Privacy Policy

Last updated: 24 July 2026

Growthino is a brand operated by YLLAAA STARTUP, SL. This policy explains what personal data we collect when you visit growthino.com or use our tools, why we collect it, who we share it with, and the choices and rights you have. We have written it in plain English rather than dense legal language wherever possible.

1. Who we are (the data controller)

The data controller responsible for your personal data is:

YLLAAA STARTUP, SL
CL Rambla Badal 32, 5º 2ª
08014 Barcelona, Spain
NIF/CIF: B75430819
Privacy contact: [email protected]

"Growthino," "we," "us," and "our" in this policy all refer to YLLAAA STARTUP, SL trading as Growthino.

2. Categories of data we process

Contact details you give us directly — such as your name, email address, or phone number when you email us, submit the GEO Readiness Checker, book a call, or apply to work with us.
Booking and application content you submit through Calendly or Google Forms (see section 7) — hosted and processed on those providers' systems. We may access and use it through our business account to handle your booking or application.
Usage and analytics data — such as pages viewed, referring page, general device/browser information, and interactions with buttons and links, collected only once you have given analytics consent.
Cookie consent choices — the preferences you set in our cookie banner, stored in your browser so we can remember your choice.
AI/LLM referral data — aggregate signals about traffic arriving from AI assistants and answer engines (see GEOmetrics in section 7), collected only with analytics consent.

We do not knowingly collect special categories of data (e.g. health, religion, political opinions) through this site.

3. Why we process this data

To operate, secure, and maintain the website.
To respond to your enquiries and manage the relationship if you contact us, book a call, or apply.
To operate the GEO Readiness Checker and process the responses you submit.
To understand how visitors use the site and improve it, including how AI assistants and answer engines refer traffic to us, where you have given analytics consent.
To remember your cookie preferences.

4. Legal bases for processing

Consent (Art. 6(1)(a) GDPR) — for analytics cookies and any AI/LLM referral analytics (GEOmetrics), which only run after you actively opt in through the cookie banner.
Pre-contractual steps or performance of a contract (Art. 6(1)(b) GDPR) — where you request services, book a call, apply to work with us, or ask us to take steps before entering an agreement.
Legitimate interests (Art. 6(1)(f) GDPR) — for responding to general business enquiries, operating and protecting the website, and managing our business communications, where those interests do not override your rights.

5. Cookies and your consent choices

When you first visit growthino.com, a cookie banner lets you accept all cookies, reject non-essential cookies, or customize your choice across three categories:

Strictly necessary — always on. Required for the site to function and to remember your cookie choice itself.
Analytics — off by default. Google Tag Manager helps us manage website tags and apply your consent choices. Google Analytics 4 and GEOmetrics only collect analytics information after you grant analytics consent (see section 7).
Marketing — off by default. Only enabled with your consent.

Your choice is stored in your browser and applied on every visit until you change it.

6. Changing your cookie preferences at any time

You can review or change your cookie choices at any time — either using the "Cookie settings" link in the site footer, or the button below.

7. Third-party services we use

We use a small number of third-party services to run the site, measure how it is used, and let you book calls or apply to work with us. Some only activate with your analytics consent; others run when you actively use the specific feature they support.

Google Tag Manager — manages the website tags we use and applies your consent choices to them. Google Tag Manager itself is a tag-management container; it does not wait for analytics consent to load, but the analytics tags it manages (Google Analytics 4 and GEOmetrics) do. Google's Privacy Policy.
Google Analytics 4 — measures page views and selected website interactions, only after you grant analytics consent through the cookie banner. Google's Privacy Policy.
GEOmetrics — an AI/LLM referral-traffic analytics tool, loaded through llmometrics.b-cdn.net, that measures AI/LLM referral traffic and helps us understand how visitors arrive from AI assistants and answer engines. It is configured in Google Tag Manager to require analytics consent (analytics_storage) before it runs, in the same way as Google Analytics 4.
Tally — hosts and processes the responses to our GEO Readiness Checker on its own systems. We can access submitted responses through our Tally account to review and follow up on them. Tally states that form data is encrypted and stored on servers within the European Union. Our own website analytics receives only a fixed event label confirming that a submission happened — never your form answers, contact details, hidden fields, the raw submission payload, or Tally's submission ID. Tally's Privacy Policy.
Calendly — used to book calls with us. Booking information is submitted through Calendly, which hosts and processes it on its own systems. We may access the booking, such as your contact and scheduling details, through our Calendly account. Calendly's Privacy Policy.
Google Forms — our Apply page may use an embedded Google Form to collect applications. If you use it, your application information is submitted through Google's systems, and we may access submitted applications through our Google business account. Google's Privacy Policy.
YouTube — some pages, such as our case studies, embed videos using YouTube's privacy-enhanced mode (youtube-nocookie.com). This reduces cookie use compared to a standard YouTube embed; loading the video still involves a connection to YouTube/Google as with any embedded media player. Google's Privacy Policy.

Where any of these providers act as a processor on our behalf, we only share the minimum data needed for them to provide their service.

8. International transfers

Some of the providers listed above, including Google, may process data outside the European Economic Area, including in the United States. Where this happens, it is carried out under that provider's own safeguards for international transfers, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses, as applicable to that provider. We recommend reviewing each provider's own privacy policy for the specific safeguards they apply.

9. How long we keep data

We keep personal data only for as long as it is needed for the purpose it was collected for. As a general approach:

Enquiry, booking, and application data is kept for as long as needed to respond to you and manage the resulting relationship, and is deleted or anonymized once it is no longer needed for that purpose.
Cookie consent choices are kept until you change or clear them in your browser.
Analytics data is kept only for as long as necessary for the reporting purposes it supports, in line with the retention settings of the relevant provider (e.g. Google Analytics 4).

Where a third-party provider such as Google, Tally, or Calendly independently retains data under its own account settings, please refer to that provider's own privacy policy for its specific retention periods.

10. Your rights under the GDPR

Subject to applicable conditions and exceptions, you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request erasure of your data.
Request restriction of processing.
Request portability of data you provided to us.
Object to processing based on legitimate interests.

We do not use website analytics or readiness-checker events to make decisions about you based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, contact us at [email protected].

Where we rely on your consent — for example for analytics cookies or GEOmetrics — you can withdraw it at any time using the "Manage cookie preferences" button above or the "Cookie settings" link in the footer. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

12. Right to complain to the Spanish data protection authority

If you believe we have not handled your personal data in line with applicable law, you have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD):

Agencia Española de Protección de Datos
Edificio Cuzco IV
Paseo de la Castellana, 141, planta 9
28046 Madrid, Spain — www.aepd.es

13. Contact us

For any question about this policy or how we handle your data, contact us at [email protected].

14. Changes to this policy

We may update this policy from time to time, for example as our tools or third-party providers change. We will update the "Last updated" date at the top of this page when we do. We encourage you to review this page periodically.