Terms of Service

Open Digital Business, hosted by Growgnite

Effective date: October 24, 2026

Last updated: October 24, 2026

These terms are a contract between you and Growgnite LLC, a Wyoming limited liability company ("Growgnite", "we", "us"). They cover your use of the hosted Open Digital Business service (the "Service"), including:

• the app at app.opendigitalbusiness.com;
• the pages, sites, funnels, checkouts, forms and course portals you publish through it, whether on opendbiz.com or on a domain you connect;
• the Service's emails, APIs and integrations.

Please read them carefully. By creating an account, signing in, or using the Service, you agree to these terms. If you don't agree, don't use the Service.

In short (this summary isn't a substitute for the full terms):

• The Service is for businesses and professionals aged 18 or over.
• You own what you create. We use it only to run the Service, and we never use it to train AI models.
• You're the seller in your own sales; payments run through Stripe under Stripe's own terms.
• You're responsible for what you publish and send, and for how you treat your customers' data.
• Paid plans renew automatically until you cancel, which you can do online at any time.
• Some uses are not allowed (section 11). We may suspend accounts that break these terms.

1. Who these terms apply to

Business use only. The Service is a set of business tools for creating, launching and running digital products. You may use it only for your trade, business, craft or profession, not as a consumer for personal or household purposes.

Using the Service for an organisation. If you accept these terms for a company or other organisation, you confirm that you're authorised to bind it, and "you" means that organisation as well as you.

Minimum age. You must be at least 18 years old.

Other places you may be. You may not use the Service if you're barred from receiving it under the laws of the United States or of where you live, including sanctions laws (section 20).

2. The software and this Service

The Service runs the Open Digital Business software, which others may also run on their own servers. These terms govern only the hosted Service that Growgnite runs. In particular:

• Copies run by others aren't covered. A copy of the software run by anyone else (including services run by other operators) is not the Service, and Growgnite is not responsible for it. Its operator's terms apply there.
• Our names. These terms don't grant rights to the names "Open Digital Business", "Growgnite" or their logos. To use them, ask us at support@growgnite.com.

3. Your account

Accurate details. Give us accurate information when you sign up, and keep it up to date. Your email address is how we reach you about your account and these terms.

Keep your sign-in secure. Keep your password secure and don't share your sign-in. Each person who uses the Service needs their own account. You're responsible for activity under your account unless it results from our failure to secure the Service. Tell us promptly at support@growgnite.com if you think someone has accessed your account without permission.

Signing in with Google. If you sign in with Google, Google's terms apply to that sign-in, and the email address Google confirms becomes your account's address.

4. Workspaces and members

What a workspace is. Your work lives in a workspace. The person who creates a workspace is its owner, and an owner can invite members and give them roles.

Owners are responsible for their workspace. The owner, and the organisation they act for, is responsible for:

• who has access to the workspace;
• what members do in it;
• making sure members follow these terms.

When someone leaves. If a member leaves, the workspace's content stays with the workspace.

When a workspace's control is disputed. If people disagree about who controls a workspace, we may rely on our records (for example, who created it and who pays for it). We may also suspend changes until the dispute is resolved.

5. Plans, trials, credits and payment

Plans. The features, limits and prices of each plan are shown in the app and on our pricing page at the time you choose them. Some features have usage limits, such as storage, pages, contacts, emails or AI usage.

Automatic renewal. Paid plans are subscriptions. Unless you cancel:

• They renew automatically at the end of each billing period (monthly or yearly, as you chose), for the same length.
• Each renewal is charged at the then-current price to the payment method on file.
• We show the terms first. Before you subscribe, we show the price, the billing period, and that the plan renews until cancelled.

Cancelling. You can cancel online at any time from Account → Billing, which opens Stripe's billing portal, without contacting us. Cancellation takes effect at the end of the current billing period, and you keep paid features until then.

Refunds. We don't refund fees for a billing period that has already started, except where the law requires it or where we decide to make an exception.

Price changes. If we change the price of your plan, we'll email you at least 7 days, and no more than 30 days, before the new price applies to you. You can cancel before it takes effect.

Trials and free plans. We may offer a free plan or a trial, and we may change or end them. If a trial will turn into a paid plan, we'll tell you before you start it and remind you before you're charged.

Hosted AI credits. Some AI features use credits. These may be included with your plan, given as a trial, or bought in packs.

• They aren't money. Credits have no cash value, can't be transferred or sold, and aren't refundable except where the law requires.
• How long they last. Credits don't expire while your account is open, and they end when your account closes.
• How many each task uses. The number of credits a task uses is shown in the app and can change as providers change their prices.

Payment. Subscriptions and credit packs are billed through Stripe. We don't receive or store your full card number.

Taxes. Prices exclude taxes unless stated. You're responsible for applicable taxes, and we'll add them where we're required to collect them.

Failed payments. If a payment fails, we'll tell you and retry. If it still fails, we may move your workspace to a free plan or suspend paid features until it's paid.

6. AI features

Choosing a provider. The Service can generate text, images, video, audio and other material with AI models from third-party providers. You can use:

• the hosted AI the Service provides, paid for with credits; or
• your own provider account or API key, where the Service supports it.

When you use your own key, your agreement with that provider also applies, including its rules on usage and data.

How AI output behaves. AI output can be wrong, incomplete, out of date, biased, or similar to what others receive. It isn't professional advice of any kind. You're responsible for:

• Reviewing it. Read and check what the Service generates before you publish, sell or rely on it.
• Your claims. Every claim you make with it (section 11.3).
• Its use of other people's work. Whether its use infringes anyone's rights.

Disclosure. Where the law requires it, you must disclose that content was generated or altered by AI. Examples include realistic images, audio or video of real people, places or events, and AI-generated text published to inform the public on matters of public interest.

Labels in AI output. The Service may add labels or machine-readable markers to AI-generated media where the law requires it, and you must not remove them where the law forbids that.

Providers' policies. You must also follow the usage policies of the AI providers the Service uses for you.

No training on your content. We don't use your content, prompts or outputs to train AI models. What the providers do with them is explained in our Privacy Policy.

7. Your content

What "your content" means. "Your content" is everything you or your members put into or create with the Service: prompts, products, pages, media, emails, courses, offers, contacts and settings. It includes the output the Service generates for you.

You keep your rights. As between you and us, you own your content, to the extent the law allows anyone to own it.

What you let us do with it. You give us a worldwide, non-exclusive, royalty-free licence to host, copy, process, transmit, display and adapt your content, only as needed to:

• provide, secure and support the Service for you;
• publish what you choose to publish;
• comply with the law.

This licence ends when your content is deleted from the Service, apart from copies kept in backups for the limited time described in our Privacy Policy, or as the law requires.

Your rights to what you upload. You confirm that you have the rights and permissions needed for your content and for our use of it under these terms.

Feedback. If you send us ideas or suggestions, we may use them without any obligation to you.

8. Publishing pages, sites and domains

Published pages are public. When you publish a page, funnel, site, checkout or course, it becomes available on the internet at the address shown. You're responsible for everything on what you publish, including:

• Your legal notices. Your terms, privacy policy, refund policy, and any notice the law requires of a business like yours (for example, your business name and contact details).
• The accuracy of your offers and claims.
• Consent for any tracking you turn on.

Custom domains. You may connect only domains you control. We obtain and renew security certificates for them automatically. If you stop pointing a domain to the Service, or we can't verify your control of it, it will stop serving your pages.

Our addresses. Addresses on opendbiz.com and opendigitalbusiness.com belong to us. We may refuse, reclaim or change an address on our domains if it's misleading, infringes someone's rights, or is needed for the Service.

Unpublishing for safety. We may unpublish or block access to a page that breaks section 11 or puts visitors or the Service at risk (section 13).

9. Selling with the Business Hub

The Business Hub lets you sell offers, take payments, deliver products and courses, run affiliate programmes, and email and track your customers.

9.1 You're the seller

Sales are between you and your customer. When you sell through the Service, the sale is a contract between you and your customer. Growgnite is not a party to it and is not the seller, merchant of record, or agent of either of you. You're responsible for:

• your products and their delivery;
• your prices and descriptions;
• refunds, cancellations, disputes and chargebacks;
• customer support and warranties;
• licences and permits;
• the taxes due on your sales;
• the consumer-protection, distance-selling and subscription laws that apply where your customers live.

Recurring payments. If you sell subscriptions or payment plans, you must make the renewal terms clear before purchase and honour cancellations as the law requires.

9.2 Payments through Stripe

The Hub's checkouts use Stripe Connect. You connect your own Stripe account, and Stripe pays out to you.

Payment processing services for workspaces on Open Digital Business are provided by Stripe and are subject to the Stripe Connected Account Agreement, which includes the Stripe Terms of Service (collectively, the "Stripe Services Agreement"). By agreeing to these terms or continuing to operate as a workspace on Open Digital Business, you agree to be bound by the Stripe Services Agreement, as the same may be modified by Stripe from time to time. As a condition of Growgnite enabling payment processing services through Stripe, you agree to provide Growgnite accurate and complete information about you and your business, and you authorise Growgnite to share it and transaction information related to your use of the payment processing services provided by Stripe.

Stripe's role. Stripe, not Growgnite, decides whether to accept, hold, reverse or pay out funds. We don't hold your money.

Platform fee. If your plan includes a platform fee on Hub sales, its rate is shown on your plan. It's deducted from each sale through Stripe.

9.3 Email

The Hub sends email for you: receipts, deliveries, sequences and broadcasts. You must:

• Have the right to email each person. Have a lawful basis to email each recipient, including the consent required for marketing in their country.
• Be honest about who is writing. Never use false or misleading sender names, subject lines or headers.
• Let people unsubscribe. Keep the unsubscribe link the Service adds to marketing emails, and honour unsubscribes. The Service suppresses unsubscribed addresses for you.
• Show your postal address. Include a valid postal address in marketing emails. The Service asks for one before sending.
• Bring your own lists lawfully. Upload contacts only if you collected them lawfully. Never upload bought, rented or scraped lists.

Protecting delivery. To protect delivery for everyone, we may pause sending from a workspace with high bounce or complaint rates, or one that appears to send spam.

9.4 Affiliates

The Hub tracks referrals and calculates commissions. It doesn't pay them. You pay your affiliates and are responsible for your affiliate terms, for their tax reporting, and for making sure your affiliates disclose their relationship with you as the law requires.

9.5 Tracking, ads and social proof

You can connect a Meta pixel, Google Analytics and Meta ad accounts, and show social proof and testimonials. You're responsible for using them lawfully:

• Consent. By default, the Service loads your tracking tags on your pages only after a visitor consents through the page's banner. If you turn that requirement off, you're responsible for having another lawful basis where your visitors live.
• Platform terms. Meta's and Google's terms apply to your use of their tools and to the conversion data the Service sends them on your behalf.
• Honest proof. Social proof and testimonials must be real, current and honest (section 11.3).

9.6 Your customers' personal data

You're in charge of it; we act on your instructions. For the personal data of your customers, contacts, students, affiliates and visitors that the Service processes for you ("Customer Data"):

• You're the controller (or "business"), and decide why and how it's used.
• We're your processor (or "service provider"), and process it only on your instructions.

The Data Processing Terms in Schedule A form part of these terms and apply to that processing.

Your obligations. You must:

• give the people concerned the notices the law requires, including your own privacy policy;
• obtain any consents you need;
• answer their requests about their data. The Service has tools to export and erase a contact.

10. Connected accounts and third-party services

You can connect accounts at other services, such as YouTube, Meta (Facebook and Instagram), LinkedIn, X, TikTok, Pinterest, Stripe, and AI providers. When you do:

• Acting for you. You authorise the Service to act on your behalf with that service as you direct, for example to publish a post or create an ad.
• Their terms apply. That service's own terms and policies apply to your use of it.
• We don't run them. We don't control those services and aren't responsible for them, their availability, or changes they make.
• Disconnecting. You can disconnect an account at any time in the app, or revoke access from the other service's settings.

YouTube. The Service uses YouTube API Services. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

11. Acceptable use

These rules keep the Service safe and lawful for everyone, including the people who visit your pages and receive your emails. They apply to your content, your published pages, your emails, and your use of the Service.

11.1 Illegal and harmful content

Don't use the Service to create, publish or send:

• Child sexual abuse material. Content that sexualises minors in any way. We report it to the authorities.
• Intimate imagery without consent. Intimate images or video of a real person shared without their consent, including AI-generated or altered images that depict an identifiable person.
• Deceptive deepfakes. Realistic AI-generated or altered images, audio or video of a real person that are presented as real or likely to mislead, without their consent and a clear disclosure.
• Threats, harassment, abuse or doxxing. Including publishing someone's private information without permission.
• Hate and extremism. Content that promotes violence or hatred against people for who they are, or that supports terrorism or violent extremism.
• Instructions for serious harm. Such as making weapons capable of mass harm.
• Infringement. Content that infringes copyrights, trademarks or other rights, including selling products you don't have the rights to sell.

11.2 Fraud, scams and security abuse

Don't use the Service for:

• Phishing. Pages that imitate another business or collect passwords, payment details or personal data under false pretences.
• Impersonation. Pretending to be a person or organisation you're not.
• Malware. Distributing malware or links to it.
• Spam. Unsolicited bulk messages, or messages that break section 9.3.
• Pyramid and Ponzi schemes. Including other schemes that pay mainly for recruiting people.
• Fake documents. Fake or counterfeit documents or credentials.
• Prohibited products. Selling anything that Stripe's restricted-business list, or the law where you or your customers are, forbids.

11.3 Honest marketing

Because the Service is used to sell products, these rules matter especially. Don't:

• Earnings claims you can't back up. Make false or unsupported claims about earnings, results or income ("make $10,000 a month"). That includes presenting exceptional results as typical.
• Fake reviews and endorsements. Publish reviews, testimonials, endorsements or social proof that are fake or AI-invented, that come from people who didn't use the product, or that misrepresent who wrote them.
• Undisclosed incentives. Hide that a review or endorsement was paid for or rewarded, or that an affiliate earns a commission.
• Fake scarcity. Use countdown timers, "only 3 left" messages or other scarcity claims that aren't true.
• Unproven health, financial or legal claims. Make health, medical, financial or legal claims you can't substantiate, or present AI output as professional advice.

11.4 Using the Service fairly

Don't:

• Bypass the Service's protections. Get around limits, quotas, credits, plan restrictions or security measures, or use another person's account.
• Probe or attack the Service. Scan, test, overload or attack the Service, or its users or providers. The exception is security research done in good faith, without harming users or their data, and reported to security@opendigitalbusiness.com.
• Scrape or copy it in bulk. Scrape the Service, or copy content from it in bulk, except your own content through the export tools.
• Resell it without permission. Resell, sublicense or provide the hosted Service to others as a service, unless we agree in writing.
• Misuse its resources. Use it to mine cryptocurrency, or as general-purpose file hosting or a mail relay.
• Break AI providers' rules. Use AI features in a way that breaks the providers' usage policies.

11.5 What we do about it

We may investigate suspected breaches and act in proportion to the problem. We may:

• remove or restrict content;
• pause sending;
• unpublish pages;
• suspend or close the account;
• report illegal activity to the authorities.

Section 13 explains how.

12. Reporting content, and copyright

Anyone can report content on the Service, whether or not they have an account. We review reports and act on them promptly.

Copyright (DMCA). If you believe content on the Service infringes your copyright, send a notice to our designated agent with the following:

• your contact details;
• the work you believe is infringed;
• where the material is (its address on the Service);
• a statement that you believe in good faith that the use isn't authorised;
• a statement, under penalty of perjury, that your notice is accurate and that you're the owner or authorised to act for them;
• your physical or electronic signature.

Copyright Agent, Growgnite LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States; support@growgnite.com

If your content was removed and you believe that was a mistake, you can send a counter-notice as the law allows. We close the accounts of repeat infringers where appropriate.

Intimate images shared without consent. If an intimate image or video of you (or of someone you represent) has been published on the Service without consent, including an AI-generated one, email support@growgnite.com with the subject "Removal request". Include:

• your signature (typing your full name is enough);
• where the image appears;
• a short statement that it was published without consent;
• how to reach you.

We'll remove it within 48 hours of a valid request, and make reasonable efforts to remove known identical copies.

Other illegal or harmful content. Report it to support@growgnite.com. Explain why you believe it's illegal or breaks these terms, and include its address and your contact details. We'll confirm receipt and tell you what we decided.

If we act on your content. We'll tell you what we did and why, unless the law forbids it or doing so would create a risk of harm. You can ask us to review the decision by replying to that message.

13. Suspension and closing your account

Closing your account. You can stop using the Service at any time. To close your account or a workspace you own, email support@growgnite.com from your account's email address. Closing doesn't refund fees already paid (section 5).

When we may suspend you. We may suspend or limit your account, a workspace, or any part of the Service if:

• you break these terms in a way that matters, or don't fix a breach after we ask you to;
• payment is overdue;
• what you're doing creates a risk of harm to others, legal exposure for us, or a threat to the Service's security or stability;
• the law or an authority requires it.

Notice and the chance to fix it. We'll give you notice and a chance to fix the problem first, unless the breach is serious, it's urgent, or the law prevents notice.

When we may close your account. We may close an account that remains in breach, that repeatedly breaks these terms, or that is used mainly for prohibited purposes.

Ending the Service. We may also end the Service as a whole with at least 60 days' notice. For paid plans, we'll refund the unused part of any prepaid period.

Getting your data out. You can export your products, pages, orders and each contact's data with the Service's export tools while your account is open.

• After closing. After closing, for whatever reason, we'll keep your content for 30 days so you can ask for an export, unless the law or the reason for closing prevents it.
• Deletion. After that, we delete it as described in our Privacy Policy.

What survives. Sections that by their nature should survive closing (such as payment obligations, sections 7, 15 to 19 and Schedule A until deletion) survive it.

14. Changes to the Service and to these terms

The Service changes. The Service changes as the software evolves: features are added, improved, and sometimes removed. If we remove a feature that's central to a paid plan you're on, we'll tell you in advance. If you cancel because of it, we'll refund the unused part of any prepaid period.

These terms change. We may update these terms. For changes that matter, we'll notify you by email or in the app at least 30 days before they apply, unless the change is required sooner by law or addresses a new risk.

If you don't accept a change. You can close your account before the change applies. If you keep using the Service after it applies, you accept the new terms.

The current version, with its effective date, is always linked from the sign-in page.

15. Availability, security and backups

No guaranteed uptime. We work to keep the Service available and secure, but we don't promise it will be uninterrupted or error-free. We may need maintenance windows, and we'll try to schedule them at quiet times.

Beta features. Features marked beta or preview may change, be removed, or behave unexpectedly.

Backups. We back up the Service regularly so we can recover from incidents, but backups aren't an archive for you. Keep your own copies of important content using the export tools.

Security incidents. We protect the Service with reasonable technical and organisational measures. Schedule A describes what we do if a security incident affects Customer Data.

16. Disclaimers

To the extent the law allows:

• No warranties. The Service is provided "as is" and "as available", without warranties of any kind, whether express, implied or statutory. This includes warranties of merchantability, fitness for a particular purpose, title, non-infringement and accuracy.
• No guaranteed results. We don't guarantee any business results, sales or income from using the Service.
• Third-party services. We're not responsible for third-party services, including AI providers, Stripe, and the platforms you connect.

Some places don't allow these exclusions, so some may not apply to you.

17. Limitation of liability

To the extent the law allows:

• Indirect losses. Neither you nor we will be liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill or data, even if warned they were possible.
• The cap. Each party's total liability arising out of or relating to these terms or the Service is limited to the greater of:
• the amounts you paid us for the Service in the 12 months before the event giving rise to the claim; or
• US $100.

These limits don't apply to:

• your payment obligations;
• your obligations under section 18 (indemnity);
• a party's fraud, gross negligence or wilful misconduct;
• liability that the law doesn't allow to be limited.

18. Your responsibility for claims against us

You'll defend and indemnify Growgnite, its members, officers and employees against third-party claims, and the losses and reasonable costs (including legal fees) arising from them, that arise out of:

• your content, your published pages or your emails;
• your sales, products and dealings with your customers and affiliates;
• your processing of Customer Data in breach of the law or Schedule A;
• your breach of these terms or the law.

How claims are handled. We'll tell you promptly about the claim and let you control its defence, with our reasonable cooperation. You won't settle a claim in a way that admits fault for us, or that binds us, without our consent.

19. Governing law and disputes

Talk to us first. Most disagreements can be solved quickly. Before starting formal proceedings, contact us at support@growgnite.com and give us 30 days to try to resolve the issue informally.

Governing law. These terms are governed by the laws of the State of Wyoming, without regard to conflict-of-law rules.

Courts. Any dispute arising out of or relating to these terms or the Service will be brought only in the state courts located in Sheridan County, Wyoming, or the United States District Court for the District of Wyoming, and both parties consent to their jurisdiction. Either party may still seek urgent injunctive relief in any competent court to protect its intellectual property or confidential information.

20. Export controls and sanctions

You'll comply with the export-control and sanctions laws that apply to your use of the Service. You confirm that you're not located in a country or region subject to comprehensive US sanctions, and that you're not on a US government list of prohibited or restricted parties.

21. General

Entire agreement. These terms (with Schedule A, our Privacy Policy and any order or plan terms we agree with you) are the whole agreement between us about the Service. They replace earlier understandings.

Assignment. You may not transfer these terms without our consent. We may transfer them to an affiliate, or to a successor in a merger, acquisition or sale of the Service, and we'll notify you if we do.

Events beyond control. Neither party is liable for delays or failures caused by events beyond its reasonable control. Examples include outages of internet, hosting or AI providers, natural disasters, war, strikes and government action. This doesn't excuse payment obligations.

Notices. We'll send notices to the email address on your account or show them in the app. Send notices to us at support@growgnite.com, with legal notices also sent by post to 30 N Gould St Ste N, Sheridan, WY 82801, United States. You agree to receive communications electronically.

Severability and waiver. If part of these terms is unenforceable, the rest stays in effect, and the unenforceable part is applied as closely to its intent as the law allows. Not enforcing a right isn't a waiver of it.

Relationship. We're independent contractors. Nothing in these terms creates a partnership, joint venture, employment or agency relationship.

No third-party beneficiaries. These terms don't give rights to anyone else, except as Schedule A provides for the people whose data it protects, where the law requires.

Language. If we provide a translation, the English version governs.

22. Contact

Growgnite LLC 30 N Gould St Ste N, Sheridan, WY 82801, United States

• Support, abuse and removal requests, and copyright notices: support@growgnite.com
• Security reports: security@opendigitalbusiness.com

Schedule A: Data Processing Terms

These Data Processing Terms ("DPA") apply when Growgnite processes Customer Data for you as described in section 9.6. They form part of the Terms of Service. If they conflict with the rest of the terms, this DPA prevails for Customer Data. Capitalised terms not defined here have the meanings given by the applicable data-protection law (for example, the EU and UK GDPR, or the California Consumer Privacy Act).

A1. The processing

A2. Your instructions

We process Customer Data only on your documented instructions. These consist of these terms, your configuration and use of the Service, and other written instructions we agree.

• Legal duties come first. The exception is where the law requires otherwise. In that case, we'll tell you first unless the law forbids it.
• If an instruction breaks the law. We'll tell you if we believe an instruction infringes data-protection law.

A3. Confidentiality

We ensure that the people we authorise to process Customer Data are bound by confidentiality obligations.

A4. Security

We implement appropriate technical and organisational measures to protect Customer Data, including:

• encryption in transit (HTTPS);
• encryption of stored connection secrets;
• access limited to the people who need it, with strong authentication;
• firewalls and minimal exposed services;
• automatic security updates;
• separation of workspaces in the application;
• regular backups;
• monitoring for abuse.

We may update these measures as long as overall protection isn't reduced.

A5. Subprocessors

General authorisation. You authorise us to use the subprocessors listed in our Privacy Policy (section "Who we share data with").

• Their obligations. We impose data-protection obligations on each one that are no less protective than this DPA, and we remain responsible for their performance.
• Changes and objections. We'll give at least 30 days' notice of a new subprocessor, by updating the list and notifying subscribed account owners. You may object on reasonable data-protection grounds. If we can't resolve the objection, you may close the affected workspace and receive a refund of any prepaid fees for the remaining period.

A6. Helping you meet your obligations

We'll help you, taking into account the nature of the processing:

• Requests from individuals. Respond to requests from individuals to exercise their rights. The Service provides tools to find, export and erase a contact's data. If an individual contacts us directly about Customer Data, we'll refer them to you.
• Assessments. Carry out data-protection impact assessments and consult regulators, where required.

A7. Security incidents

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data, we'll:

• notify you without undue delay, and in any case within 48 hours of becoming aware;
• share the information you reasonably need to meet your own notification duties;
• take reasonable steps to contain the breach and reduce its effects.

A8. Audits

We'll make available the information reasonably necessary to demonstrate compliance with this DPA, and answer reasonable written questions.

• Auditing us. If that isn't enough, or a regulator requires it, you may audit our compliance, at your cost, no more than once a year.
• Conditions. You must give 30 days' notice. The audit must take place during business hours, be carried out by an auditor bound by confidentiality, and minimise disruption.

A9. Deletion and return

During the subscription. You can export Customer Data (your orders, and each contact's records) at any time while your account is open.

After it ends. When your use of the Service ends, we'll delete Customer Data within 30 days, after the export period in section 13. Copies in backups are overwritten within 14 days after that.

Copies the law requires us to keep. These may be kept for as long as the law requires, protected under this DPA.

A10. International transfers

The Service is hosted in the European Union. Growgnite is located in the United States, and some subprocessors are too, so Customer Data may be accessed from or transferred to the United States. To the extent Customer Data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, these safeguards apply:

• EEA. The Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference. Module 2 applies where you're a controller, and Module 3 where you're a processor. Further terms:
• Clause 7 (docking) applies.
• Clause 9 option 2 applies, with the notice period in A5.
• Clause 11's optional language doesn't apply.
• Clauses 17 and 18 select the law and courts of Ireland.
• Annex I is completed by A1 and the contact details in these terms.
• Annex II is completed by A4.
• UK. The UK International Data Transfer Addendum to those clauses applies.
• Switzerland. The clauses apply with the necessary adjustments, with the Federal Data Protection and Information Commissioner as the competent authority.

A11. US state privacy laws

Where Customer Data is "personal information" under the California Consumer Privacy Act or a similar US state law, we act as your service provider or processor, and we will not:

• sell or share it (as those laws define those terms);
• retain, use or disclose it for any purpose other than providing the Service to you, or as the law otherwise permits;
• retain, use or disclose it outside our direct business relationship with you;
• combine it with personal information we receive from others, except as those laws permit.

If we can't comply. We'll tell you if we can no longer meet these obligations. You may take reasonable steps to stop and remediate unauthorised use.

A12. Liability

Each party's liability under this DPA is subject to section 17 of the terms, except where the law doesn't allow it to be limited.