Privacy Policy
Effective 5 September 2026. Last updated 29 September 2026.
This policy describes what McIlhattan Media collects, why, and who it is shared with. It is written to describe what the systems actually do, not to cover every hypothetical.
Who we are
McIlhattan Media ("we", "us") is the entity behind this site and is responsible for the data described here. We operate under the brand name GrowthHackr, which is also the name of our YouTube channel. You can reach us about anything in this policy, including any request to access or delete your data, at growthhackrhq@gmail.com.
What we collect
Information you give us
If you submit the free Leak Report form, we collect exactly the fields on that form: your name and email address, and the business information you choose to enter — what you sell, who your audience is, your current lead status, which part of your funnel you suspect is leaking, your ad content, your landing page URL, what you have already tried, and your cost per lead.
You decide what goes in those fields. Please do not enter anyone else's personal data, or anything confidential you are not free to share.
Growth Hackr Ads (Google Ads and Meta ads management) customers
If you sign up for Growth Hackr Ads at ads.growthhackr.org, we collect what you enter during onboarding: your website or social link, business details, your goals and budget, your name, email address and phone number, and your Google Ads Customer ID. If you choose "Connect with Google", we also receive the Google Ads data described in Google Ads data below. If you connect your Meta business assets with Facebook Login for Business, we also receive the Meta data described in Meta (Facebook and Instagram) data below.
Purchases
Payments are processed by Stripe. We receive confirmation that a purchase completed, along with the email address used. We never see or store your card number — that goes directly to Stripe.
Information collected automatically
This site is hosted on Netlify, which keeps standard server logs (IP address, browser user-agent, requested page, timestamp) for security and operational purposes.
growthhackr.org sets no cookies and runs no analytics, advertising pixels, or third-party tracking scripts. There is no Google Analytics, no Meta pixel, and no session or behavioural tracking on these pages. If that changes, this policy will be updated first.
Our Google Ads service pages at ads.growthhackr.org are different: they use the Google Ads conversion tag (to measure which of our own ads bring sign-ups) and Microsoft Clarity (to see, in aggregate, where visitors get stuck so we can improve the pages). Both may set cookies. Landing pages we build for customers use Clarity the same way, reporting to that customer.
How we use it
- To generate and email your Leak Report diagnostic
- To send the follow-up email sequence relating to that diagnostic, which you can unsubscribe from at any time using the link in any email
- To deliver and support anything you purchase
- To keep the service secure and working, and to meet legal obligations
We do not sell your personal information. We do not share it with advertisers or data brokers.
Automated processing by AI systems
Your Leak Report submission is analysed by an AI system (Anthropic's Claude API) to produce your diagnostic, and the result is reviewed by an automated quality check before it is sent to you. The content of your submission is transmitted to Anthropic for that processing. A human — the operator of McIlhattan Media — may also read submissions in order to run and improve the service.
The diagnostic is generated advice, not a professional or legal opinion. See our Terms of Service.
Google and YouTube data
McIlhattan Media operates two internal automation systems — the Google Organic AI content system and the YouTube Shorts AI video system — which use Google APIs.
These systems authenticate against a Google account owned and operated by McIlhattan Media, and access only our own YouTube channel and web properties. They do not request, receive, or access the Google or YouTube account data of site visitors, Leak Report recipients, or customers. Visiting this site or submitting the Leak Report form never involves your Google account.
Scopes we request, and what each is used for
| Scope | What we do with it |
|---|---|
youtube.upload |
Upload our own short videos to our YouTube channel, and set YouTube's required altered-or-synthetic-content disclosure on each one. |
youtube.force-ssl |
Manage the metadata of our own videos, read comments left on them, and post replies from the channel account. |
yt-analytics.readonly |
Read performance data for our own channel — views and audience retention — to decide what to make next. |
Comments left on our videos
When someone comments publicly on one of our videos, our system processes that comment's publicly visible content — the commenter's YouTube display name and the text of the comment — in order to draft a reply. Draft replies are reviewed by a human before being posted. A record of the comment and the reply is kept in a private log so the same comment is not answered twice. We do not build profiles of commenters, and we do not use comment data for advertising.
Our videos are produced with AI assistance and are disclosed as such to YouTube. Replies are AI-assisted; if you ask us directly whether you are talking to a bot, we will tell you the truth.
Google Ads data (Growth Hackr Ads customers only)
Growth Hackr Ads is a done-for-you Google Ads management service. When a customer clicks Connect with Google and approves access, or accepts a manager-link request from our Google Ads manager account (McIlhattan Media, 175-617-1933), we access that customer's Google Ads account only to provide the service they signed up for.
| Scope | What we do with it |
|---|---|
https://www.googleapis.com/auth/adwords |
|
We do not use your Google Ads data to advertise to you or anyone else, we do not sell it, and we do not use it to train general-purpose AI models. Performance data may be processed by an AI system (Anthropic's Claude API) to produce recommendations for your own account only.
Revoking access: you can remove our access at any time at myaccount.google.com/permissions, or in Google Ads under Admin → Access and security → Managers → Unlink, or by emailing growthhackrhq@gmail.com. Your campaigns stay in your account and remain yours.
Meta (Facebook and Instagram) data
Growth Hackr Ads also manages Meta ads (Facebook and Instagram) for customers who choose it. When a customer signs in with Facebook Login for Business, we access only the ad accounts, Pages, Instagram accounts and pixels/datasets that the customer chooses to share, and only to provide the service they signed up for. Meta data is handled only for customers; visiting this site never involves your Facebook or Instagram account.
| Permission | What we do with it |
|---|---|
ads_management | Create and edit campaigns, ad sets and ads in the ad accounts you share. |
ads_read | Read performance data and reports for those ad accounts. |
business_management | Manage the business assets you share with us. |
pages_show_list | Use your Page to run ads and read ad engagement. This permission lists the Pages you can choose from. |
pages_read_engagement | Use your Page to run ads and read ad engagement. |
pages_manage_ads | Use your Page to run ads and read ad engagement. |
Your approval comes first: campaigns are created paused and go live only with your approval.
We do not sell Meta data, we do not use it for our own advertising, and we do not use it to train general-purpose AI models. Performance data may be processed by an AI system (Anthropic's Claude API) to produce recommendations for your own account only.
Storage and access: Access tokens are stored in our automation provider's encrypted storage, never in web pages, emails or spreadsheets. Only the operator of McIlhattan Media can access them.
Revoking access: you can remove our access at any time in Meta Business Settings (under Partners or connected apps), or in your Facebook settings under Business Integrations, or by emailing growthhackrhq@gmail.com. Your campaigns stay in your ad account and remain yours.
Data deletion: when you ask us to, or when you cancel, we delete stored Meta access tokens and your customer record within 30 days, except records we are legally required to keep. To request deletion, email growthhackrhq@gmail.com.
How we protect your data
We protect the data we hold, including Google user data and sensitive account data, with these safeguards:
- Encryption in transit: every connection to our sites, our automation platform, Google's APIs and Meta's APIs uses HTTPS/TLS.
- Encryption at rest: customer records are stored with our automation provider (n8n Cloud), whose storage is encrypted at rest. Google OAuth access and refresh tokens are stored only in n8n's encrypted credential store, never in web pages, emails or spreadsheets, and are never shown to anyone.
- Least privilege: we request only the Google scope and Meta permissions listed above, and use them only for the features listed above. Each customer's dashboard is reachable only through a private, unguessable link issued to that customer.
- Restricted access: only the operator of McIlhattan Media can access customer data and connected accounts, using accounts protected by strong authentication. No other person or contractor has access.
- No sale or advertising use: Google user data is never sold, never used for advertising, and never transferred except to the processors listed below as needed to run the service.
- Retention and deletion: we keep customer data while you are a customer. When you cancel or ask us to delete it, we unlink our manager account, delete stored Google OAuth tokens and Meta access tokens, and delete your customer record within 30 days, except records we are legally required to keep (such as payment records held by Stripe).
- Incidents: if we learn of unauthorised access to your data, we will notify you without undue delay and take steps to contain it.
Limited Use
McIlhattan Media's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically: we use Google user data only to provide the user-facing features described above; we do not transfer it to others except as necessary to provide those features, for security purposes, or to comply with applicable law; we do not use it for advertising; and we do not allow humans to read it except where required to operate or secure the service, where required by law, or with the account owner's agreement.
Meta Platform Terms
McIlhattan Media's use of data received from the Meta Platform complies with the Meta Platform Terms.
Who processes data on our behalf
| Service | Role |
|---|---|
| Netlify | Website hosting and server logs |
| n8n | Workflow automation connecting the services below, and encrypted storage of customer records and OAuth credentials |
| Google Ads API | Connecting, building, managing and reporting on customers' Google Ads accounts (customers only) |
| Meta Platforms (Marketing API) | Connecting, building, managing and reporting on customers' Meta ad accounts (customers only) |
| Microsoft Clarity | Aggregate visitor behaviour on ads.growthhackr.org and customer landing pages |
| Anthropic | AI processing of Leak Report submissions and content generation |
| Google (Sheets, Gmail, YouTube, Search Console) | Record storage, email delivery, and our own channel and site publishing |
| Kit (formerly ConvertKit) | Email follow-up sequences |
| Stripe | Payment processing |
| fal.ai | Generates the voiceover and imagery for our videos. No customer or visitor data is sent to it. |
How long we keep it
Leak Report submissions and their diagnostics are kept in a private log so we can support you and avoid duplicating work. Email subscription records are kept until you unsubscribe. Ask us to delete your data and we will, except where we are required to keep a record — for example, transaction records Stripe must retain.
Your choices
- Unsubscribe from any email using the link in that email
- Remove our access to your Google Ads account at any time (see Revoking access)
- Remove our access to your Meta ad accounts, Pages and Instagram accounts at any time (see Meta data)
- Ask us what we hold about you, ask us to correct it, or ask us to delete it — email growthhackrhq@gmail.com
- Simply don't submit the Leak Report form; browsing this site does not require you to give us anything
Children
This service is for business operators and is not directed at anyone under 18. We do not knowingly collect data from children.
Changes
If this policy changes materially, we will update the effective date at the top and, where the change affects data we already hold, tell affected people by email.