Privacy Notice

Last updated: 30 September 2026

Governing law: Province of Ontario, Canada (PIPEDA, Quebec Law 25 where applicable, GDPR/UK GDPR for EU/UK visitors)

This Privacy Notice (the “Notice”) applies to the Dash2Grow website at https://dash2grow.com and the Dash2Grow services (together, the “Services”), which are operated by Dash2Grow Inc., a company incorporated under the federal laws of Canada, with its registered office at 7 Bayview Station Rd, Ottawa, ON K1Y 2C5, Canada (“Dash2Grow,” “we,” “us”).

This Notice explains what information we collect, how we use it, who we share it with, and the choices and rights you have. It works alongside our Terms of Service.

The Services are intended for people 18 years or older. We do not knowingly collect personal information from anyone under 18.

1. Information We Collect

Information you give us

Account information: your name, email address, and a securely hashed password when you create an account.
Two-factor authentication: if you enrol in two-factor authentication, the phone number you give us for it, which is handled by Google Firebase (Section 7).
Two-factor backup codes: if you enable two-factor authentication, the recovery codes we generate for you.
Billing information: processed by our payment processor, Stripe. We receive tokenized references and limited details (for example, the last four digits and card brand). We never receive or store your full card number.
Content you submit: the inputs you send to generate AI outputs, and the AI outputs produced, along with any building blocks (prompts, agents, skills) you create, save, or share.
Communications: messages you send us (for example, support requests) and your newsletter or marketing preferences.

Information we collect automatically

Usage data: which building blocks you use, how often, and your plan tier.
Device and log data: IP address, browser type, operating system, device identifiers, and pages viewed.
Cookies and similar technologies: see Section 5.

2. How We Use Information

We use information to: provide and operate the Services; process payments and manage subscriptions; authenticate you and secure your account; respond to your requests; understand and improve how the Services are used; send service and, where permitted, marketing communications; prevent fraud and abuse; and comply with our legal obligations.

We may also create aggregated or de-identified information that can no longer reasonably be linked to you. We may use and retain that information for any lawful business purpose, including to analyze usage patterns and to improve and develop the Services and our library of building blocks (prompts, agents, and skills), and we will not attempt to re-identify it except as permitted by law.

3. AI Providers and How Your Content Flows

The Services are powered by third-party AI providers. When you use a feature that generates AI output, your inputs are transmitted to one or more AI providers to produce that output. The providers we use today are Anthropic (Claude models), OpenAI (GPT models) and Google (Gemini models). We may add or replace providers. The current list is the table in Section 7, and we update it when it changes.

We do not use your inputs or outputs to train AI models of our own, and we do not sell them. ⚠️ That is a statement about us, not about the AI providers in Section 7 — what each of them does with content sent to it is governed by its own terms, and the paragraph below explains what that means. We use your content to provide the Services to you, to operate and secure them, and for the limited purposes described in this Notice. We may, however, use aggregated and de-identified information about how the Services are used (which cannot reasonably be linked to you) to analyze patterns and to improve and develop the Services and our library of building blocks, as described in Section 2.

Each AI provider processes data under its own terms and privacy policy. Section 7 names every provider and links to its privacy policy, so you can read what each one does with the content it receives. Where an AI provider offers commercial or API terms that limit how long it retains submitted content, or that exclude submitted content from training the provider’s own models, we use those terms or settings where they are available to us. ⚠️ Once your content reaches an AI provider, what happens to it is governed by that provider, not by us. We do not control it, we are not responsible for it, and we cannot promise that a provider will not keep your content or use it — whether or not doing so is within that provider’s own policy. Please read those policies, and do not submit anything you would not be comfortable sending to a third-party company.

4. Analytics and Advertising

⚠️ Read this first: we run no advertising or analytics tool on our website today, and none of the tools listed in this section is loaded there. The list below is what we may use in future, published so you can see it in advance. When we load one, it will be in line with your cookie choices, and we will update this Notice first.

The only analytics tool in the picture today is PostHog, which is built into the Services and is not loaded on our website. It is named in Section 7 with every other provider we use.

If we add a website analytics tool, or any advertising or conversion-measurement tool — the common ones are products of Google, Microsoft, LinkedIn, Meta and X — we will name the provider in this Notice and, where consent is required, obtain your consent before it loads. Tools of that kind generally work by sharing online identifiers such as cookie IDs, device identifiers, and your IP address with the platform that supplies them. If we turn one on, this Notice will say what it shares before it loads.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Both of those happen through advertising cookies and pixels, and we run none — so there is nothing to opt out of today. If we turn any on, that may count as a “sale” or “sharing” under some US state privacy laws including California’s CCPA/CPRA, even though no money changes hands; we will update this Notice and provide an opt-out before that happens (Section 13).

5. Cookies and Your Choices

We use cookies and similar technologies in three categories:

Strictly necessary: required to run the Services (for example, sign-in and security). These are always on.
Analytics: help us understand usage (Section 4).
Advertising: help us measure and run marketing (Section 4).

⚠️ On our website at dash2grow.com we use strictly necessary cookies only today. We do not load analytics or advertising cookies there, so there is no consent banner and no cookie-preferences control — there is nothing yet for them to manage. You can control cookies through your browser settings.

The Services are not yet generally available. We will state the cookies the Services use, and provide the controls for them, before the Services open to customers.

Before we load any non-essential cookie we will present a consent banner with non-essential cookies off by default, add a cookie-preferences control, and update this Notice. Where consent is required — including for visitors in the EU, the UK, and Quebec — those cookies will load only after you opt in.

Some browsers offer a “Do Not Track” (DNT) signal. Because there is no common industry standard for how to interpret DNT, we do not respond to DNT signals. ⚠️ We do not currently process any opt-out signal, including the Global Privacy Control (GPC), because we run no advertising or analytics cookies for one to apply to. When we do, we will honour GPC and say so here.

6. Marketing Communications

With your consent, or where otherwise permitted by law, we may send you marketing emails about Dash2Grow features, content, and offers.

Canada (CASL). We send commercial electronic messages only with the consent required by Canada’s Anti-Spam Legislation (CASL). We identify ourselves in each message and include a working unsubscribe mechanism. ⚠️ If an unsubscribe link ever fails, email us at legal@dash2grow.com and we will remove you by hand.

Opting out. You can opt out of marketing emails at any time by using the “unsubscribe” link in any marketing message, by updating your preferences in your account where available, or by emailing us at legal@dash2grow.com. We will action your request within 10 business days, as CASL requires, and usually sooner. Even after you opt out of marketing, we may still send you non-promotional service messages about your account, such as billing, security, and important changes to the Services.

7. Subprocessors and Service Providers

We share information with vendors who process it on our behalf, under contract, only to provide the Services. The current list (which may change as we add or replace providers) includes:

Provider	What it handles
Google Firebase	phone numbers, when you enrol in or use two-factor authentication, and your authentication session — privacy policy
Stripe	payment processing — privacy policy
Anthropic · OpenAI · Google (Gemini)	AI model providers — the content you submit is sent to one of these to generate output. Privacy policies: Anthropic · OpenAI · Google
Resend	marketing, transactional and service email, including your email address — privacy policy
PostHog	product analytics — ⚠️ built into the Services, and not loaded on our website (Sections 4 and 5) — privacy policy
Hostinger	hosting for our marketing website at dash2grow.com — privacy policy

We may engage other subprocessors as the Services evolve, and will update this list. We do not sell personal information, and we do not share it except as described in this Notice (with service providers, to comply with law, to protect rights and safety, or as part of a business transfer such as a merger or acquisition, in which case we will notify you).

⚠️ This is the complete list of the providers we knew of when this Notice was published, with one gap we are naming rather than hiding: the Services are not yet generally available (Section 5), and we will name the provider that hosts them here before they open to customers. If you believe anything else is missing, tell us at the address in Section 17 and we will check and correct it.

8. Data Retention

We keep personal information only as long as needed for the purposes described here:

Account data: for the life of your account. ⚠️ You can ask us to delete your data at any time using the address in Section 17, and we will action that request. ⚠️ What we do not yet have is an automatic process that deletes or anonymises the underlying records when an account closes — we are building it, and until this Notice states a period, we are not committing to one.
Content and AI inputs/outputs: retained while your account is active and for a limited operational period thereafter, then deleted or anonymized.
Billing records: retained for as long as tax and accounting law requires us to keep them.
Analytics data: retained according to each analytics provider’s retention settings.
Security vulnerability reports: retained for up to 12 months after the issue is resolved, then deleted.

9. Security

We use reasonable, industry-standard administrative, technical, and physical measures designed to protect personal information. These include encryption of data in transit, storing account passwords only in hashed form, access controls that limit who can reach personal information, and contractual security commitments from our service providers. However, no method of transmission or storage is completely secure. The Services are provided on an “as is” and “as available” basis, and we do not warrant that they are secure or free from unauthorized access. To the maximum extent permitted by law, you use the Services at your own risk with respect to data security.

If a breach of our security safeguards creates a real risk of significant harm to you, we will notify you and the applicable regulators (including the Office of the Privacy Commissioner of Canada and, where required, Quebec’s Commission d’accès à l’information) as required by law, and we keep records of breaches as the law requires.

If you are in the EU, EEA, or UK, we will notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. The clock starts when we become aware of the breach, and reports sent to the address in Section 17 or under our Responsible Disclosure Policy are one of the ways that can happen.

10. Automated Decision-Making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, and we do not use your personal information for that kind of profiling. The AI features of the Services generate outputs at your direction and in response to the inputs you provide; they are tools you control, not automated decisions we make about you. If this ever changes, we will update this Notice and provide the rights and safeguards the law requires.

11. International Transfers

We are based in Canada and our providers may process data in Canada, the United States, and other countries. This means your information may be transferred to and processed in countries whose data-protection laws differ from those where you live.

Where personal information of individuals in the EU, EEA, or UK is transferred to a country that has not received an adequacy decision, we look to the appropriate safeguards contemplated by Article 46 of the GDPR. Depending on the provider, the safeguard it makes available may be:

the European Commission’s Standard Contractual Clauses (SCCs) for transfers out of the EU/EEA;
the UK International Data Transfer Addendum (IDTA), or the UK Addendum to the EU SCCs, for transfers out of the UK; and
the EU-US and UK-US Data Privacy Framework (DPF), where the receiving provider is certified under it.

⚠️ We do not have separately negotiated transfer terms with these providers; where a safeguard applies, it is the one the provider itself publishes. If you are in the EU, EEA, or UK and want to know which safeguard applies to a particular provider, email us at legal@dash2grow.com and we will tell you what we have established about that provider and where its terms can be read. ⚠️ For most providers that is the provider’s own published document rather than a signed agreement we can send you a copy of.

Where personal information is transferred onward from Canada to a provider in another country, the same safeguards above apply to that onward transfer.

Canada relies on its adequacy recognition for transfers from the EU/UK.

12. Your Rights

We owe you the rights in this section directly. In data-protection law the company that decides why and how personal information is used is called the controller, and the controller is the one that owes you these rights. For everything described in this Notice — your account, your billing, how you use the Services, and the content you submit — that is us. Section 12(a) at the end explains the two situations where that could be someone else, neither of which exists today.

Canada (PIPEDA) and Quebec (Law 25): you may request access to, and correction of, the personal information we hold about you, and request its deletion subject to legal retention requirements. Quebec residents have additional rights, including data portability. We respond within the timelines set by applicable law (generally 30 days). If you are not satisfied with how we handle your request or your personal information, you may file a complaint with the Office of the Privacy Commissioner of Canada, or, for Quebec residents, the Commission d’accès à l’information du Québec.

EU / EEA (EU GDPR) and UK (UK GDPR): you have the following rights, and you can exercise any of them using the address below:

Access: to get a copy of the personal information we hold about you.
Rectification: to have information that is wrong or incomplete corrected.
Erasure: to ask us to delete your personal information.
Restriction: to tell us to pause using your information while something is disputed, instead of deleting it.
Portability: to receive your information in a format you can take somewhere else.
Objection: to tell us to stop a particular use, including any use we base on our legitimate interests.
Not to be subject to a decision made solely by a machine where that decision has a legal or similarly significant effect on you (see Section 10). Our legal bases are: performance of our contract with you (account and billing); our legitimate interests (security, fraud prevention, and improving the Services); and your consent (analytics and advertising cookies, and marketing email). You may withdraw consent at any time, and it will not affect processing carried out before withdrawal. You may lodge a complaint with your local supervisory authority: in the UK, the Information Commissioner’s Office (ICO); in the EU/EEA, your national data protection authority.

EU / EEA / UK contact. You can raise any privacy question, or exercise any of your rights, by contacting us directly at legal@dash2grow.com, and we will handle your request. We do not currently maintain a separate EU, EEA, or UK representative; please use this address to reach us about data-protection matters in those regions.

How to exercise your rights: use the privacy controls in your account settings where available, or email us at legal@dash2grow.com. We may need to verify your identity before acting on a request.

12(a) The two situations where the controller would not be us

⚠️ Neither of these exists today. They are here so you can see what would change if one did.

If your organisation signs an agreement with us covering its staff’s use of the Services. Where that happens, the agreement decides which of us is responsible for which personal data. ⚠️ Your rights do not disappear — they may be owed to you by that organisation rather than by us, and we will say so here and tell you who to contact. ⚠️ No such agreement is in place with any customer today.

If we embed a third party that decides its own purposes. An advertising or measurement tool embedded in our website can make us and its provider joint controllers, because the provider decides its own purposes as well as serving ours. We run none today (Section 4). Before we turn one on, we will name it here, say what we and that provider each decide, and tell you which of us to contact about which right.

13. United States State Privacy Rights

If you are a resident of a US state that has enacted a comprehensive consumer privacy law, you have specific rights over your personal information, subject to the exceptions and limits in the applicable law. These states include California (CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, and Oregon. ⚠️ More US states are enacting laws of this kind. If yours is not listed and you want to exercise a right under it, contact us at the address below and we will deal with your request. Depending on your state, these rights may include:

Right to know / access: to confirm whether we process your personal information and to obtain a copy of it, along with details about the categories collected, the sources, the purposes, and the categories of recipients.
Right to delete: to request deletion of personal information we have collected from you. ⚠️ Read Section 8 with this — we will action a deletion request, and the automatic process that clears the underlying records on account closure is still being built.
Right to correct: to request correction of inaccurate personal information.
Right to portability: to receive your personal information in a portable and, where technically feasible, readily usable format.
Right to opt out of the “sale” or “sharing” of personal information and of targeted (cross-context behavioral) advertising.
Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, where your state provides it. ⚠️ We do not do this at all — see Section 10.
Right to limit the use of sensitive personal information, where your state provides it.
Right to non-discrimination: we will not deny you services, charge you a different price, or provide a different level of quality because you exercised your privacy rights.
Right to appeal: in states that provide it (for example, Virginia, Colorado, and Connecticut), you may appeal our decision on your request; if we deny your appeal, we will tell you how to contact your state Attorney General.

“Sale” and “sharing” of personal information. ⚠️ We do not sell your personal information, and we do not share it for cross-context behavioural advertising. None of the advertising cookies or pixels described in Section 4 is active. If that changes, it may be considered a “sale” or “sharing” under California’s CCPA/CPRA and several other state laws — and we will update this Notice and provide an opt-out before it does. We do not knowingly “sell” or “share” the personal information of consumers under 16.

How to opt out (“Do Not Sell or Share My Personal Information”). ⚠️ There is nothing to opt out of today — we run no advertising cookies or pixels, so no “sale” or “sharing” is taking place.

When we do, this section will carry the mechanism before the activity starts: a “Do Not Sell or Share My Personal Information” control, a cookie-preferences control, and recognition of the Global Privacy Control (GPC) as a valid opt-out signal. Because GPC applies to a specific browser or device, you would need to set it on each browser and device you use, and it may not be linked to your account unless you are signed in. ⛔ We will not begin such activity and add the controls afterwards.

Sensitive personal information. We do not collect government-identifiers, precise geolocation, health, biometric, or similar sensitive data in the ordinary operation of the Services, and we do not use or disclose sensitive personal information for purposes that would trigger a right to limit its use under California law. Any content you choose to submit as an AI input is handled as described in Sections 1 and 3.

How to exercise your rights. Submit a request by emailing legal@dash2grow.com or using the privacy controls in your account settings where available. We will not discriminate against you for exercising your rights. We may need to verify your identity before acting on a request, and we may decline requests as permitted by law. We will respond within the time your state’s law requires, generally within 45 days, and we may extend that period where the law allows, in which case we will let you know. You may use an authorized agent to submit a request on your behalf, in which case we may require proof of the agent’s authorization and verification of your identity.

14. Your Responsibilities

⚠️ Read this one carefully — it is the part of this Notice most likely to affect you personally.

When you type or paste other people’s personal information into the Services — a client list, a colleague’s email, a CV, a customer’s details — you are the one responsible for having the right to do so. That means the information is yours, or the people it concerns have agreed, or you have some other lawful reason to use it. We are not responsible for third-party personal information you submit without one, and it will be sent to an AI provider like any other input (Section 3).

15. Children

The Services are not directed to anyone under 18, and we do not knowingly collect their personal information. If we learn that we have collected personal information from a person under 18, we will delete it promptly.

This also satisfies the US Children’s Online Privacy Protection Act (COPPA), which sets a lower threshold of 13: we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at legal@dash2grow.com so we can delete it.

16. Changes to This Notice

We may update this Notice from time to time. For material changes, we will give notice by email or a prominent notice on the Services before the change takes effect, and we will update the “Last updated” date above.

17. Contact

Questions or requests about this Notice or your personal information:

Dash2Grow Inc. 7 Bayview Station Rd, Ottawa, ON K1Y 2C5, Canada Email: legal@dash2grow.com

Person responsible for the protection of personal information. For the purposes of Quebec’s Law 25, the person responsible for the protection of personal information at Dash2Grow Inc. is the individual exercising the highest authority within the company. You can reach that person in writing at the address above, or by email at legal@dash2grow.com — a mailbox that person owns and reads.