Checkgrow

GDPR overview

GDPR implementation is concrete and unusually well documented. The data controller is named as Checkgrow d.o.o, Ulica Vjekoslava Heinzela 60, 10000 Zagreb, Croatia, VAT HR16006061302, reachable at admin@checkgrow.com. Because the vendor is established in the EU, no Article 27 representative is required or designated. The four legal bases under Article 6 are set out individually, and all eight data subject rights are documented article by article with the concrete steps to exercise each one, on a stated thirty-day response deadline. The vendor states it takes no solely automated decisions with legal effect under Article 22, and commits to the seventy-two-hour breach notification of Article 33. The Croatian supervisory authority, AZOP, is named as the route for complaints. Transfers outside the EEA rely on standard contractual clauses, signed processor agreements and the EU-US Data Privacy Framework. Both documents carry an effective date of 1 February 2026. No DPO is appointed and no customer-facing DPA is offered.

Who owns the data?

Customers keep ownership. The terms state that you retain ownership of everything you upload, submit or create, and that Checkgrow receives only a limited licence to host, store, process and display it for the sole purpose of running the service. Ownership of AI-generated output stays with you as well, subject to any underlying rights, though the terms warn that comparable inputs may produce comparable outputs for other customers. You can delete your account yourself, immediately and permanently, and user content is removed within thirty days. Feedback and suggestions are the exception: those carry a worldwide, royalty-free and perpetual licence to the vendor.

Reuse rights

Customers may reuse their own data freely and without asking permission. Two export routes are documented: a structured PDF of the knowledge base, and a full Online Archive delivered in a machine-readable format, typically JSON or CSV, within five to ten business days. The documentation states plainly that the vendor imposes no restriction on what you do with exported data. On the vendor's own side, the privacy policy lists service delivery, communication, platform improvement, security and compliance as its purposes, each mapped to a GDPR Article 6 legal basis. AI inputs travel to a provider you choose among OpenAI, Google Gemini and Perplexity, always proxied server-side so that your credentials never reach a third party directly. One point is genuinely unresolved: the privacy policy lists training and improving the vendor's own AI models on aggregated, anonymised data among its purposes, while the security documentation states that customer data is never used to train AI models.

Data retention & training

Hosting summary

Primary storage is in the European Union. Every database holding customer content, generated results, campaigns and knowledge entries sits on Supabase infrastructure at AWS Frankfurt, in Germany, and the documentation states that data stays in Europe, so no additional transfer mechanism is needed for primary storage. Processing is broader than storage. The privacy policy names nine subprocessors with their locations: Supabase in the EU, OpenAI, Perplexity, Resend and Firecrawl in the United States, Google Gemini and Google Analytics across the US and EU, and Cloudflare and the LinkedIn API globally. Transfers outside the EEA rely on standard contractual clauses, a signed agreement with every processor and the EU-US Data Privacy Framework. Enterprise customers may run self-hosted infrastructure instead. Note that the security certifications listed beside each provider belong to those providers; Checkgrow claims no certification of its own.