What Growth-OS stores and who can see it

WISEPIM Growth-OS is an internal tool. WISEPIM staff use it to run sales, marketing, strategy and finance on our own records. There is no customer-facing account here and no self-service signup. The people with access are colleagues.

That makes the privacy question a practical one rather than a legal formality. We put real conversations with real companies into this system. This page says what ends up stored, where it sits, who can read it, and what you can ask us to remove.

Your account holds a name, an email address, a profile image and the identifiers behind your sign-in. A membership row ties that account to the organization and, where access is narrower, to a single project. Each membership carries one role.

Working records follow from use: the tasks you own, the notes and documents you write, the meetings assigned to you, your availability and the objectives and bets you are named on. Activity history records which record changed, who changed it and when.

That history is deliberate. When a decision is questioned a year later, the trail is how we answer, and the trail has your name on it.

Company records carry the firmographics we have gathered, the segment and ICP rule comparison, pipeline stage and owner. People records carry a name, a role, contact details and the account they belong to. Most of it arrives because a colleague typed it or imported it.

Meetings hold their transcript as text in the database. Evidence rows hold an exact quote taken from a transcript linked in the same project. The quote is the point. An insight without a verbatim line from a real conversation does not become a record here.

Finance holds our own budget, expenses, subscriptions, invoices and payment snapshots from a connected Mollie source. Competitor intelligence, content drafts, campaign plans and frozen recipient snapshots hold whatever a colleague put in them.

Campaigns plan and record results. WISEPIM Growth-OS does not email, message or contact anyone, so no recipient hears from this system.

Records live in one PostgreSQL database on Railway, reachable over the private network between our services. The database port is not exposed publicly. Deployment details are owned by our Railway runbook.

Uploads, attachments and privacy exports live in a private S3-compatible bucket. Browsers upload straight to that bucket with a presigned request that expires, and reads come back through signed links. The bucket is not browsable.

The browser reads live data through an authenticated proxy that fixes the tables, the columns and the tenant predicate for every sync. It is a read transport. Nothing is written through it, and it cannot widen what your role already allows.

Access is scoped to the organization and to the project. A membership sits at the organization level or on one project, and carries one role: owner, admin, editor, viewer, founder, advisory or first hire.

Every read and write derives your identity and your scope on the server, not from anything the browser sends. An unknown role, an unknown project or a scope that has not finished loading fails closed rather than guessing.

A colleague with access to a project can read the records in it, including meeting transcripts and the quotes drawn from them. Treat a transcript as what it is, which is someone speaking, written down. If a conversation should not be readable by the team, it should not be in WISEPIM Growth-OS.

Ask Growth Kit, meeting extraction, the multi-lens workbench, content drafting and event research read the records of the project you are working in. They do not reach another project, another tenant or anything outside WISEPIM Growth-OS. The exception is event and company research, which runs an explicit web search and shows the links it found.

Answers cite the records they used and pin the revision they read. A citation identifies a source. It does not prove that the whole record was retrieved, and the interface says when a candidate cap was reached.

Those requests are processed by OpenAI, the provider configured for every route in our AI routing config. Record text and transcript passages leave our infrastructure for that call. Model output is a proposal until a person approves it. Nothing becomes a record on its own.

Fourteen provider adapters ship today, among them Mollie, Attio, Google Calendar, Granola, Search Console, PostHog, Loops, Sanity, SerpAPI, Firecrawl, Firehose and Airscale. Each one is designed to read data the provider already holds about us.

A connection stores its credential encrypted at rest and scoped to one project. The ciphertext is never part of what a read returns, and rotating a credential raises its version and clears the last verified time so a stale check cannot pass as fresh.

No provider was called from this repository against live credentials during development. The Sources page, not this text, tells you which connections actually work. Do not connect a source with credentials you are not authorized to use.

Product analytics runs through PostHog and stays off until you accept the analytics cookie category. Without consent every analytics call is a no-op, and without a configured key the library is never loaded at all.

Error reporting runs through Sentry and is separate from product analytics. It starts with the application wherever a DSN is configured and is not behind the consent switch. In production it also samples session replays, a fraction of ordinary sessions and every session that hits an error.

That replay behavior is worth knowing about and worth deciding on deliberately. Change your cookie choices in Settings, Privacy.

An export produces a JSON artifact of your own account data: your memberships, the projects you can reach, the notes and revisions you authored, and your private copilot conversations with their citations. It is your export, not a copy of everyone else’s work, and it fails loudly rather than shipping a silently truncated package.

A deletion request purges your private copilot threads in the requesting tenant, clears your attribution on extraction requests and cancels your queued work. Records the team owns stay where they are, attached to an anonymized user record so history and audit attribution still resolve.

Retention periods are not defined. Nothing in the system expires a company record, a meeting transcript or an evidence quote on a schedule today. If we want a retention rule, someone has to decide it and it has to be built.

Open Settings, Privacy and request an export or a deletion there. Deletion asks you to type an exact confirmation phrase, because it does not come back. Both requests report their status while they run, and a finished export hands you a signed link with a limited lifetime.

For anything those two workflows do not cover, including a request about someone who is not you, email [email protected]. The company behind WISEPIM Growth-OS is WISEPIM.

Some questions sit outside the code and still need a decision from the company. The lawful basis for holding records about people who never asked to be in our pipeline. The basis and the notice for recording calls and keeping their transcripts. Retention periods per record kind. Whether a processing agreement is needed with any provider we connect a source to.

None of those are set anywhere in WISEPIM Growth-OS, and this page will not imply otherwise. When they are decided, this page gets updated in the same change.