Home / Privacy policy

Privacy policy

I collect as little as I can. This page explains what I collect, why, who else sees it, and how to make me delete it.

Last updated 22 October 2026

Who I am

Growth Protocol is run by David Pires, based in Zurich, Switzerland. I decide why and how your data is used, so I am the controller under the Swiss Federal Act on Data Protection (FADP) and, for visitors in the EU or UK, the GDPR. You can reach me at hello@growthprotocol.co.

What I collect

  • What you send me. Your name, work email, company and anything you write when you download a canvas, book a call or email me.
  • What your browser shares. Pages viewed, time on page, referring site, approximate location (city level), device, browser and screen size.
  • How you use the site. Clicks, scrolling and mouse movement, collected as heatmaps and recordings. Text you type into forms is masked.

I do not collect payment details here, and I do not knowingly collect data from children.

Why, and on what basis

  • Replying to you and sending what you asked for. This is needed to answer you, or to take steps you asked for before a contract.
  • Analytics and recordings. Only with your consent, which you give in the cookie banner. Without it, no analytics or recording cookies are set.
  • Marketing measurement and linking visits to your contact record. Only with your consent.
  • Keeping the site secure and working. My legitimate interest. No consent is needed for this.

Cookies and the tools I use

Cookies other than essential ones wait for your choice in the cookie banner. Tools are loaded through Google Tag Manager, and your choice is passed to them using Google Consent Mode. Before you choose, Google tags can send limited signals without cookies or identifiers (for example that a page was viewed, with no ID stored on your device), which Google uses for aggregate and modelled reporting. Recording and marketing tools stay off until you consent. You can change it at any time with here or in the footer. If you turn something off, I delete the cookies it set.

Essential

  • Google Tag Manager (Google). Loads the other tools below. It does not collect anything on its own. Their policy.

Analytics

  • Google Analytics (Google). Counts visits and shows which pages and sources bring people here. Uses cookies starting with _ga. Their policy.
  • Microsoft Clarity (Microsoft). Shows heatmaps and anonymised session recordings so I can see where people get stuck. Their policy.
  • PostHog (PostHog Inc, EU cloud). Product analytics, session recordings and short surveys. Data is stored in the EU. Form fields are masked in recordings. Their policy.
  • Contentsquare (Contentsquare SAS (France)). Heatmaps and session recordings to see how pages are used. Uses cookies starting with _cs. Their policy.
  • Hotjar (Hotjar Ltd (Malta)). Heatmaps, recordings and short on-page surveys. Form fields are not recorded. Their policy.

Marketing

  • HubSpot (HubSpot). Stores your details when you fill in a form or book a call, and links your visits to that record if you allow marketing cookies. Their policy.

Your consent choice is stored in your browser (local storage) for 12 months, then I ask again.

Who else sees your data

The providers listed above process data for me. When you book a call, the form is hosted by Typeform, which receives the details you enter and passes them to me. I do not sell your data and I do not share it for anyone else's advertising. I may share it with professional advisers or authorities if the law requires.

Transfers abroad

Some providers are in the US or elsewhere outside Switzerland and the EU. Where that happens, transfers rely on an adequacy decision, such as the Swiss-US and EU-US Data Privacy Frameworks where the provider is certified, or on standard contractual clauses.

How long I keep it

  • Contact and CRM records: until you ask me to delete them, or about 24 months after our last contact.
  • Analytics data: up to 14 months in Google Analytics, and as set by Clarity and Hotjar (typically 12 months or less).
  • Emails to hello@growthprotocol.co: as long as needed to deal with your request, then deleted or archived as the law requires.

Your rights

You can ask me to show you your data, correct it, delete it, restrict how I use it, or send it to you in a usable format. You can withdraw consent at any time, and you can object to marketing messages. Email hello@growthprotocol.co and I will reply within 30 days.

If you are not happy with my answer, you can complain to a data protection authority. In Switzerland that is the Federal Data Protection and Information Commissioner (FDPIC). In the EU or UK, it is the authority where you live.

Other sites

This site links to LinkedIn and other sites. They have their own policies and I am not responsible for them.

Changes

If I change this policy, I will update the date above. For material changes, such as a new tool that sets cookies, I will ask for your consent again.