Privacy Policy

Last updated: April 20, 2026

This Privacy Policy explains how KFX Media Group, LLC (“Grow Your Social”, “GYS”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you visit grow-your-social.com, create an account, or use our managed Instagram growth Service.

We comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and other applicable data protection laws. If you do not agree with this policy, please do not use the Service.

1. Data Controller

• KFX Media Group, LLC (a Delaware limited liability company)
• 131 Continental Dr, Suite 305, Newark, DE 19713, USA
• Email: support@grow-your-social.com

2. EU/UK Representative

Because we offer Services to data subjects in the European Union and the United Kingdom, we are in the process of appointing a representative under Article 27 GDPR and the equivalent UK provision. Until that appointment is published, EU and UK data subjects may exercise their rights and contact us directly using the email address above. We will respond within 30 days.

3. What Personal Data We Collect

We collect the following categories of personal data:

3.1 Information you provide

• Account data: name, email address, billing address, phone number (optional)
• Payment data: handled directly by our payment processor Stripe; we receive only the last 4 digits of the card and the transaction reference
• Instagram credentials: the username and password of the Instagram account on which you ask us to perform the Service. We store these credentials encrypted at rest. They are accessed only by the account managers assigned to your account.
• Service preferences: target accounts, niche, content notes, hashtags, and any other onboarding information you submit through the dashboard
• Communications: emails, WhatsApp messages, and Zendesk tickets you send us, including any attachments

3.2 Information collected automatically

• Usage data: pages viewed, time on page, clicks, dashboard interactions
• Device data: IP address, browser type, operating system, device type, language, time zone
• Referrer data: the website that linked you to us, search terms (if available), UTM and campaign parameters
• Cookies and similar technologies (see Section 8)

3.3 Information from your Instagram account

When you use the “Analyze your account” feature on our marketing site, or when the personalized dashboard loads, we fetch publicly available information from Instagram about the handle you submit. This includes profile picture URL, follower count, full name, recent post images, like counts, and comment counts. The data is requested server-side and cached for up to 24 hours. We do not log in to your account for this feature; only public data is retrieved.

4. Why We Process Your Data & Legal Bases (GDPR Article 6)

5. Third-Party Processors & Recipients

We engage the following service providers (“processors”) to help us deliver the Service. Each is bound by a Data Processing Agreement (DPA) and processes data only on our instructions:

Other than the processors listed above, we do not sell, rent, or share your personal data with third parties for their own marketing purposes. We may disclose data to law enforcement, regulators, or other authorities when legally required, or to protect our rights, property, or the safety of our users or the public.

6. International Data Transfers

Several of our processors are located in the United States. When we transfer personal data of EU/UK data subjects to the US or to other jurisdictions outside the EEA/UK, we rely on one or more of the following safeguards:

• The EU–US Data Privacy Framework (where the recipient is certified)
• The European Commission's Standard Contractual Clauses (2021)
• Supplementary technical measures such as encryption in transit and at rest

7. Data Retention

We retain personal data only as long as necessary:

• Active customer account data is retained for the duration of your subscription and for up to 30 days after cancellation, after which it is deleted or anonymized on your request.
• Instagram credentials are deleted from our active systems within 7 days of subscription cancellation, except where retention is necessary to investigate a dispute or comply with a legal request.
• Service performance logs (records of the work we performed for you) are kept in pseudonymized form for up to 24 months to evidence the Service we delivered, in case of a dispute or chargeback.
• Invoices, billing, and tax records are retained for the periods required by applicable tax and accounting law: 7 years in the United States and 10 years in Germany. We cannot delete these earlier even on request, because we are legally required to keep them.
• Marketing email subscriptions are retained until you unsubscribe. Once unsubscribed, your email is added to a suppression list (the minimum data required to honor the unsubscribe).
• Support communications in Zendesk and email systems are retained for up to 24 months, then deleted.

Where we are required to keep data for tax or accounting reasons, processing is restricted to that purpose only and not used for any other.

8. Cookies & Tracking

Our website uses three categories of cookies and similar technologies:

• Necessary cookies (login session, cookie-consent state). These are always active and cannot be disabled.
• Analytics cookies, set by Google Analytics 4 and Google Tag Manager, measure how visitors interact with the site so we can improve it. Loaded only after you accept Analytics in our cookie banner.
• Advertising cookies, set by Meta Pixel, measure ad performance and allow us to show you relevant ads on Facebook and Instagram. Loaded only after you accept Advertising in our cookie banner.

We use Google Consent Mode v2: until you explicitly grant consent, all storage is denied and ad signals are redacted (ads_data_redaction = true).

You can change your cookie preferences at any time:

Show cookie settings

A cookie icon will appear at the bottom-left. Click it to open your preferences.

9. Marketing & Remarketing

We run paid advertising campaigns on Meta (Facebook & Instagram). With your consent, the Meta Pixel records that you visited our site and may show you our ads on Meta platforms in the future. You can opt out at any time through your cookie preferences on our site or directly through your Facebook ad settings.

Newsletter and marketing emails are sent only with your explicit consent (Article 6(1)(a) GDPR). Every email contains a one-click unsubscribe link.

10. Your Rights (GDPR / UK GDPR)

If you are in the EU, EEA, or UK, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data (“right to be forgotten”), subject to legal retention obligations (Art. 17)
• Restrict processing (Art. 18)
• Receive your data in a portable format (Art. 20)
• Object to processing based on legitimate interests, including direct marketing (Art. 21)
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3))
• Lodge a complaint with your local supervisory authority. In Germany, this is your state data protection authority. A list of EU authorities is available at edpb.europa.eu.

To exercise any of these rights, send an email to support@grow-your-social.com. We will respond within 30 days. We may need to verify your identity before fulfilling the request.

11. Additional Rights for California Residents (CCPA / CPRA)

If you are a California resident using the Service, you have the right to:

• Know what personal information we collect, use, and disclose about you
• Access and request a copy of your personal information
• Request deletion of your personal information, subject to legal exceptions
• Correct inaccurate personal information
• Opt out of the “sale” or “sharing” of personal information. We do not sell personal information for monetary compensation. The use of cookies for cross-context behavioral advertising via Meta Pixel may be considered “sharing” under CPRA; you can opt out by rejecting Advertising cookies in our cookie banner.
• Limit the use of sensitive personal information (we do not collect data in the CCPA-defined “sensitive” categories beyond what is required to provide the Service)
• Be free from retaliation for exercising your CCPA rights

To exercise these rights, contact us at support@grow-your-social.com. We will respond within 45 days.

12. Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These include: encryption of Instagram credentials at rest, TLS encryption in transit, restricted access controls (only assigned account managers can access your account credentials), secret management for API keys, regular security audits of our infrastructure, and employee confidentiality obligations. No system is 100% secure, but we make commercially reasonable efforts to protect your data.

13. Data Breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours, in accordance with Article 33 GDPR, and notify you without undue delay where the breach is likely to result in a high risk to you (Article 34 GDPR).

14. Children

Our Service is not directed to children under the age of 18, and we do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it.

15. Automated Decision-Making

We do not engage in automated decision-making that produces legal effects concerning you or significantly affects you, within the meaning of Article 22 GDPR.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or by posting a prominent notice on our website at least 14 days before they take effect. The “Last updated” date at the top reflects the most recent revision.

17. Contact & Complaints

For any privacy questions, requests, or complaints, contact:

• KFX Media Group, LLC
• 131 Continental Dr, Suite 305, Newark, DE 19713, USA
• Email: support@grow-your-social.com

EU/UK consumers also have the right to lodge a complaint with their local data protection supervisory authority at any time.