What we collect, and what we never do with it.

Growth House is the operating brand of Studio Sami LLC, a Florida limited liability company based in Davenport, Florida. This policy covers the Growth House marketing site and Studio OS, the platform that runs subscription builds. If you hired us for a one-time build that you host on your own infrastructure, your operational data lives with you, not us, and only the items in this policy that relate to our website and our business records apply.

Account information you give us: name, email, business name, and the login details needed to access your portal. Client data you submit through your build: documents, prompts, answers, configurations, and the records your workflow processes. Outputs the workflow generates for you. Payment information, which is handled by Stripe; we never see or store full card numbers. Basic usage and security logs (such as sign-in events and errors) needed to operate the platform. We do not buy data about you, and we do not run advertising trackers on the portal.

We use your information to build, run, and support your workflow, to authenticate you, to process payments, to send you service emails, and to keep the platform secure. We do not sell your data, we do not share it for advertising, and we do not use one client's data to do another client's work. Access to your data is limited to you and the operator running your build.

On joingrowthhouse.com we ask before setting any tracking cookie. If you say yes, we set two first-party cookies: gh_vid, a random id for your browser, and gh_ft, which remembers how you first found us (for example a TikTok link or a Google search). With them we record the pages you view and the buttons you click on our site, so we can see which pages help people and which channels bring them. That record stays in our own database. It is not shared with advertising networks, and there are no Google, Meta or TikTok pixels on the site. If you later give us your email (through the chat, the rank check, the booking form or The Lab), that record is attached to it, so we know what you were interested in when we reply. If you say no, or your browser sends a Global Privacy Control signal, none of this is stored and the site works the same. We also set gh_consent to remember your answer. To change it, clear cookies for this site and the question comes back. Links in The Lab pass through our own redirect so we can see which ones readers use.

Every AI step in your build runs on Anthropic's Claude models, accessed through Anthropic's commercial API, and only Anthropic. We do not send your data to OpenAI, Google, or any other AI provider for processing. Under Anthropic's commercial terms, the inputs and outputs we send are not used to train Anthropic's models, and Anthropic retains API traffic only briefly for abuse monitoring before discarding it. We do notbuild embeddings or a vector database from your documents, so there is no secondary AI copy of your data that outlives the original. You can review Anthropic's terms at anthropic.com/legal/commercial-terms.

We rely on a small, named set of vendors to run the platform. Each is bound by its own terms and processes your data only to provide its service to us:

Your data is stored in Supabase, on Amazon Web Services, encrypted at rest with AES-256 and in transit over TLS. Each client's data sits in its own scope: every table and every private storage bucket has Row Level Security enabled with policies tied to your organization, enforced at the database layer so a query can only return rows that belong to you. Operator accounts that can reach client data are protected by app-based two-factor authentication; client sign-in uses one-time email magic links, so there is no reusable client password to steal. Supabase is SOC 2 Type II certified and independently audited; you can verify that at supabase.com/security.

We keep your data for as long as your account is active. Inside the platform, your documents, prompts, and outputs live in your scope until you delete them or cancel. At the AI layer, Anthropic retains API traffic only briefly for abuse monitoring and then discards it. We do not maintain a separate long-term archive of your prompts and outputs outside your own scope. After cancellation we provide a one-time export within 30 days, after which we delete your data from the live platform.

You can ask us to delete a specific document, a set of responses, or your entire account, and we will remove it from the live database and from file storage, not just hide it. Because there are no embeddings or vector copies, there is no hidden second version to chase down. Encrypted backups age out on their normal rotation rather than being individually edited; if you need a hard backup-purge commitment in writing, we can include that in a data processing addendum. Email your request to the address at the bottom of this page.

You can ask us what data we hold about you, ask us to correct it, export it, or delete it. If you are covered by a privacy law such as the GDPR or a US state privacy act, we honor the access, correction, deletion, and portability rights it gives you. For business-sensitive or regulated data, we can sign a data processing addendum that names our sub-processors and commits us in writing to the no-training, deletion, and breach-notification terms described here.

If we ever discover a breach that affects your data, we will notify you without undue delay, tell you what we know, and tell you what we are doing about it. We will not sit on it.

If we change this policy in a way that materially affects how we handle your data, we will update the date above and let active clients know. Continued use of the platform after a change means you accept the updated policy.

Questions about this policy, or a request about your data, go to [email protected]. We read every one.