Privacy Policy

Dash2Grow ("Dash2Grow", "we", "us", or "our") operates the Dash2Growmarketplace and related services (the "Service"), which lets creators publish AI prompts, agents, workflows, and related digital products, and lets buyers discover and purchase them.

For the purposes of the EU and UK General Data Protection Regulation (together, the "GDPR"), Dash2Grow is the data controller of personal data you provide directly to us (for example, when you create an account or buy a listing). When you interact with an individual creator's storefront, that creator may be an independent controller of data you share with them.

Our registered contact for privacy matters is: privacy@dash2grow.com.

Placeholder: replace with your registered legal entity name, registered address, company number, and (if required) the name and contact details of your appointed EU/UK representative and Data Protection Officer before publishing.

This policy explains what personal data we collect when you useDash2Grow, why we collect it, how long we keep it, who we share it with, and the rights you have over it. It applies to the Dash2Growwebsite, dashboard, checkout, creator studio, and any communications we send you.

It does not cover third-party websites we link to, or the practices of creators who sell on Dash2Grow beyond what we handle on their behalf as a marketplace.

We collect the following categories of personal data:

• Account data. Your name, email address, password hash, profile picture, username, bio, location, and social links.
• Authentication data. Sign-in provider (email, Google), session tokens, and security events (sign-in, sign-out, password changes).
• Creator data. Listings you publish, versions, descriptions, cover assets, tags, and payout onboarding status.
• Transaction data. Purchases you make or receive, order totals, currency, receipts, invoices, refunds, and download activity. Card details are handled by our payment processor and are never stored on Dash2Grow servers.
• Communications. Messages you send to other users or to our support team, review content, discussion posts, votes, follows, wishlists, and notifications.
• Technical data. IP address, device and browser type, language, referring page, and timestamps, collected through standard server logs and cookies (see the Cookie Policy).

We do not intentionally collect special-category data (such as health, biometric, or political data) and we ask you not to submit it through listings, messages, or reviews.

Under the GDPR we must have a lawful basis for every use of your personal data. We rely on the following bases:

• Performance of a contract - to create your account, process purchases and payouts, deliver downloads, and provide the features you sign up for.
• Legitimate interests - to keep the Service secure, prevent fraud and abuse, moderate content, understand how the Service is used (aggregated analytics), and improve the product. You can object at any time (see "Your rights" below).
• Consent - for non-essential cookies, marketing emails, and any optional features that ask you to opt in. You can withdraw consent at any time without affecting prior lawful processing.
• Legal obligation - to keep tax, accounting, and consumer-protection records, respond to lawful requests from public authorities, and comply with anti-money-laundering rules where they apply.

We do not sell your personal data. We share it only with the following categories of recipients, and only to the extent needed:

• Payment and payout providers. Stripe processes card payments, invoices, and creator payouts. Stripe acts as an independent controller for payment data it handles - see Stripe's own privacy notice for details.
• Infrastructure and hosting providers. Cloud hosting, database, storage, email delivery, and error-monitoring vendors process data on our behalf under written data-processing agreements.
• Other Dash2Grow users. Your public profile, published listings, reviews, and discussion posts are visible to other users. Creators receive limited buyer information (order ID, purchased listing, and any message you send) to fulfil purchases and support.
• Authorities and legal successors. Where required by law, court order, or in connection with a merger, acquisition, or reorganisation, in which case we take reasonable steps to make sure your data continues to be protected.

Dash2Grow and some of our service providers operate outside the European Economic Area (EEA) and the United Kingdom. Where personal data is transferred outside those regions, we rely on one of the transfer mechanisms recognised by the GDPR - typically the European Commission's Standard Contractual Clauses (2021), the UK Addendum, and supplementary technical and organisational measures (such as encryption in transit and at rest) where appropriate.

You can request a copy of the safeguards we use by emailing privacy@dash2grow.com.

We keep your personal data only for as long as we need it for the purposes described above, or as required by law.

• Account data: for as long as your account is active. If you delete your account, we remove or anonymise it within 30 days, except where retention is required.
• Transaction and invoice data: up to 10 years after the transaction, to meet tax and accounting obligations in the jurisdictions where we operate.
• Support and moderation records: up to 3 years after the last interaction, to defend legal claims and improve safety.
• Server and security logs: up to 12 months.

If the GDPR applies to you, you have the following rights in respect of your personal data:

• Access - request a copy of the data we hold about you.
• Rectification - ask us to correct inaccurate or incomplete data.
• Erasure - ask us to delete your data ("right to be forgotten").
• Restriction - ask us to limit how we process your data.
• Portability - receive your data in a structured, machine-readable format, or have it sent to another controller where technically feasible.
• Objection - object to processing based on our legitimate interests, including profiling and direct marketing.
• Withdraw consent - where we rely on consent, you may withdraw it at any time.
• Automated decisions - we do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

You can exercise most of these rights directly from your profile and security pages, or by emailing privacy@dash2grow.com. We will respond within one month.

You also have the right to lodge a complaint with your local supervisory authority - for example, the Irish Data Protection Commission (DPC) or the UK Information Commissioner's Office (ICO) - though we would appreciate the chance to address your concerns first.

We use industry-standard technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest for our production database, hashed passwords, row-level access controls, role-based staff access, audit logging, and regular backups.

No system is perfectly secure. If we ever become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify affected users without undue delay.

Dash2Grow is not directed at children under 16, and we do not knowingly collect personal data from children under that age. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of the page and, if the changes are material, notify you by email or through the Service before they take effect.

Questions about this policy or how we handle your data? Email privacy@dash2grow.com or write to us via our contact page.