned to a business can open that account to provide support. Every such access is logged.
- Account deletion. Email care@growthxl.ai and we will complete your request within 30 days. Deleting your login does not delete the business's conversations, which belong to the business.
- Leads' choices. A lead who no longer wants texts from a business can reply STOP at any time, and it is honoured automatically.
11. Data retention
| Data type | Retention |
|---|---|
| Customer account records | While the account is active, and afterwards unless you request deletion or we determine the data is no longer needed for legal, accounting or legitimate business purposes |
| Marketing leads | Until you request deletion or opt out, or until we determine the information is no longer needed |
| Billing and tax records | At least 7 years, as required by law |
| Call recordings, sales, onboarding and support | Retained for training, quality assurance and dispute resolution |
| Website analytics, identifiable | Up to 26 months |
| Cookies | Session-only or up to 13 months, depending on type |
| Support tickets | While the account is active and for a reasonable period afterwards |
| App login and device push tokens | While you have access to a business on the App, deleted within 30 days of a completed deletion request |
| Messages, call records, voicemails and recordings | For as long as the business is a Delegated AI Inc customer, then handled under that business's agreement with us |
| Usage metering | With billing records, at least 7 years |
You may request deletion at any time as described in Section 13. After deletion we may keep limited information needed to comply with legal obligations, resolve disputes, prevent fraud and enforce our agreements.
12. Your privacy rights
| Right | What it means |
|---|---|
| Know and access | Get a copy of the personal information we hold about you |
| Delete | Request deletion of your personal information |
| Correct | Fix inaccurate personal information |
| Portability | Receive your information in a portable format |
| Opt out of sale or sharing | Stop us sharing your information for cross-context behavioural advertising |
| Limit use of sensitive information | Restrict use of sensitive personal information to limited purposes |
| Non-discrimination | We will not deny service, charge a different price or give a different quality of service for exercising your rights |
| Appeal | If we deny your request you can appeal, in Virginia, Colorado, Connecticut, Texas and Oregon |
If you are a lead of one of our business customers and your request concerns the messages or calls you exchanged with that business, we will forward your request to that business or direct you to it, because the business controls that information.
13. How to exercise your rights
Email care@growthxl.ai with what you would like. We will:
- Acknowledge your request within 10 business days.
- Respond within 45 days. If we need more time we will tell you, and may extend by a further 45 days.
- Handle the first request in any 12-month period at no charge.
Verification. To protect your information we will ask you to confirm details we already hold, such as your email address and our last interaction with you. We may ask for more verification where the request involves sensitive information.
Authorised agents. You may appoint an agent to make a request for you. We will require written, signed authorisation and will verify your identity.
Appeals. If we deny your request and you live in Virginia, Colorado, Connecticut, Texas or Oregon, you may appeal by emailing us with the subject line "Appeal". We will respond within 45 days, or 60 days for Colorado and Texas.
14. State-specific disclosures
14.1 California (CCPA and CPRA)
In the past 12 months we have collected the categories in Section 3, disclosed them for business purposes to service providers and professional advisers, and shared website data with advertising partners for cross-context behavioural advertising as described in Section 7. We have not sold personal information for monetary consideration and have not knowingly collected or sold the personal information of consumers under 16. California residents may appoint an authorised agent. We do not offer financial incentives in exchange for personal information.
14.2 Colorado, Connecticut and Oregon
Residents have the rights in Section 12, including the right to opt out of targeted advertising, sale and certain profiling. We honour Global Privacy Control as a universal opt-out signal.
14.3 Virginia
Virginia residents have the rights in Section 12. We do not engage in profiling that produces legal or similarly significant effects.
14.4 Texas
Texas residents have the rights in Section 12. As Texas law requires us to state: we do not sell sensitive personal data, and we do not collect or sell biometric personal data.
14.5 Other states
Residents of other states with comprehensive privacy laws, including Utah, Iowa, Montana, Tennessee, Indiana, Florida, Delaware, New Jersey, New Hampshire, Kentucky, Maryland, Minnesota and Rhode Island, have the rights granted by their state's law. Contact us as described in Section 13.
15. Children's privacy
The Sites and Services are not directed to children under 16, and the App is a business tool intended for adults. We do not knowingly collect personal information from children under 16. If you believe we have, email us and we will delete it.
16. Data security
We use reasonable administrative, technical and physical safeguards, including encryption in transit, encryption at rest with our hosting providers, access controls, logging of staff access to customer accounts, and vendor due diligence. No method of transmission or storage is completely secure, so while we use commercially acceptable means to protect your data we cannot guarantee absolute security.
17. International users
The Sites, Services and App are operated from the United States. If you access them from elsewhere, your information will be transferred to and processed in the United States, and by using them you consent to that transfer.
18. Third-party links
Our Sites link to third-party websites and services. This Policy does not apply to them, and we encourage you to read their privacy policies.
19. Changes to this Policy
We may update this Policy from time to time. The date at the top reflects the most recent change. If we make material changes we will notify you by posting a notice on the Sites or in the App, or by email. We review this Policy at least once every 12 months.
20. Contact us
Delegated AI Inc
Delegated AI Inc, 1130 Ogletown Road, Suite 2, #2749, Newark, DE 19711, USA
Email: care@growthxl.ai
Questions about this page? Email care@growthxl.ai.