Privacy policy for the GROW app

Last updated: 15 October 2026

This policy explains what personal data the GROW app uses, why, who receives it, how long we keep it, and how you can ask us to delete it. GROW is the app for Dominaite Alliance Partners: self-employed sales partners who introduce businesses to Dominaite.

This policy covers the GROW app only. The Dominaite platform for merchants has its own privacy policy.

1. Who we are

The GROW app is provided by Dominaite EOOD, str. Dr. Miron Ignatiev No. 11, fl. 2, ap. 4, Primorski, 9010 Varna, Bulgaria, UIC 208557619 ("Dominaite", "we", "us"). We decide why and how your personal data is used, so we are the data controller.

Questions about privacy: privacy@dominaite.com.

2. What data we use and why

Your account and sign-in

• What: your name, email address, phone number, the password you choose, and one-time sign-in codes. If you add a profile photo when you sign up, that photo too.
• Why: to create your partner account and let you sign in securely.
• How: sign-in runs on Amazon Cognito (Amazon Web Services, data centre in Stockholm, Sweden). We never see your password. Cognito stores it in protected form.
• This phone: after you sign in with a code, Cognito remembers this phone by a device key, so it may not ask for a code next time here. Signing out makes Cognito forget it.

Your identity check

• What: photos of your identity document, a live selfie and a short selfie video. If your document has a chip and you choose to scan it, also the data read from the chip with your phone's NFC reader (the same data printed on the document, plus its photo).
• Why: the law and our partner agreement require us to verify who our partners are before we pay them (anti-money-laundering and fraud prevention).
• How: our identity-verification provider Sumsub does the check inside the app. Sumsub processes the images and chip data on our behalf and tells us the result. The app uses your camera and microphone only while you take part in the check.
• During the check, Sumsub also receives a random identifier for your phone and technical details about the device, to detect fraud.
• If the identity-check screens fail while you use them, Sumsub's software sends Sumsub a crash report. The report holds technical details about the error and your device, linked to your check. Sumsub uses it to find and fix the error. We have switched off Sumsub's usage statistics in the app.

Your partner work

• What: your partner profile (country, area, preferred language, tier), and the leads and businesses you record (business names, contact people, phone numbers, email addresses, notes and visit records). Also the onboarding applications you help businesses complete, and the offers you prepare.
• Why: to run the service you use as a partner, and to attribute the businesses you introduce to you.
• Note: the leads you enter contain other people's personal data. Only enter data you have a right to share, and tell the people concerned that you share it with Dominaite.

Your earnings and payouts

• What: your commission, tier and payout records, your tax details and your bank account (IBAN).
• Why: to calculate and pay what you earn, and to meet tax and accounting law.

Coins and the Store

• What: the coins you earn for your partner work, the Store items you order with them, the order's status, and the delivery address you give for the order. The delivery address is the recipient name, street address, city, postal code, country and, if you add it, a phone number. The app fills in the address form from the addresses on your partner profile. You can change it before you order.
• Why: to send you the items you order and to keep your coin balance correct.
• Note: coins are not money. You cannot buy, sell, transfer or cash them out. You can only use them in the Store. If you send an item to someone else, tell them that you give us their name and address for the delivery.

The leaderboard and badges

• The leaderboard is off for you until you turn it on. In the app, "Show me on the leaderboard" starts switched off.
• If you turn it on, other GROW partners can see your first name, the first letter of your last name, your area, your tier and how your rank moved. They never see your earnings, your sales figures or your contact details. You see your own monthly sales figure. No one else does.
• You can turn it off at any time in the same place. Your row disappears after the next nightly update of the board.
• Badges: we work them out from the data we already hold about your work (for example your first merchant). The app shows them to you.

Notifications

• What: the messages we show you in the app's notifications inbox (for example that a merchant you brought in got its payment terminals), and whether you have read or cleared each one.
• Why: to keep you informed about your work.
• How: the inbox is inside the app only. We do not send push notifications and hold no push-notification token.

Mercury, the assistant

• What: the messages you write to Mercury, the in-app assistant, and the records you ask it about.
• Why: to answer your questions and suggest next steps.
• How: Mercury runs on Dominaite's own service. To write its answers, that service sends your message and the related records to Azure OpenAI, an AI model service of Microsoft, which acts on our behalf.
• Our Azure OpenAI service is set up in Microsoft's Germany West Central region, where its stored data is kept. To answer a request, Microsoft may process it in another Azure region, including outside the EU. Microsoft's data protection terms cover such transfers.

Address search

• What: the address text you type into an address field during a business application.
• Why: to suggest complete addresses as you type.
• How: when address suggestions are switched on in the app, the app sends the text to Google Places (Google LLC). Without address suggestions, you type the address by hand and nothing goes to Google.

App lock

If you turn on the app lock, your phone checks your fingerprint or face. The app never receives your fingerprint or face data. It only learns from the phone whether the check passed.

Data kept only on your phone

When you move up a tier, the app shows a short celebration once. To know that it has shown it, the app remembers on this phone the last tier it showed you. It files this under a one-way code made from your partner number (not the number itself). This stays on the phone and is not sent to us.

App updates

The app may download small updates from Expo (the app platform we build on). This request carries your phone's network address, the app's version and a random number the app creates when it is first installed, so Expo can tell installs apart. No account data is sent.

3. What we do not do

• No location. The app does not ask for or use your phone's location. Directions open your maps app with the business's address. Your position stays in the maps app.
• No advertising and no advertising identifiers.
• No crash reporting or analytics tools of our own. The only crash reports leave the app from the Sumsub identity-check screens, to Sumsub, as described under "Your identity check".
• No sale of personal data, and no use of it for anyone else's marketing.
• No push notifications today. If we add push notifications later, we change this policy first.

4. Who receives your data

Only the providers we need to run the service, each under a contract that limits them to our instructions:

• Amazon Web Services (Cognito): sign-in. Stockholm, Sweden (EU).
• Microsoft Azure: our servers and databases. Germany West Central (EU).
• Microsoft (Azure OpenAI): Mercury's answers. Stored in Germany West Central (EU); a request may be processed in other Azure regions, including outside the EU.
• Sumsub: identity check.
• Google (Places): address suggestions, if switched on.
• Expo: app updates.

Other GROW partners see your first name, last-name initial, area, tier and rank movement only if you turn on "Show me on the leaderboard" (see section 2).

We also share data when the law requires it (for example with tax authorities). We share data with the businesses you introduce only as far as the introduction needs. A delivery company posts the Store items you order to the address you give.

When a provider processes data outside the EU/EEA, we use the European Commission's approved Standard Contractual Clauses or another safeguard the GDPR allows, such as an adequacy decision.

5. How long we keep it

• Leads, notes, visit records and other work records: while your partner account is open, and until we complete the deletion after you ask us to delete your account (see section 7).
• Account and identity-check data that anti-money-laundering law requires: for the duration of our business relationship plus 7 years. Then we delete it.
• Commission, payout, tax and Store order records: 7 years from the date of the transaction, as Bulgarian accounting and tax law requires.
• Technical records, including sign-in records kept for security: typically 24 to 36 months, unless they are needed for a security or fraud investigation.
• Messages to our support team: 3 years after the matter is resolved.

6. Your rights

You can ask us to: see the data we hold about you, correct it, delete it, limit how we use it, object to a use, and receive a copy in a portable form. Write to privacy@dominaite.com. We will respond to your request within one month of receipt.

You can also complain to a data protection authority. Our lead authority is the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, kzld@cpdp.bg. You can also complain to the authority of the country where you live or work. The European Data Protection Board lists the national authorities.

7. How to delete your account

• In the app: Settings, then Legal, then Delete my account. Read what is deleted, then confirm. The app signs you out. We schedule the deletion for 30 days after your request, and our staff then complete it.
• Without the app: follow the steps on grow.dominaite.com/delete-account.

What we delete: your partner account and sign-in, your profile and contact details, your identity check, and your leads and notes. What we must keep: your commission, payout and Store order records, and the account and identity-check data that anti-money-laundering law requires. We keep them only for as long as the law requires (section 5).

8. Security

Data travels encrypted (HTTPS). Sign-in uses one-time codes. You can lock the app with your fingerprint or face. Inside Dominaite, only the staff who need partner data can access it.

9. Children

GROW is for adults working as Dominaite partners. We do not knowingly accept partners under 18.

10. Changes

When this policy changes, we update the date at the top. If a change affects how we use your data, we tell you in the app before the change applies.