Privacy Policy

Last updated: 11 October 2026

This notice explains how NBS SRL (“OniGrow” or the “Controller”), with registered office at Via Francia 5D, 37135 Verona (Italy), VAT IT01563280294, email info@onigrow.com, processes personal data of users of onigrow.com and customers of our Services, pursuant to Regulation (EU) 2016/679 (GDPR) and applicable national law.

Controller and contacts

Controller:
NBS SRL – Via Francia 5D, 37135 Verona (Italy)

Privacy contact:
info@onigrow.com (for requests or to exercise rights)

Categories of data processed

• Identification and contact data: name, surname, email, phone, billing details.
• Payment data: handled via certified providers (e.g., Stripe, PayPal). OniGrow does not store full card details.
• Technical browsing data: IP addresses, device IDs, technical logs, browser info and pages visited, cookies and similar technologies (see “Cookies”).
• Communications: requests via email, contact forms or support channels.
• Social credentials (if provided): Instagram username and password, strictly necessary to provide the Service.
• Rewards program data: personal referral code, credit history (earned and used), referral codes entered at checkout, number of active subscriptions (for volume discount calculation), anonymized relationship between referrer and referred customer.

Purposes and legal bases

Consent can be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

Processing of access credentials

• Optional and requested only when necessary to provide the Service.
• Used exclusively to enable access to the Customer’s account.
• Encrypted and stored securely, with limited and logged access.
• Deleted immediately at the end of the Service or upon Customer request.
  Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Methods and security

Data are processed lawfully, fairly and transparently using IT/telecommunication tools, applying security measures such as:

• encryption at rest and in transit,
• role-based and logged access,
• periodic backups and monitoring,
• internal incident response procedures.

Data retention

Data recipients

Data may be disclosed to:

• Payment providers (Stripe, PayPal) – independent controllers;
• Technical vendors (hosting, email, CRM, analytics, WordPress plugins) – appointed processors under Art. 28 GDPR;
• Advertising and analytics platforms (Google, Meta, Microsoft, OpenAI), only with your Statistics or Marketing consent – independent controllers or processors, depending on the service;
• Consultants and contractors bound by confidentiality;
• Competent authorities, where required by law.

OniGrow does not sell personal data to third parties.

Transfers outside the EEA

Some providers process data outside the European Economic Area, in particular in the United States. Google, Meta and Microsoft participate in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission in its decision of 10 July 2023. For other providers we adopt appropriate safeguards (e.g., EU Commission Standard Contractual Clauses and supplementary measures) in accordance with Arts. 44–49 GDPR.

Data subject rights

Users may exercise the rights to:

• access, rectification, erasure, restriction, objection, portability (Arts. 15–22 GDPR);
• withdraw consent where applicable;
• lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), which supervises the data controller, or with the supervisory authority of your country of residence.

Requests may be sent to info@onigrow.com.

Minors

The Service is intended for adults. We do not knowingly collect data from minors; any such data communicated will be deleted.

Cookies and similar technologies

We use cookies and browser storage to operate the site and, with your consent, for statistics and marketing. You can choose categories in the banner and change them in “Cookie settings” in the footer.

Categories and services

• Necessary: session, cart and language. The og_consent cookie stores preferences and the choice reference for 180 days. The onigrow_ref cookie stores the referral-link code for 30 days.
• Aggregate visit counting: without cookies and without storing anything in your browser, we count page views by day, page, traffic source (for example a search engine or an ad), device type, country and language. We do not record your IP address, identifiers or any other data that could identify you, and these totals are not linked to orders. Country is derived from the IP address at request time, without storing it. It is an aggregate statistic treated like technical cookies (Italian Data Protection Authority, guidelines of 10 June 2021), based on our legitimate interest in knowing how many people visit the site, and it does not require consent. Totals are kept for 13 months.
• Statistics: Google Analytics 4, Microsoft Clarity and OniGrow’s internal measurement analyse visits, interactions, purchases and browsing journeys. Clarity also uses heatmaps and session recordings. They are enabled with Statistics consent and may use pseudonymous identifiers, even when reports are aggregated.
• Marketing: Google Ads, Meta Pixel / Conversions API and OpenAI / ChatGPT measure advertising effectiveness through visits, products viewed or added to the cart, checkout and purchases actually paid for. Google Ads and Meta also support advertising and relevant content. Microsoft advertising features follow Marketing. Services are enabled with Marketing consent; their pixels are not loaded before consent.

Measurement data and technologies

Measurement data may include products and quantities, amounts and EUR currency, event and advertising-click references, pseudonymous browser identifiers and technical connection and device information. UTM source parameters may be stored with Statistics or Marketing; Google and Meta click references only with Marketing. These data are not necessarily anonymous.

To match conversions to ads, Google Ads may receive email and phone as SHA-256 hashes. Meta and OpenAI may also receive hashed first and last names. The OpenAI pixel can recognise these data when available on the site, including forms, and transmit normalised country, city, region and postal code without hashing. Meta may receive hashed location and customer identifier, as well as unhashed IP address and browser information. Hashing does not make data anonymous.

The periods below concern browser storage, not providers’ server retention. They are configured or verified periods; browsers and clearing data may shorten them. Some expiries are renewed during use.

Main statistics cookies

Cookie	Service and purpose	Browser duration
og_session_count	OniGrow: session count	365 days
og_tracking	OniGrow: UTM source with Statistics or Marketing; click references with Marketing	30 days
_ga, _ga_*	Google Analytics: visits and interactions	Up to two years requested; about 400 days in the verified browser
_clck; _clsk	Microsoft Clarity: browsing experience	365 days; 1 day

Main advertising and provider cookies

Cookie	Service and purpose	Browser duration
_fbp	Meta: browser identifier	90 days
_fbc; _gcl_*	Meta / Google: click references, when present	Presence and expiry depend on click parameters, the service and browser; the actual expiry can be checked in the browser.
__oppref	OpenAI: advertising-click reference from the landing page	30 days after writing; capturing the click parameter renews expiry, merely reading does not.
__obref	OpenAI: random pseudonymous browser reference	365 days after creation; reusing a valid reference does not renew expiry.
__oaiq_consent	OpenAI: pixel consent preference	30 days after writing.
MUID; MR; SM; ANONCHK; SRM_B	Microsoft: shared cookies on Clarity/Bing domains, Statistics / Marketing according to function and choice	MUID and SRM_B about 390 days; MR 7 days; SM session; ANONCHK about 10 minutes

Session storage holds browsing journeys and technical references until the session ends, for example OniGrow’s og_* and Clarity’s _cltk. Services also use localStorage, such as Meta’s lastExternalReferrer and OpenAI’s oaiq_consent: it has no automatic expiry and remains until cleared or updated by the service. OpenAI also uses visit-consent markers in sessionStorage. You can clear these stores in browser settings.

Preferences, withdrawal and provider notices

You can accept, refuse or change Statistics and Marketing in “Cookie settings” in the footer. Disabling a category stops future transmissions for that choice. Withdrawing Marketing removes first-party marketing identifiers from the browser; preferences may remain to remember refusal. Cookies on third-party domains can be managed through your browser and provider settings. Withdrawal does not undo processing already performed.

Our server record of the consent choice is retained for 24 months, separately from cookie expiry. To exercise your rights, you can use the contacts in this notice and those of the providers.

Provider privacy notices: Google, Meta, Microsoft, OpenAI.

Third‑party platforms

Use of the Service may involve interactions with third‑party platforms (e.g., Instagram).
Such platforms act independently as controllers, with their own policies and terms of use.
OniGrow is not sponsored or certified by Instagram™.

Changes to this Privacy Policy

Material changes will be notified with 30 days’ notice via website notice or email.
Continued use of the site/services after that period implies acceptance of the updated version.