Skip to content
GROWTH DEPT.MTA

Privacy policy

Privacy, in plain words.

Effective 10 November 2026. Replaces the version effective 7 November 2026.

Who we are

Growth Dept is the trading name of Growth Dept Inc. (“Growth Dept”, “we”, “us”). This policy covers Growth Dept MTA: the website and application at mta.growthdept.ai, its pixel, its APIs and its Shopify app. Questions, and requests to see or delete data, go to support@growthdept.ai.

Two kinds of people

People who use MTA: the brand staff and Growth Dept staff who sign in. We hold their accounts and decide how that data is used.

Shoppers on a brand’s website: the brand puts the MTA pixel on its pages, connects its store and decides what it measures. We process that data for the brand, under our agreement with it, and only to give the brand its attribution reports.

What we collect from people who use MTA

  • Your email address and name, your role in each organization, and when you last signed in.
  • If you sign in with Google: the name, email address and Google account id that Google shares with your permission (the openid, email and profile scopes). We ask for nothing else from your Google account.
  • If you use a password: a scrypt hash of it, never the password itself.
  • If you turn on two-step sign-in: your authenticator secret, encrypted, and your recovery codes, kept only as hashes.
  • For each session: a hash of the session token, when it started and expires, how you signed in, and your browser’s user-agent string.
  • If you use AI (Preview): your conversations, meaning each question you ask about a brand and the answer you were shown, which are stored for you; the custom instructions you save for a brand; and a usage record for each question with when it was asked, what answered it and how many tokens it used. The usage record does not hold the question or the answer.
  • The email addresses a brand adds to its alert list under Settings > Email notifications.
  • An audit log of changes to accounts, brands, access and API keys. It records ids and settings, not email addresses or names.

What the pixel collects about shoppers

  • Page views and shopping events (product viewed, added to cart, checkout started and completed), with their time, the page’s host and path, and the referring site’s host.
  • From the page address, only the ad parameters on an allow-list: UTM tags, ad click ids and ad ids. The rest of the query string is dropped before anything is stored.
  • A random visitor id kept in the brand’s own cookie and local storage, or Shopify’s client id on Shopify pages.
  • The kind of device (desktop, mobile or tablet), worked out from the browser’s user-agent string, which is not stored.
  • The value and currency an event carries, such as a cart’s total; on checkout events, the checkout token; and on a completed checkout, the order id.

MTA does not store shoppers’ IP addresses, email addresses, names, phone numbers, street addresses or device fingerprints. The collector uses the IP address in memory to slow down floods of requests and does not keep it. MTA does not link a shopper across different brands. The Shopify pixel runs only when the shopper’s consent allows analytics, and the landing-page script honours Global Privacy Control and the brand’s consent banner.

What MTA keeps about a brand’s orders

  • For each order: its id and number, its dates, the total and its parts (tax, shipping, discounts, tips and refunds), the line items (product and variant ids, SKU, title, quantity, price and discount), discount codes, order tags, the sales channel, and whether it was a test or was cancelled.
  • The landing page’s host with its allow-listed ad parameters, the referring site’s host, and the visitor ids the landing-page script or the pixel wrote to the cart. These tie the order to the visits before it.
  • The customer’s id, only as a hash made with the brand’s own key, so a returning customer’s orders can be linked. MTA does not read names, email addresses, phone numbers or addresses from Shopify.
  • Orders sent through MTA’s orders API may include contact fields. Names, phone numbers, IP addresses and shipping addresses are dropped unread. An email address is turned into a hash with the brand’s key as it arrives and is used only to match ad views that a measurement partner sends to the order; the address itself is not stored. Ad views a partner sends with an email address are hashed the same way.
  • If the brand connects Klaviyo: the Klaviyo profile id that the brand’s email and text links carry (the nb_klid tag) and which Klaviyo profile placed which order, so a click on one device and an order on another can be joined. Klaviyo sends each order event with the order’s details, contact fields included; MTA keeps only the order id and the profile id and discards the rest as it reads them. Klaviyo’s new subscribers are counted per day, from the time of each sign-up only.

The Shopify app

When a merchant installs Growth Dept MTA from Shopify, MTA keeps a record of the installation: the store’s myshopify address, name, currency and time zone, the permissions Shopify granted, when the app was installed, opened and uninstalled, and the store’s access and refresh tokens, encrypted, with their expiry times. Once the store is linked to a brand, the record also says which brand, who linked it and when, and the tokens move to the brand’s store connection, so only one copy exists. Each single-use link is recorded with who used it and when.

  • Uninstalling the app. As soon as Shopify reports the uninstall, MTA deletes the store’s tokens and stops syncing the store. The store’s data stays until Shopify sends its shop erasure request (shop/redact), 48 hours after the uninstall.
  • Shop erasure. MTA deletes the installation record and the store’s orders, line items and refunds, the identity records, pixel events and visits, each order’s attribution, and the files on the brand’s Documents page, which are built from those orders. The deletion is queued when the request arrives and runs in batches. The brand’s ad spend, its settings and its daily report totals, which name no order or shopper, stay. If the brand connects the same store another way, such as through Growth Dept’s own connection, the app’s erasure leaves that data alone.
  • Customer data requests. When Shopify asks what MTA holds about a customer, MTA puts everything it holds for the orders Shopify names into one file: those orders and their line items, the visits credited to them, and the pixel events of the visitors tied to them. The file has no name, email address, phone number or address, because MTA does not read those fields. It goes on the brand’s Documents page in MTA for 30 days, and MTA emails the brand’s owners and admins that it is there, so the brand can answer the customer.
  • Customer erasure. When Shopify asks MTA to erase a customer, MTA deletes the customer’s hash and identity records, removes the visitor ids from their orders and the order ids from their checkout events, and replaces their visitor ids on pixel events and visits with random ones. The orders keep their money figures, so the store’s totals still add up. With no visitor tied to them, their credit moves to Unattributed the next time MTA recomputes attribution, which it does every 15 minutes.

Why we use it

  • Account data: to sign you in, show you the brands you have access to, keep the service secure and answer support requests.
  • Shopper and order data: to credit each order to the visits and ads that led to it, for the brand that collected it, and nothing else.

We do not sell personal data, use it for advertising, or share it with other brands.

Google user data

Growth Dept MTA’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in data only to sign you in and identify your account. We do not sell it, use it for advertising, allow humans to read it except with your consent or for security and abuse handling, or use it to train or improve AI or machine-learning models.

Cookies on mta.growthdept.ai

  • mta_session: keeps you signed in, for up to 30 days.
  • mta_google_flow: holds a Google sign-in in progress, for ten minutes.
  • mta_signin_pending: holds a sign-in waiting for a second factor, for ten minutes.
  • mta_oauth_ followed by a platform name: holds a store or ad account connection in progress, for ten minutes.

This site sets no analytics or advertising cookies.

Who else handles it

  • Vercel hosts the application, and Neon hosts the database, both in the United States (US East).
  • Resend sends MTA’s emails: password and sign-in emails, invitations, notices about Shopify data requests, and alerts to the addresses on a brand’s alert list. It receives each email’s recipients, subject and text.
  • Anthropic answers questions in AI (Preview) when a brand uses the Anthropic API for it. With each question, Anthropic receives the question and the conversation so far, the asker’s custom instructions, the brand’s name, time zone, currency and attribution settings, and the totals MTA’s report tools return. No shopper data and no single order is sent.
  • For a brand Growth Dept already runs, AI (Preview) can instead be answered by the brand’s own Growth Dept agent, on a machine Growth Dept operates for that brand. It receives the question, the conversation so far, the brand’s totals, the asker’s role and an id that means nothing outside MTA, never their name or email address. The agent runs on OpenAI’s models, so OpenAI receives what the agent sends its model to answer: that request, and anything the agent looks up for the answer in the data Growth Dept holds for the brand.
  • Google, when you choose to sign in with Google.
  • The platforms a brand connects, which send MTA the brand’s orders and ad data: Shopify, Meta, Google Ads, TikTok, Microsoft Advertising, Snapchat, Pinterest, Reddit, LinkedIn, AppLovin, Amazon Ads, X, The Trade Desk, Vibe, MNTN, Rokt, impact.com, OpenAI Ads and Klaviyo.
  • Partners a brand chooses under Settings > Data Sharing, which read the brand’s report exports with a key the brand can revoke.

How long we keep it

  • Raw pixel events, identity links and visitor records: 13 months. Visits are kept until they are older than both 13 months and the brand’s lookback window. Daily report totals are kept after that.
  • Ad views a measurement partner matched to orders: 13 months.
  • Orders: while the brand uses MTA, unless Shopify’s shop erasure request deletes them first.
  • Files on a brand’s Documents page, such as exports and answers to Shopify data requests: 30 days. The next nightly job then deletes them.
  • When a brand leaves: as soon as the brand is deleted, its API keys and Growth Dept connection key stop working, and its pixel and scheduled data pulls stop. Thirty days after the deletion, we start permanently deleting everything MTA holds for the brand, including pixel events, identity records, orders, ad spend, attribution, reports, settings and connections. The deletion runs in batches, so it finishes shortly after that day rather than on it. We keep the audit log’s entries about the brand, which hold ids and settings but no shopper data, and a record of the deletion with the number of rows removed.
  • AI (Preview) conversations: MTA shows a conversation only to the person who started it; the brand’s owners and admins cannot open it, and Growth Dept’s admin pages show only how many conversations a brand has. Growth Dept staff who maintain the database could read stored conversations, and do so only to run or fix the service or when the law requires it. That person can delete it in the panel at any time. A conversation with no new question for 90 days is deleted by the next nightly job, and conversations are also deleted when their person’s account is deleted or with the rest of the brand’s data when the brand is deleted.
  • Your account: until you or your organization ask us to delete it.

How it is protected

Each brand’s rows are separated by Postgres row-level security. Platform tokens are encrypted with AES-256-GCM. Passwords, session tokens and API keys are stored only as hashes. The security page has the details.

Your choices

Email support@growthdept.ai to see, correct or delete your account data. You can see and delete your own AI (Preview) conversations in the panel. Shoppers who want their data removed should ask the brand they bought from; we act on the brand’s instruction and on Shopify’s data and erasure requests. You can remove MTA’s access to your Google account at any time in your Google account settings.

Changes

We may update this policy. The current version is always at mta.growthdept.ai/privacy with its effective date. This version replaces the one effective 7 November 2026: it adds Klaviyo to the platforms a brand can connect and says what MTA keeps from it.