How we handle the information you send us.

1. Who we are

Glow & Grow is an independent supplier verification and due diligence service focused on helping international buyers better understand the businesses they plan to work with in China.

We review available company information, supplier documentation and relevant public records to provide practical, evidence-based findings that can support business decisions.

Glow & Grow does not act as a sourcing agent, does not receive commissions from suppliers and does not guarantee the safety, quality or performance of any supplier.

For general enquiries, contact [email protected]. For privacy-related enquiries, contact [email protected].

2. Information we collect

The Request a Supplier Check form may collect:

• About you: your name, company name, email address and, if you choose to give it, a phone or WhatsApp number.
• About the supplier: the supplier’s name, Chinese legal name if you provide it, website, marketplace link and contact person.
• About the transaction: the product, approximate transaction value, planned payment, and the stage you have reached.
• Your request: the service or package you select, and any concerns or information you ask us to investigate.
• Uploaded documents: PDF, JPG/JPEG, PNG, WEBP or TXT files that you choose to attach. For each file we also store its original filename, the document type you choose and its file size.

We also store an inquiry reference, the time you confirmed the statement beside the submit button, the version of that statement, and the version of this Privacy Policy that applied when you submitted.

3. Information about suppliers and other third parties

Supplier due diligence can involve information about people connected with a supplier, such as representatives, directors, shareholders where available, contact people and other persons who appear in relevant business or public records.

A review uses the information you supply and publicly available corporate, ownership, legal, court, enforcement and regulatory records, depending on the package selected. We do not claim access to sources we do not use.

4. How we use information

We use information to:

• review your inquiry;
• communicate with you about scope, pricing and next steps;
• carry out supplier verification or due diligence if you proceed;
• prepare and deliver findings and reports;
• keep the service secure and prevent abuse and spam;
• maintain operational records; and
• comply with legitimate legal obligations where they apply.

Submitting the inquiry form does not itself mean that Glow & Grow has accepted or begun a paid due diligence engagement.

We do not sell personal information. We do not currently use personal information for targeted advertising, and we do not currently run advertising analytics on this website.

5. Security and abuse prevention

When you use the website or submit the form, your IP address is processed in order to deliver the request. We do not intentionally store raw IP addresses in our application database. Instead, the application creates a salted, keyed hash (HMAC) of the address, which is used for abuse prevention and rate limiting. We treat that hashed identifier as potentially personal data.

Cloudflare Turnstile, which protects the form from bots, also processes technical and browser information and IP data. Our infrastructure providers may keep request and security logs for a limited time under their own practices.

6. Documents you upload

Uploaded documents are kept in private Supabase Storage and are not publicly accessible. Our internal notification emails do not include the uploaded files and do not contain permanent file or storage links.

Please submit only what is necessary for the review, and do not upload passwords, login credentials or payment card details.

Uploaded documents are not automatically malware-scanned. Accepting a file does not mean it has been checked as virus-free or safe.

7. Service providers

We use the following providers to run the service:

• Cloudflare: DNS, website hosting through Cloudflare Pages (when the site is published), Cloudflare Turnstile, and security and network processing.
• Supabase: the PostgreSQL database, private Storage, Edge Functions and related backend infrastructure. Our Supabase project data is currently hosted in Frankfurt, Germany (EU). This does not mean that all processing takes place there.
• Postmark: transactional and internal email notifications.
• Google Workspace: business email and correspondence.

These providers may process operational and security information in line with their own infrastructure and retention practices.

8. International processing

Information may be processed in countries other than the country where you or the supplier are located. Our primary Supabase database and storage region is currently Frankfurt, Germany, while other providers and service infrastructure may process information in other jurisdictions.

9. How long we keep information

Our systems apply the following schedule automatically. The retention process runs daily, so deletion may happen shortly after the nominal date rather than at an exact time.

• Inactive enquiries. An enquiry that has not progressed to an active engagement may be automatically closed after approximately 30 days of inactivity.
• Closed enquiries where you do not proceed. The enquiry record and any uploaded documents are scheduled for deletion approximately 30 days after closure.
• Original documents for completed work. Original uploaded documents are scheduled for deletion approximately 90 days after the report is delivered.
• Completed case records. Completed case and report records are scheduled for deletion approximately 365 days after the case is closed.
• Incomplete uploads. A submission whose uploads are not completed is removed once its upload window (about one hour) has passed.
• Rate-limit and security counters. Approximately 2 days.
• Audit events. Approximately 365 days.

Active engagements are managed by our team and are not closed automatically just because 30 days have passed.

Copies held in provider backups, infrastructure logs or email systems may remain for longer, according to each provider’s retention practices. We do not claim that every copy everywhere is removed at the same moment.

10. Emails and notifications

When you submit the form, we send ourselves an internal notification. It may contain the inquiry reference, the service or package, your name, your company, the supplier name, and the number and types of documents submitted. It does not contain document attachments or permanent document links.

Later business correspondence by email may contain other information that you or we choose to exchange.

11. Cookies, Turnstile and analytics

We do not currently use advertising cookies or website analytics. The Contact page uses Cloudflare Turnstile to prevent abuse and bots; Turnstile may use browser and device signals and limited storage that it needs to provide the security service.

12. Your choices and privacy rights

Depending on where you live, privacy laws may give you rights about your personal information, which can include the right to ask for access, correction, deletion or restriction of certain processing.

You can send a request to [email protected]. We may need to verify a request before acting on it, and we may keep information where needed for security, legal or legitimate record-keeping purposes.

If applicable law gives you the right to complain to a data protection or privacy authority, you may also do so.

13. Security

We use encrypted transport (HTTPS), keep documents in private storage, restrict database access, keep application storage non-public and apply security and rate-limiting controls. No online system can guarantee absolute security, so please avoid including anything more sensitive than the check requires.

14. Changes to this Privacy Policy

We may update this policy from time to time. The date at the top shows when it was last changed, and each inquiry records the policy version that applied when it was submitted.

15. Contact us

Privacy requests and questions: [email protected]. General enquiries: [email protected].

Verify a Supplier