Privacy Policy
Open Digital Business, hosted by Growgnite
Effective date: October 24, 2026
Last updated: October 24, 2026
This policy explains what personal information Growgnite LLC ("Growgnite", "we", "us") collects when you use the hosted Open Digital Business service (the "Service"), why, who we share it with, and the choices and rights you have. It applies to:
- people who sign up for and use the Service, and members of their workspaces;
- people who contact us or visit our websites, opendigitalbusiness.com and opendbiz.com.
At a glance
- No selling. We don't sell your personal information, and we don't use it for targeted advertising.
- No training. We don't use your content, prompts or outputs to train AI models.
- AI providers. Your prompts go to the AI provider that runs each task. Section 5 explains what each one may do with them.
- The pages you publish. Personal data your customers and visitors give to pages you publish is yours to control. We process it for you (section 9).
- Your rights. You can see, export, correct and delete your data. Section 12 explains how.
1. Who is responsible for your data
Growgnite is the controller for the personal information described in this policy:
Growgnite LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States Privacy questions: support@growgnite.com
Pages our customers publish. Workspaces use the Service to run their own businesses. When you buy from, sign up with, or visit a page published by a workspace, that business is responsible for your data, and its own privacy policy applies. We process that data for it as a service provider (section 9).
Copies run by others. Others may run their own copies of the Open Digital Business software. This policy covers only the Service that Growgnite runs. A copy run by someone else is that operator's responsibility.
2. What we collect
Information you give us
- Account details.
- your name, email address and password (which we store only as a secure hash);
- your workspace name;
- the roles of the people you invite.
- Profile from Google sign-in. Your name, email address, profile picture, and Google account ID. We don't receive your Google password.
- Your content. What you put into or create with the Service:
- prompts, products, pages, media, emails, courses and offers;
- brand settings;
- the contacts and customer records you add.
The people in your contacts are covered by section 9. - Billing details. Your plan, billing address, tax details, and payment history. Card details go directly to Stripe. We never receive your full card number. - Business and payout details for the Business Hub. When you connect a Stripe account, you give Stripe your business and identity details. Stripe shares account status and transaction information with us (section 10). - Support messages. What you send us by email or through the app, and our replies.
Information collected automatically
- Usage and device information. IP address, browser and device type, pages and features used, and the dates and times of requests. Your approximate location (country or region) can be inferred from your IP address.
- Security information. Sign-in attempts, rate-limit events, and records of suspicious activity, used to protect accounts and the Service.
- Error records. When a generation fails, we keep a technical record to diagnose it, which can include a short excerpt of the prompt.
- Cookies and browser storage. See section 8.
Information from services you connect
When you connect another service (YouTube, Meta, LinkedIn, X, TikTok, Pinterest, Stripe, an AI provider account), we receive:
- the access tokens it issues;
- the basic account details needed to show the connection, such as a channel or page name and its ID;
- the information needed for what you ask us to do, such as ad account and campaign figures.
We store access tokens encrypted.
3. How we use it
We use personal information to:
- Provide the Service. Create your account, run the features you use, publish what you publish, send the emails you schedule, and keep your workspace in sync across devices.
- Run AI tasks. Send your prompts and content to the AI provider that performs each task, and return the result (section 5).
- Bill you. Process subscriptions and credit purchases, and keep the records tax law requires.
- Communicate with you.
- Service messages: password resets, security alerts, receipts, plan and policy changes. You can't opt out of these while you have an account.
- Product news: where the law requires it, we send product news only with your consent. You can unsubscribe from product news at any time.
- Protect the Service and its users. Prevent fraud, spam and abuse, enforce our Terms of Service and acceptable-use rules, investigate security incidents, and respond to reports.
- Improve the Service. Understand which features are used and where errors happen, mostly from aggregated information. We don't use your content for this beyond fixing a problem you report or an error in your account.
- Comply with the law. Meet legal obligations, respond to lawful requests, and establish or defend legal claims.
We don't use automated decision-making that has legal or similarly significant effects on you.
4. Our legal bases (EEA, UK and Switzerland)
If you're in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Service, running AI tasks, billing, service messages | Performing our contract with you |
| Security, fraud and abuse prevention; improving the Service; measuring visits to our websites; product news to existing customers where permitted | Our legitimate interests in running a safe, working service and telling customers about it. These interests don't override your rights. |
| Product news where consent is required | Your consent, which you can withdraw at any time |
| Tax records, responding to authorities | Complying with legal obligations |
5. AI providers and your content
When you use an AI feature, the Service sends your prompt, plus any content you include, to the provider that runs the task. Which provider runs it depends on the feature and your settings:
- Hosted AI (paid for with credits). We send the request under our own business account with the provider. Under their terms at the time of writing:
- Anthropic, OpenAI and Google (on its paid API) don't use API data to train their models by default. They may keep requests for a limited time (for example, up to 30 days) to detect abuse.
- OpenRouter doesn't keep prompts by default, and our account routes only to model providers that don't train on them.
- KIE.AI passes image and video requests to the companies whose models it offers, and its terms don't say whether those requests may be used for training. Avoid putting personal or confidential information in image and video prompts.
- Your own key or account. If you connect your own provider account or API key, the request goes under your account, and your agreement with that provider governs how it treats your data.
- Free tiers can differ. For example, Google may use data sent through the free tier of its Gemini API to improve its products.
- Check the terms of any free tier you use.
What we do with prompts and output. We don't use your prompts, content or outputs to train AI models. Where a provider lets us choose, our accounts are set to refuse training.
Research Studio. It sends your search terms to public sources such as Google News, Reddit and YouTube to gather results.
6. Who we share data with
Service providers who process data for us (our subprocessors), under contracts that limit what they may do with it:
| Provider | What they do | Where |
|---|---|---|
| Contabo | Hosts the servers that run the Service and store its data | European Union |
| Stripe | Subscription billing; payments for Business Hub checkouts | United States and other countries |
| Resend | Delivers the Service's emails, including emails workspaces send | United States |
| Anthropic | AI text generation (hosted AI) | United States |
| OpenAI | AI text, image and speech generation (hosted AI) | United States |
| AI generation (Gemini, Veo); Google sign-in | United States | |
| OpenRouter | Routes AI requests to model providers (hosted AI) | United States |
| KIE.AI | AI image and video generation (hosted AI) | United States |
| Cloudflare | DNS, and hosting of our websites | United States and other countries |
Services you connect, at your direction. When you publish to YouTube or a social network, run Meta ads, or take payments through Stripe, we send that service what's needed to do what you asked.
Within your workspace. Members of a workspace can see the workspace's content according to their roles.
For legal reasons. We disclose information when we believe in good faith that it's required by law, court order or a valid legal request, or necessary to protect someone's safety, to prevent fraud or abuse, or to protect our rights. Where we can, we'll tell you about a request for your data first.
Business transfers. If Growgnite is involved in a merger, acquisition or sale of assets, personal information may be transferred as part of it. This policy, or one at least as protective, will continue to apply.
No selling or targeted advertising. We don't sell personal information, and we don't share it for cross-context behavioural advertising.
7. Google and YouTube data
The Service uses YouTube API Services so you can publish videos to your channel. When you connect a YouTube channel:
- What we receive. Access tokens and your channel's ID and title.
- What we use it for. Only to show the connection and to upload and publish the videos you choose.
- What we don't do with it. We don't use it for advertising, we don't sell it, and we don't share it except as needed to provide that feature.
Open Digital Business's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting. You can disconnect your channel in the app at any time, and we then delete the tokens and channel details we stored. You can also revoke our access from your Google account's security settings page.
Google's own policies. Google's handling of your data is described in the Google Privacy Policy. Use of YouTube is subject to the YouTube Terms of Service.
Google sign-in. If you sign in with Google, we receive only your basic profile (name, email address, picture and Google account ID) and use it only to create and sign in to your account.
8. Cookies and browser storage
We use a small number of cookies, all needed for the Service to work. We don't use advertising or third-party analytics cookies in the app.
In the app (app.opendigitalbusiness.com)
| Name | Purpose | Lasts |
|---|---|---|
aidpa_refresh |
Keeps you signed in. Secure and HTTP-only, sent only to the sign-in service. | Up to 30 days, or until you sign out |
dps_oauth_* |
Ties a Google or connected-account sign-in to the browser that started it, to prevent forgery | A few minutes |
Browser storage (for example theme-store) |
Remembers display preferences such as light or dark mode | Until you clear it |
On pages published with the Service, which workspaces control:
| Name | Purpose | Lasts |
|---|---|---|
dps_consent |
Remembers the visitor's answer to the page's consent banner | 180 days |
dps_student, dps_student_csrf |
Keeps a student signed in to a course portal, and protects that session | 30 days |
Session storage dps_proof_dismissed |
Remembers that a visitor closed a social-proof notice | Until the tab closes |
Meta pixel (_fbp, _fbc), Google Analytics (_ga) |
Set by Meta and Google if the workspace turned them on. By default they load only after the visitor consents. | Set by Meta and Google |
Requests to other services. Published pages can load fonts from Google Fonts and embedded videos from YouTube, Vimeo or Loom, if the workspace uses them. Those services receive the visitor's IP address and may set their own cookies.
Campaign tracking without our cookies. On published pages, campaign information (such as utm_ parameters or an affiliate code) travels in the page address rather than in our cookies.
Do Not Track and Global Privacy Control.
- In the app. We don't track you across other websites, so a Do Not Track signal doesn't change how the app behaves. We treat a Global Privacy Control signal as a request to opt out of selling or sharing, which we don't do anyway.
- On published pages. Tracking depends on the workspace's settings and the visitor's consent.
Our websites. Our websites measure visits with Cloudflare Web Analytics, which doesn't set cookies or track you across other sites. It counts page views from information such as the page address, the referring site and the browser type.
9. Data we process for workspaces
Workspaces use the Business Hub to sell, deliver courses, email their contacts, run affiliate programmes and track their marketing. For the personal data of their customers, contacts, students, affiliates and visitors:
- The workspace's role. The workspace is the controller and decides why and how the data is used.
- Our role. We process it only on the workspace's instructions, under the Data Processing Terms in our Terms of Service. We don't use it for our own purposes, except to secure the Service, prevent abuse, and comply with the law.
What the Service does for workspaces, on their instructions:
- Checkout. Records orders, and the campaign or referral that led to them.
- Ad conversions. If the workspace connected Meta or Google Analytics, reports purchases to them. For Meta, this includes a hashed email address, IP address and browser information.
- Email. Sends the workspace's emails, and keeps unsubscribe and bounce records so unsubscribed addresses aren't emailed again.
- Erasure. Lets the workspace erase a contact, which also removes them from its emails, social proof and records.
If you're a customer or contact of a workspace, contact that business to exercise your rights. If you contact us instead, we'll pass your request to it, or help it respond.
10. Payments through Stripe
Subscriptions are billed through Stripe, and Business Hub checkouts run on Stripe Connect.
When you connect your Stripe account. When you provide personal data in connection with connecting a Stripe account to the Service, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.
What Stripe shares with us. Stripe tells us the status of your account and your transactions, so the Service can show orders and deliver products. We never receive full card numbers.
11. Meta data, and how to delete it
If you connect a Meta account (Facebook, Instagram or Meta ads), we store:
- access tokens;
- the IDs and names of the pages and ad accounts you choose;
- the campaign figures needed for the reports you see.
How to delete this data:
- In the app, open the workspace's connected accounts (Publisher, or Business Hub → Ads) and choose Disconnect. In Publisher, this deletes the connection and its stored details. In Business Hub → Ads, it deletes the access token and revokes the app's permissions with Meta. The ad account and campaign details stay with the workspace until step 3 or until the workspace is closed.
- You can also remove the app from your Facebook settings, under Settings & privacy → Settings → Apps and websites.
- To delete everything else Meta provided, or if you no longer have access to your account, email support@growgnite.com with the subject "Delete my Meta data". We'll confirm when it's done, within 30 days.
12. Your rights and choices
Rights we offer everyone. Wherever you live, you can ask us to:
- tell you what personal information we hold about you, and give you a copy;
- correct it;
- delete it;
- give it to you in a portable format;
- stop using it for product news or other purposes based on our legitimate interests.
What you can do yourself in the app. You can update your account details, export your products, pages, orders and each contact's data, and disconnect connected accounts. To close your account, or for anything else, email support@growgnite.com.
EEA, UK and Switzerland. You also have the right to:
- restrict our processing;
- object to it;
- withdraw consent at any time, without affecting earlier processing;
- complain to your local data-protection authority.
California and other US states with privacy laws. You have the rights their laws give you, which include:
- knowing what we collect and disclose;
- deleting and correcting your information;
- opting out of selling, sharing and targeted advertising (we don't do these);
- not being discriminated against for using your rights.
How we handle requests.
- Verification. We'll verify your identity before acting on a request, usually by asking you to confirm it from your account's email address.
- Authorised agents. An authorised agent may make a request for you with your signed permission.
- Timing. We'll respond within one month. If the law allows more time and we need it, we'll tell you why.
- Appeals. If we decline a request, you can appeal by replying to our answer. We'll explain the outcome and how to complain to a regulator.
California "Shine the Light". We don't disclose personal information to third parties for their own direct-marketing purposes.
13. How long we keep data
We keep personal information only as long as we need it for the purposes in this policy:
| Data | How long |
|---|---|
| Account and workspace content | While your account is open. After you close it, 30 days so you can request an export, then deleted. Backup copies are overwritten within 14 days after that. |
| Billing and tax records | As long as tax and accounting law requires, generally 7 years |
| Security and server logs | 90 days, unless needed to investigate an incident |
| Error records of failed generations | 90 days |
| Support conversations | 2 years after the conversation ends |
| Unsubscribe and suppression records | As long as needed to keep honouring the unsubscribe |
| Connected-account tokens | Until you disconnect the account, or close your account |
14. How we protect data
We protect personal information with measures appropriate to the risk, including:
- encryption in transit;
- encryption of stored access tokens and secrets;
- password hashing;
- access limited to those who need it, with strong authentication;
- firewalls;
- automatic security updates;
- regular backups;
- monitoring for abuse.
No service can be perfectly secure. If a breach affects your personal information, we'll tell you and the authorities as the law requires.
You can report a security issue to security@opendigitalbusiness.com.
15. International transfers
Growgnite is based in the United States. The Service's servers are in the European Union, and several of our providers, including the AI providers, are in the United States. Your information may therefore be processed outside your country, where data-protection laws may differ.
When we transfer personal information from the EEA, the UK or Switzerland to a country without an adequacy decision, we use safeguards such as the European Commission's Standard Contractual Clauses, and the UK and Swiss equivalents.
You can ask us for a copy of the relevant safeguards at support@growgnite.com.
16. Children
The Service is for businesses and professionals and isn't intended for anyone under 18. We don't knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we'll delete it.
17. Changes to this policy
We'll update this policy when our practices change, and change the "Last updated" date. If a change matters, we'll tell account holders by email or in the app before it takes effect. Earlier versions are available on request.
18. Contact us
Growgnite LLC 30 N Gould St Ste N, Sheridan, WY 82801, United States
- Privacy and support: support@growgnite.com
- Security reports: security@opendigitalbusiness.com
Annex: US state privacy notice
This annex gives the detail that some US state privacy laws require. We give it to everyone, whether or not a given law applies to us.
What we collected in the last 12 months, and what we did with it
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email address, IP address, account IDs | Hosting, email, payment and AI providers (section 6) |
| Commercial information | Plan, purchases, billing history | Stripe, hosting provider |
| Internet activity | Feature usage, request logs | Hosting provider |
| Approximate location | Country or region inferred from IP address | Hosting provider |
| Audio, visual and similar information | Media and recordings you upload or generate | Hosting and AI providers |
| Professional information | Business name, role in a workspace | Hosting provider, Stripe |
| Sensitive information | Account sign-in credentials (password stored as a hash) | Not disclosed |
Where it comes from: you; your devices; services you connect; Stripe.
Why we collect it: the purposes in section 3.
How long we keep it: see section 13.
What we don't do:
- We haven't sold personal information or shared it for cross-context behavioural advertising.
- We don't do so for anyone under 16.
- We use sensitive information only to provide the Service and keep it secure, not to infer characteristics about you.