Cookie & Tracking Policy
Cookies, analytics, and tracking technologies used by the Growth Station platform.
Growth Station — Cookie & Tracking Technology Policy
Last updated: August 16, 2026
Translation notice: This English version is provided for convenience. If it conflicts with the original Portuguese document, the Portuguese version prevails.
Growth Machine Editora e Aceleração Ltda. ("Growth Machine") uses cookies and tracking technologies on the Growth Station platform (the "Platform"). This Policy explains which technologies we use, why we use them, and how Users can manage them.
1. Cookies and Tracking Technologies
- Cookies: Small text files stored in a User's browser to retain session information and preferences.
- Tracking pixels: Invisible images embedded in emails to detect opens.
- Tracked links: Modified URLs used to detect clicks on links in emails.
- Product analytics: Code that records events related to a User's interactions with the Platform.
2. Technologies We Use
2.1 Session and Authentication Technologies
| Cookie/technology | Purpose | Type | Duration | Required |
|---|---|---|---|---|
JWT (Authorization header) | User authentication | Essential | Session duration or until token expiration | Yes |
| Browser session cookies | Maintaining the authenticated session | Essential | Browser session | Yes |
| SSO tokens (Google/Microsoft) | Authentication through an external identity provider | Essential | Session duration or according to provider expiration | Yes |
These technologies are strictly necessary for the Platform to operate and cannot be disabled.
2.2 Persistent Connections (WebSocket)
| Technology | Purpose | Type | Duration | Required |
|---|---|---|---|---|
| Socket.IO (WebSocket) | Real-time chat, live notifications, and status updates | Essential | Authenticated session duration | Yes |
How it works:
- After authentication, the Platform establishes a WebSocket connection for bidirectional, real-time communication.
- The connection is authenticated through a JWT and restricted to the User's Project.
- Data in transit may include chat messages, update notifications, and presence events.
- Connection state is maintained in Redis as volatile cache and is not persistently stored there.
The WebSocket connection is strictly necessary for real-time communication features.
2.3 Email Tracking
| Technology | Purpose | Type | Scope | Configurable |
|---|---|---|---|---|
| Open-tracking pixel | Detect when a Lead opens an email sent through the Platform | Functional | Emails sent by the Project | No (always on) |
| Tracked links | Detect when a Lead clicks a link in an email | Functional | Emails sent by the Project | No (always on) |
How it works:
- When an email is sent through the Platform, an invisible 1×1 image may be inserted into its body.
- Links in the email body may redirect through a tracking URL.
- When the Lead opens the email or clicks a link, the event is recorded in the Platform.
Data collected: Timestamp of the open or click and event type (open, click, reply, or bounce).
Control: Open and click tracking applies to every email sent through the Platform and cannot be turned off by the Project in the interface. Leads can prevent open detection by disabling automatic image loading in their email client.
2.4 Product Analytics
| Technology | Purpose | Type | Data collected |
|---|---|---|---|
| PostHog | Platform usage analytics for product improvement | Analytics | Interaction events such as clicks, navigation, and features used; session identifiers; browser technical data; User identification data (name, email, role, project, and plan) |
User identification: once authenticated, the Platform User is identified in PostHog with name, email, role, active project, and project plan, so usage analysis can be segmented by profile and by account. This identification refers to the Platform User, not to Leads.
PostHog does NOT collect:
- The content of emails, messages, or calls.
- Lead record data.
- Passwords or credentials.
2.5 Session Replay
| Technology | Purpose | Type | Data collected |
|---|---|---|---|
| Sentry Replay | Reproduce the navigation leading up to an error, for diagnosis | Analytics | Structure of the screens visited, clicks, and navigation, with all textual content masked |
| PostHog Replay | Usage and interface troubleshooting | Analytics | Same scope, when enabled on the project |
How it works and safeguards:
- Replay records the structure of the screen (element positions, clicks, scrolling), not a video copy.
- All textual content, form fields, and media are masked in the browser, before transmission. Names, emails, phone numbers, message bodies, and call transcripts never leave the device.
- In Sentry, 10% of sessions are recorded, plus 100% of sessions in which an error occurs.
- Users can turn replay off under Settings → Privacy inside the Platform.
2.6 Error Monitoring
| Technology | Purpose | Type | Data collected |
|---|---|---|---|
| Sentry | Detection and diagnosis of technical errors | Essential | Stack traces, technical request data such as URL and technical headers, anonymized IP address, and error context |
3. Third-Party Cookies and Tracking
The Platform does not use third-party cookies for advertising or retargeting.
Third-party service integrations such as Nylas, Twilio, and CRMs may use their own cookies and tracking technologies under their respective privacy policies:
4. Legal Basis
| Technology | Legal basis |
|---|---|
| Session/authentication technologies | Performance of a contract (Article 7, V of the LGPD) — necessary for operation |
| SSO tokens | Performance of a contract (Article 7, V of the LGPD) — authentication method selected by the User |
| WebSocket (Socket.IO) | Performance of a contract (Article 7, V of the LGPD) — necessary for real-time features |
| Email tracking | Legitimate interests (Article 7, IX of the LGPD) — contracted prospecting functionality |
| PostHog analytics | Legitimate interests (Article 7, IX of the LGPD) — product improvement |
| Session replay | Legitimate interests (Article 7, IX of the LGPD) — error and usability diagnosis |
| Sentry monitoring | Legitimate interests (Article 7, IX of the LGPD) — security and stability |
5. Management and Opt-Out
5.1 Browser Cookies
Users can manage cookies directly in their browser settings. Disabling essential cookies will prevent use of the Platform.
5.2 Email Tracking
- The Project (customer company) has no interface control to disable tracking. Projects that need it suppressed should raise the case with support.
- A Lead (recipient) can disable automatic image loading in their email client to prevent open detection.
5.3 Analytics and Session Replay
Users can turn product analytics and session replay off inside the Platform, under Settings → Privacy. The preference is stored in the browser, so it applies per device.
To request deletion of analytics data already collected, email privacidade@growthedge.com.br with the analytics identifier shown on that same screen.
6. Changes to This Policy
We may update this Policy periodically. Material changes will be communicated through the Platform.
7. Contact
For questions about this Policy:
- Email: privacidade@growthedge.com.br
- Data Protection Officer (DPO): Natália Caroline Batista
This document was prepared in accordance with Brazil's LGPD (Law No. 13,709/2018) and the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014).
Your feedback matters
Did this guide answer your question?
It only takes a few seconds and helps us keep the knowledge base useful.