Privacy Policy

1) Scope & Roles

• Scope. This Policy covers our handling of information about:
  (a) Account users (admins and team members who log in), and
  (b) Visitors to our sites and marketing pages.
  It also explains how we handle end‑user data that our customers collect on the landing pages they build with Grownomic.
• Controller vs. Processor.
  • We act as a controller for our own site/app, analytics, and communications.
  • We act as a processor (service provider/contractor) when customers send us Customer Data about their own end users via the pages, forms, and integrations they configure. Customers are responsible for providing their end users with legally sufficient notices and consents. If required, we will enter into a Data Processing Addendum (DPA) with customers.

2) Information We Collect

The information we collect depends on how you use the Service.

1. Account & Billing – name, email, password, company, role, plan, payment/billing details (handled by our payment provider).
2. Customer Content – assets you or your team upload or connect (copy, images, video, templates, logos, code, configurations).
3. Customer Data – data you collect from your own end users on pages you host with us (form entries, device/analytics identifiers), plus your workspace settings and integrations you connect (e.g., ad platforms, analytics, CRM).
4. AI Prompts & Outputs – prompts or other inputs you send to AI features and the resulting content (text, images, layouts, code).
5. Usage/Telemetry ("Service Data") – event logs, device info, IP address, timestamps, feature usage, performance/quality signals, diagnostics, and security signals.
6. Support & Feedback – messages, tickets, survey responses.
7. Cookies & Similar Tech – used for authentication, security, analytics, debugging, A/B testing, and remembering preferences. See Cookies & Tracking below.

Sensitive or regulated data. The Service is not designed for PHI (HIPAA), PCI payment card data, or other highly regulated data. Please don't submit such data unless we have a written agreement that says otherwise.

3) How We Use Information

We use information to:

• Provide the Service – create and manage accounts and workspaces; host pages; connect integrations; process payments; provide support.
• Operate, maintain, and secure – monitor uptime, prevent abuse, detect fraud/security incidents, debug, and ensure integrity.
• Improve and develop (service-improvement data) – understand feature adoption, measure performance, debug issues, and improve reliability and quality. This may involve processing Service Data and, where necessary, limited PII (e.g., account or device identifiers) to reproduce problems or assess feature performance. Where feasible, we use aggregated or de-identified data; in some cases identifiable data is necessary to operate and improve the Service.
• Communicate – send transactional messages (in‑product, email); with your consent or as permitted by law, send product updates and marketing. You can unsubscribe from marketing at any time.
• Comply with law & enforce terms – protect our rights, address disputes, and meet legal obligations.

AI-specific practices

• No foundation‑model training on your content. We don't train foundation models using your Customer Content, Customer Data, Prompts, or Outputs. We use third‑party AI providers via API and configure them—where controls exist—not to retain your prompts/outputs for their own model training.
• Human review. We may review a set of interactions to investigate abuse, troubleshoot, or evaluate system quality, subject to access controls and confidentiality obligations.
• Outputs & responsibility. AI outputs can be inaccurate or non‑unique. You should review outputs for accuracy, claims substantiation, and compliance with applicable laws and platform policies before using them commercially.

4) Legal Bases & Applicability

We are a U.S. company. When privacy laws like GDPR/UK GDPR or U.S. state privacy laws (e.g., CA/CO/CT/VA/UT/DE, as applicable) apply to us or to your use, we will comply with those laws' requirements (e.g., transparency, rights, appropriate contracts). Where required, we will present appropriate notices, obtain consent, and honor user rights.

5) Sharing Your Information

We do not sell personal information. We share as follows:

• Service providers / sub‑processors. Hosting, cloud compute, AI model APIs, email/SMS delivery, analytics, logging/monitoring, payments, support, and similar vendors who process data for us under contracts. We maintain a written list of these providers and will notify of material changes where required by law.
• Integrations you connect. If you enable a connection (e.g., ad platforms, analytics, CRM), we'll send or receive data as necessary to provide the integration—subject to the third party's terms and privacy policy. You can disable integrations at any time.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, data may be transferred subject to this Policy and any successor's privacy commitments.
• Legal, safety, and rights. To comply with law, enforce agreements, or protect Grownomic, our users, or the public from harm.

We may share aggregated or de‑identified information that does not identify an individual.

6) International Data Transfers

We may process and store information in the United States and other countries where we or our providers operate. Where required, we will use lawful transfer mechanisms.

7) Retention

We retain information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. We apply different retention periods by category (e.g., account/billing records kept for statutory periods; logs for shorter operational periods). When data is deleted from active systems, residual copies may remain in backups for a limited time and are purged in the ordinary course.

8) Your Choices

• Account settings. You can access, correct, or delete certain account information in your workspace settings.
• Marketing communications. You can unsubscribe from marketing emails via the link in the message. We may still send transactional or service‑related communications.
• AI settings. If we introduce workspace‑level controls related to prompts/outputs retention, you'll find them in settings or documentation.
• Cookies & Tracking. See below for choices regarding analytics and advertising cookies.

When applicable laws grant you rights (e.g., access, correction, deletion, portability, restriction, objection, appeal, or opt‑out of targeted advertising/sale/profiling), you or your authorized agent can submit a request at info@grownomic.ai. We will verify your identity, respond within required timeframes, and explain any denial with appeal instructions as required.

For Customer end‑users: Please contact the relevant customer (the controller of your data). If you contact us directly, we may notify the customer and help them respond where appropriate.

9) Cookies & Tracking

We use cookies, local storage, and similar technologies to:

• keep you signed in and secure sessions,
• remember preferences,
• measure usage and performance,
• diagnose and fix issues, and
• (where applicable) support marketing attribution and A/B testing.

Choices. You can control cookies in your browser settings. Where required by law, we'll present a banner or settings to manage optional cookies. If you enable Global Privacy Control (GPC) or similar recognized signals in a supported region, we will treat it as an opt‑out where required.

10) Security

We implement technical and organizational measures designed to protect personal information, including encryption in transit and at rest, access controls, and vulnerability management. No method of transmission or storage is perfectly secure; we can't guarantee absolute security. If we confirm unauthorized access to personal information in our possession, we will notify affected customers without undue delay and in accordance with applicable law.

11) Children's Privacy

The Service is not directed to children under 13, and we don't knowingly collect personal information from them. If you are a parent or guardian and believe your child has provided us personal information, contact us to request deletion.

12) Third‑Party Links

Our Service may link to third‑party websites, apps, or services. Their privacy practices govern when you leave our environment. Review those policies carefully.

13) End‑User Content, IP, and Takedowns

If you believe content hosted through our Service infringes your rights, you can submit a notice to info@grownomic.ai. We may remove or disable access to disputed materials and may terminate repeat infringers as permitted by law. See our Terms for details.

14) Data Subject / Consumer Requests

To exercise a privacy right or submit a question/complaint, email info@grownomic.ai with:

• your name, email, and the country/state you reside in,
• the right you wish to exercise, and
• enough detail for us to understand and respond.

If we refuse a request where permitted by law, we'll explain why and how to appeal.

15) How We Work With AI Providers

• We use reputable third‑party AI model providers through API to power certain features.
• We do not authorize providers to use Customer Content or Customer Data to train their general models. Provider processing is also subject to their terms and privacy policies.
• If our practices materially change, we will update this Policy.

16) Your Responsibilities

You're responsible for the content and datasets you upload; ensuring you have rights to use third‑party materials; and for complying with laws that apply to your marketing uses (e.g., consent for email/SMS, claims substantiation, platform rules). For end‑user data collected via your pages, you must provide any required notices and obtain any required consents.

17) Data Export & Deletion at End of Subscription

Upon request at the end of your subscription, we will make your Customer Content and Customer Data reasonably available for export to the extent required by law. We will delete or anonymize Customer Content and Customer Data from active systems within legally required timeframes, except for limited business records (e.g., billing, security logs) we may retain as permitted. Backups are purged in the ordinary course.

18) Contact

Questions about this Policy or our privacy practices?
Email: info@grownomic.ai

Order of precedence. If this Policy conflicts with a DPA executed between you and Grownomic, the DPA controls for processing in scope of that DPA. For general use of the Service, the Terms of Use and this Policy both apply.