The fine print
How we handle your data
To show us a problem you often have to show us a bit of your business. Here’s exactly what happens to it.
Last updated: . This page changes as the way we work changes, and this date changes with it.
Before you send anything
A few things that make this safer for you:
- Don’t upload passwords, full card numbers, or records you aren’t allowed to share.
- Where you can, redact the sensitive parts, or use a made-up example. A fake invoice with the same layout shows us the problem just as well as a real one.
- If it’s sensitive, say so. The form asks, or you can email hello@growingresearch.org. We’ll agree how to handle it before you send more.
What we store
When you send a problem, we store what you gave us:
- the problem description;
- your answers to the optional follow-up questions;
- any files you attached;
- your name and email address;
- your company and phone number, if you gave them.
To limit abuse we also store a salted one-way hash of your IP address, not the address itself, and a shortened version of your browser’s user-agent string.
Every submission gets its own case number, and each case’s data is kept separate under that number. A case number looks like this made-up one:
GRL-7K2M9QXR
Where it lives
With Cloudflare, which also hosts this site. The written parts go in a Cloudflare D1 database and the files go in Cloudflare R2 storage. Uploaded files are private: they’re never published and never served from a public address.
Who sees it, and what it’s used for
People at GRL who are reviewing your problem. It’s used to understand your problem and respond to you, and for nothing else.
- It isn’t sold.
- It isn’t shared for marketing.
- It isn’t used to train AI models.
- It’s never added to the permanent or shared memory of A.N.T.O.N., our research system. What belongs to your case stays with your case.
How long we keep it
- Your case record and files: if the problem never becomes a project, they’re deleted automatically 90 days after you sent it.
- The email notice we get when it arrives: a short message in our business inbox (case number, name, email, company, and a one-paragraph summary, left out if you said it’s sensitive). It’s separate from the case record and isn’t deleted automatically.
- Emails we send each other: kept like any business correspondence, for as long as we need them.
You can ask us to delete any of it, sooner, including those emails, by writing to hello@growingresearch.org. Include your case number if you have it.
If your problem becomes a project, how long we keep project material is agreed in that project’s written terms, before work starts.
What you can upload
Uploads are optional. If you do attach something, these are the limits:
- up to 5 files per submission;
- up to 25 MB per file;
- up to 60 MB in total.
File types we accept
- PNG image (.png)
- JPEG image (.jpg, .jpeg)
- WebP image (.webp)
- GIF image (.gif)
- HEIC photo (.heic)
- PDF (.pdf)
- Text file (.txt)
- CSV (.csv)
- Word document (.docx)
- Excel spreadsheet (.xlsx)
- MP4 video (.mp4)
- QuickTime video (.mov)
- WebM video (.webm)
We don’t accept programs, scripts, zipped archives, web pages or SVG images. We also don’t accept older Word and Excel files (.doc, .xls) or macro-enabled ones, because they can hide small programs. Saving a copy as .docx, .xlsx or PDF works fine.
What happens to a file when it arrives
- We check it really is the kind of file its name says, and turn it away if not.
- We look inside Word, Excel and PDF files and turn away ones that carry macros, scripts, embedded programs, or links that would fetch and run something when opened.
- What’s left is stored privately, in quarantine: nothing opens it automatically, nothing runs it, and it never becomes part of anything outside your case.
- A person at GRL opens it only when reviewing your problem, and does so carefully.
To be plain about it: these checks are not virus scanning, and we don’t claim they catch everything. That’s why files stay in quarantine and are handled with care.
Text limits
The problem description can be up to 6,000 characters, and each follow-up answer up to 3,000. That’s a lot of room. If you need more, send what fits and tell us there’s more to say.
What we’re not claiming
We’re a small lab, and we’d rather be plain than impressive. This page describes what the site does. It doesn’t claim any security certification or compliance badge, because we don’t hold any. If your information is covered by rules about who may handle it, tell us before you send it, and we’ll tell you honestly whether we’re the right people to see it.
Questions
Write to hello@growingresearch.org. A person will answer.