GrowthOS for WooCommerce

GrowthOS for WooCommerce / GrowthOS Connect — Privacy notice

Operator and contact

GrowthOS Connect is operated by Dizzy Agency Single Member PC, Leof. Marinou Antypa 107, Ilioupoli, 16345, Greece. Contact for support, privacy questions and data-rights requests: hello@dizzyagency.gr.

This notice covers the connection service at connect.dizzyagency.gr and the optional account connections initiated by the GrowthOS for WooCommerce plugin. The merchant remains responsible for its own WooCommerce store, orders, customers, staff permissions and hosting.

What the application does

A merchant installs GrowthOS in their own WordPress/WooCommerce store and may connect Google Ads, Meta Ads, TikTok Ads or Google Analytics 4. The merchant authorizes access on the provider's website, returns to WordPress and selects the account or property for that installation. The central service performs fixed account-discovery and aggregate-reporting operations. It does not expose functions to create or edit campaigns or budgets.

Provider availability is shown in the plugin. Google Ads and GA4 have been tested in a restricted pilot; public provider approvals are pending. TikTok's full automatic account-cost coverage is not yet available. The service does not claim that an authorization alone proves complete advertising costs.

Optional connection through your own Ryze subscription

A merchant may connect their own active Ryze subscription through Ryze's remote MCP service. This connection reads account metadata and aggregate advertising cost for one authorized workspace and the selected Google/Meta accounts. It requests only mcp:read, uses a separate public OAuth client for each verified WordPress installation, and provides no advertising-editing operations. This Ryze connection does not currently import TikTok cost or GA4 traffic.

During public-client registration, Ryze receives the store hostname and an opaque identifier derived from the installation identifier, together with fixed callback and read-only authorization metadata. Ryze then receives the authorization and API requests needed to retrieve the merchant's own connected accounts and reports. The merchant's Ryze subscription and connected advertising platforms remain subject to their own privacy controls. GrowthOS stores the installation-owned client metadata and access/refresh grants encrypted at the connection service; WordPress receives the selected workspace/account metadata and reports, rather than Ryze access tokens.

Data accessed, used and stored

The connection service does not upload WooCommerce orders, store-customer names, customer contact details or product COGS from the plugin. Those data remain in the merchant's store. GA4 reports cover the selected property as a whole, which may contain more than one domain. Daily active users are not added together and presented as period-unique people.

Purposes and permissions

We use the information to establish the connection requested by the merchant, verify the selected account, retrieve the requested reports, maintain authorized connections and protect the service against replay, abuse and unauthorized access. The basis for processing account-administration data is provision of the requested service/contract, and our legitimate interests in maintaining security. Where we process report data on a merchant's behalf, we follow that merchant's instructions and applicable service arrangements. Provider authorization is required before accessing provider data. The merchant must have authority to connect the selected accounts and to use their store's data.

Google Ads uses https://www.googleapis.com/auth/adwords. Google defines that permission broadly, including account-data changes; this implementation exposes only reporting/account-discovery operations. GA4 uses https://www.googleapis.com/auth/analytics.readonly. Meta uses ads_read. TikTok permissions are displayed in its own authorization flow and must match the approved application functionality.

Sharing and access

The selected platform receives the authorization and API requests needed for the connection. The merchant's own installation receives its selected account metadata and reports. Hosting, backup and technical service providers may process data to operate and secure the service. Platform providers and the merchant's chosen store host also apply their own privacy policies and controls; their processing may involve other countries.

We do not sell provider user data, use it for advertising targeting, or use it to train generalized AI models. Provider data are used for the merchant-facing reporting features described here. Human access is limited to the specific data the user has affirmatively agreed may be viewed, necessary security investigations, applicable legal obligations, or aggregated internal operations where permitted by applicable privacy law and provider policy. Google user data, including derived data, are handled subject to the Google API Services User Data Policy, including its Limited Use requirements.

Retention, disconnect and deletion

Provider access material is retained for the configured installation connection. Expiry or revocation is detected on subsequent use; encrypted material can remain until that detection or an explicit disconnect. Expiry alone does not run a separate automatic erasure job. Successful disconnect removes that installation/provider's access material and account binding from the connection service and invalidates pending handoffs. Temporary authorization states and handoffs have short validity periods; bounded maintenance removes or clears expired temporary material. Installation registration and security/accounting metadata are separate from the provider grant and may remain until their service/security purpose ends or an authenticated deletion request is completed.

There is no claim that disconnect automatically erases the merchant's historical reports, store financial data or hosting backups. Technical hosting logs and backup copies are retained for security, recovery and applicable legal obligations under the hosting arrangements. Retention is assessed against those purposes; data that must be retained for legal obligations may be restricted rather than immediately erased. Contact us for a request concerning a particular record or backup. No automatic deletion of every hosting backup is implied by disconnect.

For Ryze, use GrowthOS → Η συνδρομή μου Ryze → Αποσύνδεση Ryze από αυτό το κατάστημα. A successful disconnect clears that installation's Ryze access material and account binding and invalidates pending authorization handoffs. Its stable public OAuth client registration may remain for reconnection; it is not an active access grant. Disconnect does not cancel the merchant's Ryze subscription or remove accounts connected within Ryze. Remaining installation or public-client registration records can be included in an authenticated deletion request.

You can disconnect in GrowthOS → Συνδέσεις λογαριασμών → Αποσύνδεση από αυτό το κατάστημα and can revoke the application's access in the provider's connected-app/business-integration settings. For deletion of remaining service records, contact hello@dizzyagency.gr with the store domain and provider. We verify control of the affected installation before acting. Never send passwords or tokens. Disconnect and deletion instructions.

Your requests

Depending on the applicable law and processing basis, you may request access, correction, erasure, restriction, portability, or object to processing. Contact hello@dizzyagency.gr. You may also complain to the competent data-protection authority, including the Hellenic Data Protection Authority. Revoking provider authorization stops future authorized access; it does not retroactively remove data maintained by the platform or the merchant's store.