Privacy Policy

GrowthBrief is the operator of the GrowthBrief marketplace. Privacy enquiries are handled by the GrowthBrief Privacy Officer.

• Email: support@growthbrief.com.au
• Online: growthbrief.com.au/contact
• Postal correspondence: contact us to request our current postal address.

You may also ask us to provide this policy in another reasonably accessible form.

Depending on how you use GrowthBrief, we may collect and hold:

• Identity and contact information: name, email address, mobile number, business name, website, business address or service location, suburb, postcode, state, country and optional ABN.
• Account and security information: account identifier, account role, login and session information, verification status, multi-factor authentication status, password reset activity and account support records. Password authentication is handled by our authentication provider; we do not store readable passwords.
• Business brief information: requested services, project description, budget, timeline, location, work preferences, consent records, uploaded files and brief status.
• Verification and trust information: email and mobile verification results, delivery and attempt records, validation flags, redaction flags, duplicate indicators, fraud or misuse signals, complaint information and moderation records.
• Specialist information: business and profile details, biography, services, service areas, delivery preferences, application and approval status, alert preferences, credit balance, brief unlocks, responses, engagement status and reviews.
• Payment and transaction information: credit pack purchases, amounts, currency, Stripe checkout identifiers, payment status, refunds, credit adjustments and transaction history. Stripe processes full card details; GrowthBrief does not store full payment card numbers or card security codes.
• Technical and usage information: IP address, browser and device information, cookies, session data, pages visited, referring pages, campaign parameters, security logs, error logs and webhook delivery records.
• Communications: support enquiries, contact form submissions, emails, feedback and other correspondence with us.

GrowthBrief does not generally ask for sensitive information. Please do not include health, biometric, criminal record, political, religious or other sensitive information in a brief or upload unless it is genuinely necessary. If you provide it, we may collect it as part of that submission.

We collect information:

• directly from you when you submit a brief, create or update an account, apply as a specialist, upload a file, purchase credits, submit a review or contact us;
• automatically when you use the website, including through cookies, analytics, advertising tags, logs and security tools;
• from other marketplace users where they provide a review, engagement update, complaint or information connected with a brief; and
• from service providers such as payment, verification, email, hosting, analytics and authentication providers.

You can browse public pages without creating an account. However, we need identifying and contact information to verify briefs, establish accounts, process payments and provide marketplace access. If required information is not provided, we may be unable to provide the relevant service.

We collect, hold, use and disclose personal information to:

• operate, administer and improve GrowthBrief;
• create and secure business, specialist and administrator accounts;
• verify email addresses and mobile numbers;
• review, redact, categorise, match and publish verified briefs;
• assess specialist applications and manage approvals;
• enable specialists to unlock briefs, respond, quote and manage opportunities;
• enable businesses to manage briefs and specialist activity;
• calculate credit costs, process payments and maintain transaction records;
• send verification, account, security, payment, brief and alert communications;
• detect duplicate submissions, fraud, abuse, prohibited content and security risks;
• provide support, resolve disputes, moderate reviews and enforce our terms;
• measure website performance and marketing effectiveness;
• meet legal, regulatory, accounting and reporting obligations; and
• protect the rights, safety and integrity of users, GrowthBrief and the public.

Before a brief is unlocked, approved specialists may see a limited summary needed to assess whether the opportunity is suitable. This may include the service category, general location, budget, timeline and a redacted description. We use automated redaction and administrator controls to reduce direct contact and identifying details in this preview.

When an approved specialist unlocks a verified brief, we may disclose the business's contact details, full brief details and available uploaded files to that specialist so they can respond or quote. Public specialist access is subject to the brief's displayed specialist limit, which defaults to a maximum of three. Internal assignments count towards that limit unless an administrator marks the assignment as admin-only and outside the public pool.

Businesses may receive specialist profile, business, response and engagement information. Reviews and outcome information may be shared within GrowthBrief and, where clearly indicated, may be displayed publicly after moderation.

Although we restrict access through account, approval and unlock controls, recipients are separate businesses or individuals. Do not submit information that is unnecessary for specialists to assess and respond to the project.

GrowthBrief uses rules and software to assist with service matching, location matching, brief visibility, credit pricing, specialist slot limits, verification, duplicate detection, validation, redaction, fraud prevention and email alerts.

These processes may prioritise, restrict or flag marketplace activity. Material specialist approval, account enforcement, complaints and disputed duplicate decisions can be reviewed by a GrowthBrief administrator. You may contact us if you believe an automated rule has produced an incorrect outcome.

We disclose personal information only where reasonably necessary for the purposes described in this policy. Recipients may include approved marketplace users, authorised staff and contractors, professional advisers, regulators, law enforcement, a purchaser or successor of the business, and technology providers including:

• Supabase for database, authentication and file storage;
• Vercel for website hosting, delivery, logs and analytics;
• Resend for transactional email delivery;
• Twilio for mobile verification;
• Stripe for checkout, payment processing and fraud controls;
• Google for address search, analytics and advertising measurement;
• Meta for advertising measurement where the Meta Pixel is enabled;
• Microsoft Clarity for privacy-masked session recordings, heatmaps and website experience analysis where enabled; and
• GoHighLevel for selected workflow events where that integration is enabled.

Some providers process or store information outside Australia. Likely locations include Japan and the United States, as well as other countries in which these global providers and their subprocessors operate. Provider locations and infrastructure may change. Where required, we take reasonable steps to ensure overseas handling is consistent with applicable Australian privacy requirements.

We do not sell personal information to third parties.

GrowthBrief uses essential cookies and similar technologies for authentication, security, session continuity and core platform functions. We may also use Vercel Analytics, Google advertising and analytics tags, the Meta Pixel, and Microsoft Clarity to understand site use, identify usability problems, measure campaigns and improve the website. Clarity may create privacy-masked session recordings and heatmaps of interactions such as clicks, scrolling and navigation.

These tools may collect device identifiers, IP address, browser information, pages viewed, referring URLs and campaign interactions. You can limit non-essential cookies through browser settings and the privacy or advertising controls offered by Google and Meta. Blocking essential cookies may prevent account and dashboard functions from working correctly.

We send service communications needed to operate GrowthBrief, including verification codes, security notices, account access emails, payment confirmations, brief updates and specialist activity. These are not marketing messages.

Specialists may choose whether to receive alerts about matching verified briefs and can update alert preferences in their account. Marketing communications will include a way to unsubscribe where required. You may also ask us to stop marketing by contacting us. We may still send essential service and legal notices.

We use reasonable technical and organisational safeguards appropriate to the information we hold. These include access controls, role-based permissions, secure authentication, private file storage, encryption in transit, verification controls, audit and webhook logs, signed payment webhooks, monitoring and restricted administrative access.

No online service can guarantee absolute security. Keep your password confidential, use multi-factor authentication where available and contact us immediately if you suspect unauthorised account access.

We retain personal information only for as long as reasonably necessary to operate GrowthBrief, maintain account and transaction history, resolve disputes, prevent misuse, enforce agreements and meet legal, tax, accounting and regulatory obligations.

Retention periods vary by record type and account status. Archived or deleted records may remain in restricted systems or backups for a limited period. When information is no longer required, we take reasonable steps to delete it or de-identify it, unless retention is required or authorised by law.

You may request access to personal information we hold about you or ask us to correct inaccurate, incomplete or out-of-date information. Many profile details can also be reviewed or updated through your dashboard.

You may ask us to delete or de-identify information. We will assess the request and explain if information must be retained for legal, security, payment, fraud prevention or dispute purposes. We may need to verify your identity before acting on a request and will ask only for information reasonably necessary to do so.

Send requests to support@growthbrief.com.au or use our contact form. We do not generally charge for a request. If a lawful charge is necessary, we will explain it before proceeding.

If you believe we have mishandled personal information, contact the GrowthBrief Privacy Officer using the details in section 1. Please describe the issue, the outcome you are seeking and any relevant dates or records.

We will acknowledge and investigate the complaint, may contact you for more information and will aim to provide a response within 30 days. If you are not satisfied, you may contact the Office of the Australian Information Commissioner.

We investigate suspected data breaches and take steps to contain and reduce harm. If a breach is likely to result in serious harm and notification is required under Australia's Notifiable Data Breaches scheme, we will notify affected individuals and the Office of the Australian Information Commissioner as required.

GrowthBrief is a business marketplace and is not directed to children. Users must be able to act for themselves or an organisation in connection with business services. If you believe a child has provided personal information without appropriate authority, contact us so we can investigate.

We may update this policy when our services, providers or legal obligations change. The current version will be published on this page with its effective date. We will provide additional notice where a change materially affects how we handle personal information.