Who we are
AgentGrowth (growth.xark.io) is operated by Cell Digital Technology Inc. (“Cell Digital”, “we”, “us”) under the Xark brand. Questions about this policy or your data: privacy@xark.io.
Businesses and the agencies that serve them (our “clients”) use AgentGrowth. For the people who contact a client, its leads and customers, the client decides why and how their information is used, and we process it on the client’s behalf as its service provider. For the people who sign in to AgentGrowth, visitors of this website and people who request a demo, Cell Digital decides how their information is used.
What we collect
- Lead and customer contact data that clients collect through AgentGrowth: names, phone numbers, email addresses, state, the answers given in web forms, chat, text messages, phone calls, AI voice calls, email and the lead forms of Meta, Google, LinkedIn and TikTok, the conversation history, and qualification and booking details.
- Consent records: the exact consent wording shown, the page, the time, the IP address and the browser of each form submission, and every opt-out (STOP) or unsubscribe.
- Calls: call tracking records the caller’s number and the call details. Calls are recorded only where a client turned recording on. AI voice calls are recorded and transcribed by our voice provider; we keep the transcript and a link to the recording.
- Accounts of people who sign in: email address, name, role and workspace memberships, notification settings and, if you turn on phone notifications, your browser’s push subscription and user agent. Sign-in runs through Clerk.
- Connected accounts: when a client connects a Facebook Page, an Instagram professional account, a LinkedIn profile or Page, an ad account (Meta, Google Ads, LinkedIn, TikTok or Reddit), Google Analytics, a Google Business Profile or a calendar, we receive access tokens and the account details the platform returns (names, ids, profile pictures, follower counts), and we keep the posts and ad changes made for the client and their statistics.
- Landing page and website events: on landing pages we host and on client websites that use our scripts, page views, scrolling, form starts, submissions and clicks, with a random visitor id and campaign (UTM) and click ids. For links in social posts we keep a hash of the IP address and browser with a daily salt, not the IP address. Our scripts set no visitor id when the browser sends Global Privacy Control or Do Not Track.
- Demo requests on this website: your work email, your website and your message.
- Business research: public information about a client’s own business and its competitors, such as ratings, reviews, posts and search results, read through official APIs.
The marketing pages of this website set no cookies and use no analytics or advertising tools. Signing in sets the cookies the session needs. Landing pages we host for clients under /lp set a random visitor id cookie for 30 days to run page tests, unless the browser sends Global Privacy Control or Do Not Track.
How we use it
- To run the service for the client: answer and qualify its leads, book appointments, send the texts, emails and calls the client set up, and pass leads to the client’s team and its CRM.
- To plan and run the marketing the client approved: publish approved posts, landing pages and ad changes, read the results back and report them.
- To check that what was published matches what was approved, by reading back the platform’s own record.
- To keep the service secure: access checks, rate limits, abuse prevention and the audit log.
- To answer demo requests and support questions.
We do not sell personal information. We do not use lead data or data from connected platforms to build advertising profiles for anyone other than the client it belongs to, and we do not use it to train AI models.
AI processing
AgentGrowth uses large language models to draft replies, summaries, posts, plans and analyses. These requests go to DeepSeek models through the Router API gateway and, as a fallback, through OpenRouter; image and video generation runs through OpenRouter. We send them with the settings these gateways offer to not store requests (Router) and to use only providers that do not collect data for training (OpenRouter).
Posts, landing pages, ad changes, emails and plans that the AI drafts wait for a person at the client to approve them before they go out. Replies in lead conversations are sent by the AI agent within the rules, hours and scripts the client set, and the client’s team can take over any conversation.
In workspaces set to protected health information mode, the AI does not handle lead conversations by default; they go to the client’s staff.
Data from Meta, LinkedIn and Google
Meta (Facebook and Instagram). To publish posts, a client connects Facebook Pages and Instagram professional accounts, and we request these permissions: pages_show_list, pages_read_engagement, pages_manage_posts, read_insights, instagram_basic, instagram_content_publish, instagram_manage_insights and business_management. We use them only to list the Pages and Instagram accounts the person manages so the client can choose which to connect, to publish the posts a person at the client approved, to read those posts back to confirm they were published as approved, and to read post and follower statistics for the client’s reports. When a client connects a Meta ad account we request ads_read, ads_management, leads_retrieval, pages_manage_ads, pages_manage_posts, pages_show_list, instagram_content_publish and business_management, to read campaign results, make the ad changes the client approved and receive the leads from its lead forms.
Data we receive from Meta is used only to provide these features to the client that connected the account. It is not sold, not used to build advertising profiles and not shared except with the service providers listed below that host and run AgentGrowth. Access tokens are stored encrypted in Supabase Vault. When an account is disconnected, or when Meta tells us that you removed the app and asked for deletion, its stored tokens are deleted (see Data deletion).
LinkedIn. For a LinkedIn profile we request openid, profile and w_member_social, to post as that person only after they approve each post. For LinkedIn Pages we request r_organization_social, w_organization_social and rw_organization_admin, to publish approved posts and read their statistics. For LinkedIn ad accounts we request r_ads, rw_ads, r_ads_reporting, w_organization_social and r_marketing_leadgen_automation, to read results, make approved ad changes and receive leads from lead forms. Data from LinkedIn is used only to provide these features to that client and is handled as described above for Meta.
Google. Google Ads uses the adwords scope to read campaigns, keywords, search terms and results, to plan keywords, and to make the changes the client approved (budgets, keywords, ads, campaigns and audience lists). Google Analytics uses analytics.readonly to read reports. Google Business Profile uses business.manage to read reviews and to post approved replies and updates. Google Calendar uses calendar.events and calendar.freebusy to find open times and book appointments. Microsoft 365 calendars use Calendars.ReadWrite and offline_access for the same purpose.
TikTok and Reddit. For TikTok ad accounts we request ad.read, ad.write and report.read; for Reddit ad accounts adsread, adsedit, history and read. They are used to read campaign results and make the ad changes the client approved.
AgentGrowth’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features the client uses. We do not use it for advertising, do not sell it, do not use it to develop, improve or train generalized AI or machine learning models, and do not let people read it unless the client agreed, it is needed for security or to comply with law, or it is aggregated for internal operations. To produce the analyses a client asks for, some Google Ads data, such as search terms, campaign names and results, is sent to the AI models described above. Google review text is not sent to them.
How we protect it
- Each workspace’s data is separated by row-level security in the database.
- Access tokens and API keys are stored encrypted in Supabase Vault and read only on the server. They are never sent to the browser.
- Sign-in runs through Clerk, and access to each workspace is checked on every request.
- Audit events, consent records and opt-outs are append-only.
- We do not hold SOC 2 / ISO certification today.
How long we keep it
We keep a client’s data while its workspace is active. Some data is removed automatically:
- Call recordings and transcripts in protected health information mode: cleared after 90 days.
- Lead history files a client uploads: deleted on their purge date, 180 days after upload by default.
- Share links: deleted 90 days after they expire or are revoked.
- Activity feed entries and questions asked in Ask: deleted after 90 days.
- Google Ads search term data: deleted after 45 days.
- An unfinished sign-in to a social platform: its tokens are deleted after 30 minutes.
- Statistics and reviews read from an analytics, Business Profile or ad account: deleted when the client disconnects it and chooses to delete them.
- A social account’s access tokens: deleted when it is disconnected, or when Meta sends us your deletion request.
Consent records, opt-outs and the audit log are kept as evidence of what a person agreed to or refused, also after other data is deleted. When a person’s data is deleted at their request, these records keep no phone number, email, name or IP address: those are replaced by one-way hashes or removed. When a client stops using AgentGrowth it can ask us to delete its workspace data, and we delete it except for those records and what the law requires us to keep.
Your choices and rights
- If you are a lead or customer of one of our clients, contact that business first: it decides how your information is used. You can also write to us and we will pass your request to the business and help it respond.
- Reply STOP to any text message to stop texts, and use the unsubscribe link in any email.
- Depending on where you live (for example California or another US state, the EU or the UK) you may have the right to access, correct or delete your personal information, to receive a copy of it, to object to or restrict its use, and to opt out of its sale or its sharing for targeted advertising. We do not sell personal information. Email privacy@xark.io to make a request; we may need to confirm your identity first. We will not treat you differently for using these rights.
- When the business, or we on its behalf, act on a request to see or delete what is held about you, AgentGrowth has a tool for it on your record: an export of everything held about you in that business’s workspace, as a file, or a deletion. A deletion removes your messages, call transcripts, bookings and other details, keeps consent records, records of messages sent and the audit log as evidence with your identifiers replaced by one-way hashes or removed, keeps your phone number and email on the do-not-contact list so that you are not contacted again, and is checked afterwards for anything left that identifies you. Every export and deletion is logged.
- To delete data we received from Facebook or Instagram, see the Data deletion page.
- You may also complain to your data protection authority.
Children
AgentGrowth is a service for businesses and is not directed to children under 16. We do not knowingly collect their personal information.
Where data is processed
Cell Digital is based in the United States. Our service providers may process data in the United States and in other countries where they operate. Where the law requires it, we rely on appropriate safeguards for these transfers.
Changes to this policy
We update this page when what the product does changes, and we change the date at the top. If a change is significant, we tell clients by email before it applies.
Contact
Cell Digital Technology Inc. Privacy questions and requests: privacy@xark.io. Everything else: hello@xark.io.