// Legal
Privacy Policy
1. Who we are
Growth Loop Advisors LLC (“Growth Loop Advisors,” “GLA,” “we,” “us,” “our”) is a Virginia limited liability company. We provide enterprise go-to-market advisory to companies and investors: GTM diagnostic sprints, Micro Growth Loop acceleration, embedded commercial leadership, and the Growth Loop Engine, our intelligence platform for customers.
This Privacy Policy explains how we handle personal information in connection with our website at growthloopadvisors.com (the “Site”) and our advisory services (the “Services”). It does not apply to the websites, products or services of our customers or of any third party.
2. Our two roles
How we handle personal information, and who you should contact about it, depends on the context.
As a controller. For personal information about visitors to our Site, prospective customers, business contacts, our own personnel and applicants, we decide why and how the information is used. This Policy governs that handling directly, and you can exercise your rights with us.
In engagements. When we deliver an engagement for a customer organization, we handle information about that customer's employees, customers and other stakeholders on the customer's behalf and under our agreement with the customer. This includes information in the Growth Loop Engine. Our notes, analyses and deliverables identify interviewees and call participants by participant codes, not names. If your personal information was collected in a customer's engagement and you want to exercise a privacy right, please contact that organization; if you contact us instead, we will refer your request to the relevant customer and support them in responding.
3. Information we collect
3.1 Site visitors. Our Site is an informational website hosted on Vercel and served through Vercel's content delivery network. We do not operate a customer login or account area on the Site itself.
Forms. The Site offers two forms: one to book a working session and one to receive our executive brief. When you submit one, we collect the information you enter: your name and business email address and, depending on the form, your company or fund, your role, the topic you choose and your message. Form submissions are processed by our website host (Vercel) and delivered to our Microsoft 365 mailbox by our email delivery provider (Resend). When you request the executive brief, Resend also sends you an email with a download link that works for seven days. When you request a working session, Resend sends you a confirmation email with a link to our scheduling page. Resend keeps a record of the emails it delivers in line with its own retention settings. We use form submissions only to respond to you and to manage the business relationship you are asking about.
Scheduling. If you choose a meeting time through our scheduling page, it is provided by Microsoft Bookings, part of Microsoft 365, on Microsoft's own website. Microsoft collects the name, email address and details you enter and sends the calendar invitation; Microsoft's own cookie and privacy terms apply on that page.
Server logs. Our hosting infrastructure records standard technical information when a page is requested, which may include IP address, browser and device type, the page requested, the referring page and the time of the request. These records exist for security, abuse prevention and operational purposes. We do not use them to identify individual visitors or for advertising.
Analytics and cookies. We use analytics tools to understand how visitors use the Site. Google Analytics, which uses cookies, runs with cookies only if you accept it. See Section 8.
3.2 Business and prospect contacts. When you contact us, or we contact you, we collect the information you provide: typically name, business email address, telephone number, employer, job title and the content of our correspondence. We may also collect business contact information from public sources such as company websites and professional networking sites.
3.3 Engagement information. In an engagement we work with the information the customer provides or makes available to us, such as pipeline and CRM exports, call recordings and transcripts, deal notes, and the notes from our stakeholder interviews. Our notes, analyses and deliverables identify interviewees and call participants by participant codes, not names, unless the customer asks otherwise in writing. Source material the customer provides, such as call recordings, transcripts and CRM exports, may contain names; we keep it only for the engagement and handle it under our agreement with the customer. We record interviews only with notice to, and the consent of, every participant. We collect no biological or biometric data about anyone. We ask customers not to send us sensitive categories of information, such as government identifiers, financial account numbers, health information or biometric data, because our Services are not designed to process them. We do not accept protected health information (as defined under HIPAA) except under a signed business associate agreement.
3.4 The Growth Loop Engine. The Growth Loop Engine is our web application for engagements, at glengine.growthloopadvisors.com. Only people a customer or Growth Loop Advisors has authorized can sign in, using a one-time code we email to their work address; there are no passwords. For each authorized person we hold their name, work email address, their role in the customer's workspace and when they last signed in. The Engine holds the engagement information that the customer's team and our advisors enter into it, such as growth loops, the indicators and readings that track them, hypotheses and what was learned. Each customer's information is kept in that customer's own workspace, which only that customer's authorized people and our advisors can open. The Engine uses no analytics, advertising or tracking tools; the cookies it sets are described in Section 8.6.
3.5 Personnel and applicants. We collect information necessary to engage personnel and evaluate applicants, used only for employment, contracting and legal compliance purposes.
4. How we use information
We use personal information to:
- deliver, operate and improve the Services and the Site;
- communicate with customers and prospects about engagements, proposals and support;
- send you what you asked for, such as the executive brief;
- secure our systems and detect, investigate and respond to security incidents and abuse;
- maintain business records, invoice, and manage vendor relationships; and
- comply with legal obligations and enforce our agreements.
We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use customer or engagement information for our own marketing.
5. Artificial intelligence
Our advisory is delivered by people, and the recommendations we make to customers are made by our team.
We do not use customer information, engagement information or information about our customers' people to train, fine-tune or improve any artificial intelligence model, ours or anyone else's.
7. Where information is stored, and for how long
Growth Loop Advisors operates from the United States, and our service providers store and process information in the United States. If you access our Site from outside the United States, your information will be transferred to and processed in the United States, where data protection laws differ from those of your country.
Engagement information is retained for the period set out in the applicable customer agreement; where the agreement is silent, we retain it only as long as needed to deliver the Services.
Business and prospect contacts are retained while the relationship is active and for 24 months after our last contact, then deleted.
Records we must keep, such as contracts, invoices, and tax and corporate records, are retained for the periods required by law.
Backups are overwritten on their normal cycle, so information may persist in backups for a limited period after deletion. A legal hold suspends deletion for the information covered by it.
9. Security
We maintain reasonable administrative and technical safeguards for the information entrusted to us, including: least-privilege access on a need-to-know basis; multi-factor authentication on our accounts; encryption in transit and at rest through our service providers; participant codes rather than names in engagement records; sign-in to the Growth Loop Engine by a one-time code sent to the person's work email address, with each customer's information kept in its own workspace; and separation of engagement information from marketing.
No system is completely secure and we cannot guarantee absolute security. If you believe you have found a security issue, contact info@growthloopadvisors.com.
10. Your rights
Depending on where you live and on our role, you may have the right to request access to the personal information we hold about you, correction, deletion, a portable copy, restriction of or objection to certain processing, and withdrawal of consent where processing relies on it. You have the right not to be discriminated against for exercising these rights.
How to make a request. Email info@growthloopadvisors.com describing your request. We will acknowledge it and respond within 30 days of receipt, unless a longer period is permitted by law and we notify you. We verify identity before acting on a request, and will explain if we must decline. You may use an authorized agent, with proof of authorization. Where we hold information on a customer's behalf, we will refer your request to that customer, as described in Section 2.
Virginia. If we decline a request from a Virginia resident under the Virginia Consumer Data Protection Act, you may appeal by replying to our response; we will answer the appeal within 60 days. We do not process personal information for targeted advertising, do not sell it, and do not profile anyone in furtherance of decisions with legal or similarly significant effects.
California. We do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so in the preceding twelve months.
European Economic Area and United Kingdom. If the GDPR or UK GDPR applies to our handling of your personal information, we rely on your consent for analytics cookies (which you can withdraw at any time in Cookie settings), on our legitimate interests in running our business and responding to business contacts, and on the performance of a contract for engagements. Our service providers process information in the United States under the EU-U.S. Data Privacy Framework (and its UK extension) or the Standard Contractual Clauses in their data processing terms. You may also complain to the data protection supervisory authority where you live or work.
11. Children
Our Services are for businesses and investors. They are not directed to children and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.
12. Changes to this Policy
We may update this Policy. We will revise the “Last updated” date and, where a change is material and affects customers, notify affected customers by email to the designated contact. Material changes take effect 30 days after notice, except where an earlier date is required by law. Prior versions are available on request.
13. Contact us
Growth Loop Advisors LLC
3830 Lightfoot St, #129, Chantilly, VA 20151
General inquiries and privacy and security inquiries: info@growthloopadvisors.com
We respond to privacy and security inquiries promptly.