dtcgrowth.ai
Legal · Privacy

Privacy Policy

Effective May 16, 2026 · Iron Creek LLC d/b/a dtcgrowth.ai

This policy explains what we collect when you use dtcgrowth.ai, what we do with it, who we share it with, and the rights you have. Short version: we collect what we need to run the product and email you, we don't sell your data, and we don't use it to train AI models.

1. Who we are

Iron Creek LLC (d/b/a dtcgrowth.ai) is the data controller for personal information collected through the website at dtcgrowth.ai and the API at api.dtcgrowth.ai.

2. What we collect

2.1 Information you give us

  • Email address. When you subscribe to a free Skill, purchase a product, sign up for the newsletter, or create an account.
  • Account details. The name and email on file with your account, plus any preferences you set.
  • Payment information. Card numbers go directly to Stripe; we never see or store them. Stripe shares with us a customer ID, the last four digits of the card, the card brand, your billing email, and the transaction amount.
  • Uploaded content. Files you upload to use a Skill or a tool (for example, a Meta ads CSV for the auditor, or product imagery for Animate). We store these on our servers only as long as we need to deliver the result.
  • Brand library inputs. URLs and notes you save in the Operator brand library so tools can reuse them.
  • Support correspondence. Messages you send us by email or in-app.

2.2 Information we collect automatically

  • Usage and audit logs. Which Skills you invoke, when, with what input size, and the result status. This is how we enforce subscription limits and debug problems.
  • API logs. For Operator API and Custom Connector requests: timestamp, route, response status, request size, and a hashed reference to the API key.
  • Email engagement. Whether you opened or clicked a transactional or marketing email, via Resend's standard tracking.
  • Technical data. IP address, browser user agent, device type, and rough geographic region, captured by our web server logs and used for security and abuse prevention.

2.3 What we do not collect

  • Card numbers, full bank account numbers, or any data Stripe holds on your behalf.
  • Social Security numbers, government IDs, or biometric data.
  • Browsing activity outside our site or app.

3. How we use it

We use personal information to:

  • Deliver Skills, run hosted tools, and provide the Operator API.
  • Process payments, prevent fraud, and handle refunds.
  • Send transactional email (purchase confirmations, password resets, sub lifecycle, API alerts).
  • Send marketing and educational email to subscribers who opted in, with a one-click unsubscribe in every message.
  • Enforce usage limits and acceptable use, and protect the Services from abuse.
  • Improve the product. We look at aggregate usage data (which tools get used, where workflows break) to prioritize what to build next.
  • Comply with legal obligations.

We do not sell your personal information. We do not use your uploaded content to train, fine-tune, or improve any machine learning model. We do not share your data with advertisers for targeting.

4. Legal basis (EEA / UK)

If you are in the European Economic Area or the United Kingdom, our legal bases for processing are:

  • Contract. To provide the Services you bought or signed up for.
  • Legitimate interests. To secure the Services, prevent fraud, and improve the product. We balance these against your rights.
  • Consent. For marketing email and any optional tracking, with the right to withdraw at any time.
  • Legal obligation. To meet tax, accounting, and law-enforcement requirements.

5. Who we share it with

We share personal information only with the subprocessors that help us run the Services. Each is bound by a data-processing agreement and has its own security commitments.

  • Stripe, Inc. Payment processing.
  • Resend, Inc. Transactional and marketing email delivery.
  • Anthropic, PBC. Claude API for Skills you invoke, for the Custom Connector flow, and for narrative/scripting steps inside Animate.
  • Google LLC. Gemini API (visual analysis) and Veo (video generation), used as part of the Animate pipeline.
  • Kling AI, Fal.ai, ElevenLabs, Inc. Generation backends for Animate. Only triggered when you use Animate.
  • Vercel, Inc. Static-site hosting for dtcgrowth.ai.
  • Akamai (Linode). Server hosting for api.dtcgrowth.ai.

We may also share information if required by law, subpoena, or court order, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you).

6. Cookies and tracking

We use a small number of first-party cookies for essential functions: keeping you signed in, remembering your account selection, and securing forms. We do not use third-party advertising or cross-site tracking cookies. We do not use Google Analytics, Meta Pixel, or any similar third-party tracker on the public site at this time. If we add product analytics, we will update this section and the tracker will use first-party or privacy-preserving infrastructure.

7. How long we keep it

  • Account and subscription data. While your account is active and for up to 7 years after closure for tax and audit purposes.
  • Uploaded files. Up to 30 days after the job completes, then purged. You can ask us to delete them sooner.
  • Email subscribers. Until you unsubscribe, then we retain a suppression record indefinitely so we never email you again.
  • Logs. Up to 90 days for application logs, longer for audit and billing events.

8. Your rights

Depending on where you live you may have the right to:

  • Access a copy of the personal information we hold about you.
  • Correct information that is inaccurate.
  • Delete personal information, subject to legal retention.
  • Port data to another service.
  • Object or restrict certain processing, including direct marketing.
  • Withdraw consent at any time where consent is the basis.
  • Lodge a complaint with a supervisory authority (EEA / UK).

California residents: you have rights under the CCPA / CPRA to know what we collect, to delete, to correct, to opt out of "sale" or "sharing" (we do not sell or share for cross-context behavioral advertising), and to non-discrimination.

To exercise any right, email hello@dtcgrowth.ai from the address associated with your account. We will verify and respond within 30 days.

9. Children

The Services are not directed to anyone under 18. We do not knowingly collect personal information from children under 13. If you believe we have, email us at hello@dtcgrowth.ai and we will delete it.

10. Security

We take reasonable measures to protect personal information: TLS for data in transit, hashed API keys, encrypted backups, an admin-allowlist for sensitive operations, and audit logs of administrative actions. No system is perfectly secure; if we ever experience a breach that affects you, we will notify you as required by law.

11. International transfers

Our servers are in the United States. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data-protection rules than your country. By using the Services you consent to this transfer. For transfers from the EEA / UK we rely on standard contractual clauses or other lawful mechanisms.

12. Changes

We may update this Privacy Policy from time to time. The effective date at the top of this page indicates the latest version. Material changes will be communicated by email to active subscribers. Continued use after the effective date constitutes acceptance.

13. Contact

Privacy questions, requests, or complaints: hello@dtcgrowth.ai.