Privacy Policy

In plain language: The whole policy in eight lines. The sections below are the binding text.

• We collect what we need to run your account and the services you buy: your name, email, sign-in details, billing status and what you set up with us.
• We never see or store your card number. Stripe handles all payments.
• If you sign in with Google, we receive only your Google account ID, name, email address and profile photo. We use them only to sign you in and to show your profile photo.
• We do not sell your data, we do not show ads, and we do not run advertising or analytics trackers.
• Some service providers help us run the platform, such as hosting, email delivery and payments. They are listed below.
• Your data is stored in the United States and, for AI agent apps, in Germany by default. Platform backups are kept in Germany.
• You can ask us to see, correct, export or delete your data at any time.
• Green Commerce is for people aged 18 or over.

In plain language: Green Commerce is a US company. We decide how your account data is used, so we are responsible for it.

This policy is issued by GRN COMMERCE LLC, a Delaware limited liability company doing business as Green Commerce ("Green Commerce", "we", "us"), with its address at 1786 Branch Vine Dr W, Jacksonville, FL 32246, USA.

For the personal data described in this policy we act as the controller (the party that decides why and how the data is used).

You can reach us about privacy at privacy@grncommerce.com.

In plain language: Our website, the dashboard and the API. Not the content of the sites and mailboxes you run for your own customers.

This policy covers www.grncommerce.com, the dashboard at app.grncommerce.com, our API, and the support we provide.

Content you host with us. When you use our hosting, email, Git Deploy, database and AI agent apps, you store your own content on our systems, and that content may include personal data about your visitors, customers or contacts. For that content, you are the controller and we process it only on your instructions, to provide the service. You are responsible for having your own privacy notice and a legal basis for that data.

If you need a data processing agreement for that content, one is available on request at privacy@grncommerce.com.

In plain language: What you give us, what the services generate while you use them, and a small amount of technical data for security.

Account and profile. Your name, email address, the password you choose (if you set one), an optional profile photo that you upload, and your language preference. Your account and sign-in details are held by the self-hosted account system that is part of our hosting product.

Google sign-in. If you sign in with Google, see "Google user data" below.

Billing. Your plan, subscription status, payment status and Stripe customer reference. Card details stay with Stripe (see "Payment data").

Services you set up. Your sites, domains, connected Git repositories, email accounts, app instances, and the settings you choose for them.

Domain registration. If you register a domain through us, the registrant contact details that domain registries require (name, organisation, postal address, email and phone).

Site migrations. If you ask us to migrate a site, the access details for your previous host. We store them encrypted.

Connected Git accounts. If you connect GitHub, GitLab or Gitea, the access token that the provider issues. We store it encrypted and use it only to deploy the repositories you choose.

Contracts. If you hire or are hired through Contracts: the contract terms, amounts, the files you attach, and the payout status Stripe reports to us. Identity and bank details for payouts are given directly to Stripe.

AI usage. For our AI features we record which model was used, the number of tokens and the cost, so that we can bill credits. See "AI features".

Account sharing. If you invite people to your account: their email address, the role and scope you give them, and the actions taken while they work in your account.

Support and feedback. Messages you send to support and feedback you submit through the in-app feedback widget.

Security and technical data. For actions in your account we log the time, the action, the IP address and the browser (user agent). Our hosting providers also keep standard request logs.

Marketing. We do not send marketing email. If we ever do, we will ask for your consent first.

In plain language: To provide what you pay for, to keep it secure, and to meet our legal duties. Nothing else.

Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (see "Your rights").

Providing your name and email is required to open an account. Without them we cannot provide the service.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

In plain language: If you sign in with Google we get your Google ID, name, email and photo. We use them only to sign you in and show your avatar.

What we access. When you choose "Continue with Google", we request only the basic sign-in permissions (openid, email and profile). Google then shares with us your Google account identifier, your email address and whether it is verified, your name, and the address of your profile photo. When you confirm a sensitive action with Google, we also receive the time you last signed in to Google. We do not request access to your Gmail, Drive, Calendar, contacts or any other Google data.

How we use it. To create your account or link it to an existing one, to sign you in, to confirm your identity again before sensitive account changes, and to show your Google profile photo as your avatar.

How we store it. We store your Google account identifier, the Google email address linked to your account, and the address of your profile photo, together with your account. Google's sign-in tokens are used once to confirm who you are. They are not stored.

How we share it. We do not sell Google user data, do not use it for advertising, and do not use it to train AI models. We do not transfer it to anyone except as needed to provide the features you use (for example, your name and email become part of your account record, which our service providers process as described in "Who receives your data"), for security, or to comply with the law.

Limited Use. Green Commerce's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access. You can unlink Google in your dashboard settings once you have set a password, or remove Green Commerce's access at any time at myaccount.google.com/connections. To delete the data entirely, ask us to delete your account (see "Your rights").

In plain language: When you use our AI features, what you send them goes to a third-party AI model provider to get an answer.

Some features use AI models: GRN.AI credits used by your agent apps, the AI assistant in database apps, and scheduled checks in agent apps. When you use them, the prompts and content you or your app send are passed to third-party AI model providers so they can generate a response.

Our AI gateway records only the model, the token counts and the cost, to bill your credits. It does not keep the content of your prompts or responses. Requests from the database AI assistant are held for up to 24 hours while they are processed and then removed.

Under the terms we use with these providers, they do not use this content to train their models.

Your own AI keys. If you configure an agent app with your own API key for an AI provider, your app talks to that provider directly under your own agreement with it. That provider is your choice and is not our service provider.

In plain language: We never see or store your card number. Stripe does.

All payments are processed by Stripe, our only payment processor. Card details are entered into Stripe and are never transmitted to or stored on Green Commerce systems. We receive from Stripe only what we need to manage your subscription, such as the payment status, the card brand and last four digits where Stripe provides them, and your billing details.

Contractor payouts run through Stripe Connect Express. Payees give their identity and bank details directly to Stripe, which acts as an independent controller for that verification. We receive only the onboarding and payout status.

In plain language: Only the companies that help us run the service, each for a specific job. We do not sell your data.

We share personal data with the service providers below, only for the purpose shown, under contracts that require them to protect it. This list was last updated on 5 October 2026.

Self-hosted software. Our hosting product includes software that we run on our own servers, such as the cPanel control panel and the account system that provisions it and holds sign-in details. These are part of our service, not third parties.

Operational alerts. Alerts that our own team receives about the health of the platform contain internal identifiers only, not customer personal data.

People you invite. Members you add to your account can see the services and data within the scope you give them.

Other disclosures. We may disclose data when the law requires it, to protect the rights, property or safety of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.

No sale, no targeted advertising. We do not sell personal data or share it for cross-context behavioural advertising.

In plain language: Mostly in the United States. AI agent apps run in Germany by default. Backups are kept separately.

Our main platform, including your account, hosting, email and databases, runs on servers in Hillsboro, Oregon, United States. New AI agent apps run in Nuremberg, Germany, by default, with an optional low-latency location in Ashburn, Virginia, United States. Backups of the platform are written daily, encrypted, to separate storage in Germany.

Because Green Commerce is a US company with customers around the world, your data will be transferred to and processed in the United States and other countries where our providers operate. Where data protection law requires it, we protect these transfers with the European Commission's Standard Contractual Clauses or an equivalent mechanism, or with providers certified under the EU-US Data Privacy Framework, and, for countries such as the Dominican Republic, on the basis that the transfer is necessary to perform our contract with you.

You can ask us for more information about these safeguards using the contact details below.

In plain language: As long as your account is open, then only as long as the law or a clear reason requires.

We keep your data for as long as your account is open and for the periods below after that. Backups roll off on their own schedule, so deleted data can remain in encrypted backups until they expire.

In plain language: Encryption in transit, encryption for stored secrets, encrypted backups and limited access.

Connections to our website, dashboard and API are encrypted with TLS. Sensitive credentials we store, such as connected Git tokens and site migration access details, are encrypted with AES-256-GCM. Backups are encrypted. Access to production systems is limited to the people who need it and uses key-based authentication. No system is perfectly secure, and if a breach affects your personal data we will notify you and the authorities as the law requires.

In plain language: Only what the dashboard needs to work. No advertising or analytics cookies.

The dashboard uses only cookies and browser storage that are strictly necessary for it to work or that remember a choice you made, so it does not ask for cookie consent:

The in-app feedback widget is provided by JotReview. It is not loaded on sign-in pages. On other dashboard pages, while you are signed in, it receives your account ID, email address and name so that feedback can be linked to your account, and it may store its own data in your browser to work. Our website does not load any third-party scripts or fonts.

We do not use advertising, analytics or tracking cookies. If we ever add them, we will ask for your consent first where the law requires it.

In plain language: You can see, fix, export or delete your data, and object to how we use it. Write to us and we will answer within a month.

Depending on where you live, you have some or all of these rights: to access your data and get a copy; to correct it; to delete it; to restrict or object to how we use it; to receive it in a portable format; and to withdraw consent where we rely on consent. You will not be treated differently for exercising them.

How to exercise them. Email privacy@grncommerce.com from the address on your account, or open a support ticket from the dashboard. We may need to confirm your identity. We answer within one month; where a request is complex we may extend that by up to two more months and will tell you why. You can update most profile data yourself in the dashboard settings.

European Economic Area, United Kingdom and Switzerland. You have the rights in Articles 15 to 22 of the GDPR (and the UK GDPR), and you can complain to the data protection authority where you live or work.

Dominican Republic. Under Law 172-13 you have the rights of access, rectification, cancellation and opposition, and you can bring a habeas data action before the courts.

Brazil, Mexico and the rest of Latin America. You have the rights given by your local law (for example, LGPD rights in Brazil, and ARCO rights in Mexico). You can contact us at the address above, and you can complain to your local data protection authority.

United States. If you live in a US state with a consumer privacy law, you can ask to know, access, correct and delete your data. We do not sell personal data, share it for targeted advertising, or use sensitive data for purposes that require an opt-out. If we deny your request, you can appeal by replying to our answer, and if you are not satisfied, contact your state attorney general.

In plain language: Green Commerce is not for children.

Our services are meant for people aged 18 or over, and we do not knowingly collect data from children. If we learn that a child has given us personal data, we will delete it.

In plain language: If we change something important, we tell you before it applies.

We will update this policy when our practices change. We show the effective date and version at the top. If a change materially affects how we use your data, we will notify you by email or in the dashboard before it takes effect. Earlier versions are available on request.

In plain language: This policy exists in English and Spanish.

This policy is available in English and Spanish. Both versions have equal standing. If you are a consumer, the version in your language applies.

In plain language: One address, and a person reads it.

Privacy questions and requests go to privacy@grncommerce.com. You can also write to support@grncommerce.com or to our postal address: 1786 Branch Vine Dr W, Jacksonville, FL 32246, USA.