Privacy policy

Data controller

• Company name: Rowan, S. Coop. Galega (hereafter, "Rowan Growth")
• Tax ID (NIF): F26697466
• Address: C/ Cesáreo González, 25 — 36210 Vigo (Pontevedra), Spain
• Email: hola@rowangrowth.es
• Phone: +34 698 93 94 76

We have not appointed a Data Protection Officer (DPO) because we do not process data on a large scale and do not fall under the cases listed in article 37 GDPR. For any data-related question, email hola@rowangrowth.es.

What we process and why

We process your data for the following purposes:

• Free audit and contact forms: name, email, and web domain, to run the requested audit and reply to your query.
• Newsletter and commercial communications: email, to send you content about SEO/GEO and product updates. Only with your express consent.
• Delivery of the contracted tool: identifying, tax, billing, and access data for your marketing integrations (Search Console, CMS, analytics) so the program can audit, publish, and measure on your behalf. Only if you're an active customer.
• Compliance with legal obligations: tax and accounting data required by tax law.
• Browsing data: IP address, browser, and pages visited, collected via server technical means to maintain site security. See the Cookie policy for details.

Legal basis for processing

• Consent (art. 6.1.a GDPR) — audit forms, newsletter, and non-technical cookies.
• Performance of a contract (art. 6.1.b GDPR) — delivery of the contracted tool and complementary services.
• Legal obligation (art. 6.1.c GDPR) — invoicing, taxation, and accounting retention.
• Legitimate interest (art. 6.1.f GDPR) — site security, fraud prevention, and communications to active customers about products similar to the one contracted.

Retention periods

• Lead data without contract: up to 24 months from last contact, unless prior deletion request.
• Contract and billing data: 6 years from end of relationship (art. 30 Spanish Commercial Code).
• Tax data: 4 years (art. 66 LGT) or the applicable legal term, whichever is longer.
• Newsletter and marketing: until you withdraw consent.
• Server logs: 30 days, unless retention is required due to a security incident.

Data from your Google account

If you connect your Google account from the tool, Rowan Growth only accesses the services you authorize on Google's consent screen, and only for the websites you add:

• Basic account data (name, email and profile picture): to know which Google account you have connected.
• Google Analytics (read-only): visits, users, top pages and traffic sources of the property you choose.
• Google Search Console (read-only): queries, impressions, clicks and average position for your website. If you turn on indexing requests, we also ask Google to crawl the new pages we publish for you.
• Google Business Profile (only if you connect it): to pick your listing and publish the updates you prepare in the tool.

We use this data only to show you your metrics, give you recommendations, prepare the weekly letter and publish on your behalf what you ask us to. To generate recommendations and the letter, metrics are sent to our artificial intelligence providers (Anthropic and OpenAI) through their API, which does not use them to train their models.

• We do not sell Google data or use it for advertising.
• We do not use it to train artificial intelligence models.
• No one on our team views it unless you give us permission (for example, to solve an issue), for security reasons or to comply with the law.
• The access Google grants us is stored encrypted, and metrics are kept for as long as the website remains in your account.

You can revoke access at any time at myaccount.google.com/permissions. If you delete the website or your account, or ask us at hola@rowangrowth.es, we delete the access and the data obtained from Google within 30 days.

Rowan Growth's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Recipients and data processors

We do not sell or share your data with third parties for commercial purposes. We share data exclusively with the following providers, under data processing agreements pursuant to article 28 GDPR:

• Web hosting and email: 1&1 IONOS España S.L.U. (Spain, EU).
• Payment gateway (customers only): Stripe Payments Europe Ltd. (Ireland, EU).
• Code repository and workflows: GitHub Inc. — limited to operational logs (no customer personal data); international transfer covered by Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework.
• Artificial intelligence (tool customers only): Anthropic PBC and OpenAI (USA), through their API, to write articles, recommendations and the weekly letter from your website data and metrics. They do not use this data to train their models.
• Search ranking data: DataForSEO, to look up rankings, keywords and business listings in search engines. It only receives domains, keywords and locations, no personal data.
• Tax and labor advisors: licensed professionals bound by professional secrecy.

Access is limited to the data strictly necessary for each engagement. We keep an up-to-date register of processors available upon reasoned request.

International transfers

Data is mainly processed within the European Economic Area. Where a transfer outside the EEA occurs (as with the code repository hosted by GitHub Inc. or the artificial intelligence providers Anthropic and OpenAI, in the USA), it is safeguarded under valid GDPR mechanisms (Standard Contractual Clauses or current adequacy frameworks, such as the EU-US Data Privacy Framework).

Your rights

You may exercise the following rights over your personal data at any time:

• Access to the data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure when no longer necessary.
• Restriction of processing.
• Objection to processing based on legitimate interest.
• Portability to another controller.
• Withdrawal of consent at any time, with no retroactive effect.
• Not to be subject to automated individual decisions (we don't run any).

To exercise any of these rights, email hola@rowangrowth.es identifying yourself and stating which right you're exercising. We will respond within one month.

If you believe the processing does not comply with regulations, you may file a complaint with the Spanish Data Protection Agency (AEPD): C/ Jorge Juan, 6 — 28001 Madrid · electronic office sedeagpd.gob.es.

Automated decisions and profiling

We do not make automated individual decisions with significant legal effects on data subjects, nor do we build profiles from the data collected on this site.

Security

We apply reasonable technical and organizational measures to protect data against unauthorized access, loss, or alteration: encryption in transit (HTTPS/TLS), role-based access control, periodic backups, and continuous vulnerability review. In the event of a security breach affecting your data, we will inform you within the legally required deadline.

Changes

This policy may be updated to reflect legal, technical, or service changes. We recommend reviewing it periodically. The last-updated date appears in the header.

For questions about this policy or the exercise of your rights, email hola@rowangrowth.es.