Privacy Policy

Theo, operated by The Growth Collective Inc. Last updated: October 19, 2026.

Who we are

Theo is an AI teammate for marketing agencies and the brands they work with. Teams talk to Theo in Slack and in Theo Console. Theo reads the marketing platforms a team connects, answers questions about performance, and prepares drafts (for example ad drafts, email campaign drafts and documents) that people review and approve.

Theo is operated by The Growth Collective Inc., 201 Upper Post Road, Maple, Ontario, Canada ("Growth Collective", "we", "us"). You can reach us at hello@withtheo.ai.

Who this policy covers

• Our customers' team members: the people who sign in to Theo Console or talk to Theo in Slack.
• People in our customers' data: for example a brand's email subscribers or store customers, when a customer connects a platform that holds that data. For this data we act on our customer's behalf (as a processor or service provider), and the customer decides what is connected and why.

What Theo reads and what Theo stores

Theo uses connected platforms in two ways. It reads them when someone asks a question, and it keeps some of their data so it can answer questions about change and history without asking the platform for everything each time.

What Theo can read

When a person asks Theo something, Theo can call the platforms linked to the client named in the question, using only the permissions granted when the platform was connected, and uses what comes back to answer. Depending on what a workspace connects, this can include:

• advertising accounts, campaigns, creative and performance (for example Meta, Google Ads and TikTok);
• store, product and order data (Shopify);
• email and SMS marketing data such as campaigns, flows, lists, segments, metrics and subscriber profiles (Klaviyo);
• documents and pages people choose to share (for example Google Drive and Notion);
• Slack channel names, members and messages, where Theo is present;
• other apps a workspace connects through our connection partner Pipedream.

What Theo stores

Theo keeps the items below. Each item belongs to the workspace that connected the platform or created the content, and is kept separate from every other workspace.

• Conversations. What people ask Theo in Slack channels Theo is a member of, in threads Theo is part of, and in Theo Console chats, and Theo's answers, including the figures in those answers.
• Daily change logs and settings snapshots. For some platforms Theo records, once a day, what changed and how things are set up, so it can answer "what changed, and when?". Today this covers Google Ads change events and campaign state, snapshots of connected Shopify stores, and the learning state Meta reports for ads.
• Meta performance history. A warehouse of daily performance history for connected Meta ad accounts (campaigns, ad sets and ads, with the breakdowns Meta provides), so Theo can compare periods and look back over long ranges. Older months of this history may be kept as files in object storage.
• Files and media. Files people share with Theo or upload (for example screenshots, exports and creative), ad creative and media held in Ad Studio, and files Theo produces (reports, charts and images). They are stored privately and shown through short-lived signed links.
• Client records and settings. Client records, notes, rules, defaults and connection settings that a workspace saves in Theo.
• Account information. Name, email address, role and workspace membership, and, when a workspace links them, a person's Slack identity (user id, display name and profile picture).
• Credentials. Access tokens for connected platforms, encrypted at rest (see Storage and security below).
• Audit and technical records. Actions taken by people and by Theo are recorded in an audit log, along with the technical logs needed to run and secure the service.

This data is stored in our database (Supabase, which runs Postgres) and in object storage (Tigris). Each workspace's data is kept separate, and access is enforced by role.

How we use information

• To provide the service: answer questions, report on performance, keep client records, prepare drafts and, only when a person with the right permission approves, make changes in a connected platform.
• To secure the service: authentication, permissions, audit trails, abuse prevention and troubleshooting.
• To support customers and improve the reliability of the service.

We do not sell personal information. We do not use customer data or connected platform data to train general-purpose AI models, and we do not use connected platform data to advertise our own products.

AI processing

To answer a request, Theo sends the relevant parts of the conversation and the data needed to answer it to AI model providers. They process it on our behalf to generate a response: one kind of provider writes the text of an answer, another analyses images and video. Theo's answers can be wrong, so people review drafts and approve changes before anything is published or changed in a connected platform.

We send data to these providers to get the response and for no other purpose. They may process it in countries other than the one where you are.

Google user data and Limited Use

When a workspace connects a Google account, Theo can read data from Google services such as Google Ads, Google Drive and Google Sheets, using only the permissions granted during the connection. We use that data only to answer that workspace's own requests and prepare its own drafts.

In line with those requirements:

• We use Google user data only to provide the features a workspace asks for.
• We do not sell Google user data, and we do not use it for advertising.
• We do not transfer it to others except to provide the features the workspace asked for (for example to the service providers listed below), to keep the service secure, to follow the law, or as part of a merger or sale with notice to you.
• Our people do not read Google user data, except with your permission for specific data, where needed for security or to investigate abuse, or where the law requires it.
• We do not use Google user data to develop, improve or train generalized AI or machine learning models.

You can remove Theo's access at any time in your Google Account, at myaccount.google.com/permissions, or by disconnecting the account in Theo Console.

Meta platform data

Data received from Meta is used only to provide Theo to the workspace that connected it, in line with Meta's Platform Terms. This includes the performance history described above. You can remove Theo's access at any time in your Meta account settings or by disconnecting in Theo Console, and you can ask us to delete the data we hold, as described on the data deletion page.

How information is shared, and who processes it

We do not sell personal information. We share information only in these ways.

• Service providers that host and run Theo. They process data on our behalf, to provide their service to us. By category:
  • cloud hosting and compute (for example Railway and Vercel);
  • database and authentication (Supabase);
  • object storage for files, media and archived history (Tigris);
  • connection and authentication partner for third-party apps (Pipedream);
  • AI model providers, for text answers and for image and video analysis.
• Connected platforms. When a person approves a change, Theo sends it to the platform it is meant for. Theo posts its replies in Slack.
• Within a workspace. Information is visible to that workspace's members according to their roles.
• Legal reasons. When required by law, or to protect the rights, safety and security of our users and the service.

Storage and security

• Platform credentials and access tokens are encrypted at rest (AES-256-GCM) and are never sent to browsers.
• Each workspace's data is kept separate, and access is enforced by role.
• Files and media are stored privately and served through short-lived signed links.
• Data is encrypted in transit.
• Our database and object storage are hosted in the United States. Data may also be processed in other countries where our providers operate.

Retention and deletion

• Disconnecting. A workspace administrator can disconnect a platform at any time. This deletes the stored credentials immediately and stops Theo reading that platform. Data Theo has already stored stays until it is deleted as described below.
• How long we keep data. We keep data for as long as the workspace uses Theo, or as needed to provide the service, meet legal obligations and resolve disputes.
• Deletion on request. A workspace owner can ask us to delete the workspace's stored data, including conversations, change logs, snapshots, performance history, files and media, and client records. We delete it within 30 days of a verified request. See the data deletion page for how to ask.
• Slack. When a workspace removes Theo from Slack, a background job deletes Theo's copies of that workspace's Slack messages. The audit trail of actions stays, without the message text.
• Shopify. When a store uninstalls Theo, Shopify notifies us. We then revoke the connection and delete its stored credentials.
• Records we may keep. Minimal records needed to meet legal, billing or security obligations may be kept where the law requires.
• Technical logs. Technical logs are kept for a limited period.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, and to object to or restrict certain processing. If your information reached us through one of our customers (for example as a brand's subscriber), please contact that customer first; we will help them respond. To make a request, email hello@withtheo.ai.

Third-party platforms

Your use of each connected platform stays governed by that platform's own terms and privacy policy. We access only the permissions granted during the connection, and they can be revoked at any time from the platform's own settings or from Theo Console.

Children

Theo is a business service and is not directed to children under 16.

Changes to this policy

We may update this policy as the service changes. We will post the new version here with a new date and tell workspace administrators about material changes.

Contact

Privacy questions and requests: hello@withtheo.ai

The Growth Collective Inc.
201 Upper Post Road
Maple, Ontario, Canada