Privacy — corporate Growth operation
Effective from: 2026-10-10.
Controller and scope
STARTHROP DYNAMICS UNIPESSOAL LDA, tax number 519488261, registered at Rua da Sociedade, n.º 4, 2695-567 São João da Talha, Portugal, controls the administrative Starthrop Growth API operation. EU Delivery ID, Combinado and Átrio are Starthrop products, not separate institutional owners. This policy covers corporate Meta assets, internal analysis and reports. Product policies and the institutional contact-form policy continue to govern their respective processing.
Data and purposes
The administrative integration reads identifiers and names of the business portfolio, app, system user, advertising account, Pages and professional profiles; campaign status; media identifiers, types and timestamps; and authorised aggregate metrics. These support corporate asset administration, auditing, performance analysis and decisions. Identifiers, names, content and interactions may be personal data. Measurement may cover acquisition, visits, installations, registration, activation, usage, retention, subscriptions, revenue, cancellation and performance, according to features actually enabled in each product. Telephone and address needed for product functions follow their specific purpose and policy. They are not sent to every tool: ordinary GA4 events do not receive identifiable telephone, email or address. New flows depend on purpose, configuration and consent where required; reporting APIs do not create missing events.
Legal basis and minimisation
Corporate administration and security rely on Starthrop’s legitimate interest in operating and auditing its business presence, subject to assessment of people’s rights. Legal obligations apply only where relevant. A Meta technical permission is not itself a legal basis for all processing. Operators select necessary assets and fields and must not reuse information for incompatible purposes.
Recipients and safeguards
Meta supplies platform data. The Observer hosted by Render keeps the credential on the server and returns results to the authenticated administrative client. Operators may examine results in OpenAI tools and save approved reports in Google Drive. Windsor has been cancelled and is not part of the future Observer/API flow; access and data from its remaining historical period are handled separately. Google Cloud Storage may hold a copy if the file is included in the corporate archive. Access is restricted to authorised operators; reports and demonstrations must exclude secrets. Google Workspace Business Standard and ChatGPT Pro are used. OpenAI processes data under the individual EEA terms and its privacy policy, including international transfers; Pro is not an enterprise processing agreement. There is no guarantee of exclusive Portuguese residency. Use of new chats for training was disabled on 10 October 2026; this does not erase earlier content. Information about recipients and transfer safeguards can be requested through the contact below.
Retention and deletion
The Observer Meta adapter does not itself persist response bodies in a permanent repository. Results may remain in receiving clients, conversations, reports or recordings. Each report is retained only while necessary for its documented purpose, with necessity reviewed when a request is handled or work ends. The contact-form 12-month period does not automatically apply. Render runtime logs are retained for 7 days on Hobby. ChatGPT conversations remain until user deletion; OpenAI states removal within 30 days after deletion, subject to legal/security exceptions and previously de-identified data. Library files require separate handling. Drive trash is recoverable and documented to expire after 30 days; versions and legal retention need separate handling. Caches and other data follow provider settings; removing a report does not immediately remove every copy. The observed corporate archive has a minimum 30-day retention and 7-day recovery after deletion when such a copy exists; universal automatic expiry has not been established. Requests identify copies and record remaining data and expiry conditions.
Rights and contact
Request access, correction, deletion, restriction, objection and, where applicable, portability at info@starthrop.com, subject “Growth Privacy”. Include a relevant link or identifier and the right requested; never send credentials. Verification is proportionate. Responses follow applicable legal deadlines and explain limits or required retention. Complaints may be addressed to Portugal’s CNPD at www.cnpd.pt. See the deletion instructions below.
Authority requests and updates
Authority requests are assessed for legality, competence, scope and proportionality. Unlawful requests are challenged where legally possible, disclosure is minimised and requests and responses are recorded. Renato Lisboa is the human owner of this procedure, adopted on 10 October 2026, supported by authorised technical execution. Changes will be reflected here; this version is effective from 10 October 2026.