About Us and this Privacy Policy

This Privacy Policy (the “Policy”) applies to personal data Grin processes when providing our services, including various Grin websites, such as https://grin.co and https://app.grin.co, https://grin.ai and https://app.grin.ai, applications, ads, communications, and other instances where we link to this Policy (collectively “Services”). Any term not defined in this Policy has the meaning set forth in our Terms of Use. As used in this Policy, the word “including” means “including but not limited to.”

Personal Data We Collect

What Information Do We Collect?

 Through our Services, we process data about three types of users:

• As a data controller, we provide services to:
  
  • creators who sign up directly with us via our Creator Terms of Service or the Affiliate Program Creator Agreement
  • (“Creator Customers”) and prospective creator customers (“Potential Creators”); and
  • agency and brand customers who have chosen to sign up to our Terms of Service or the Affiliate Program Seller Agreement (“Brand Customers”).
• As a data processor or service provider we may also process data on behalf of:
  
  • Brand Customers about Potential Creators. 
  • Creator Customers who have chosen to sign up to our Affiliate Program Creator Agreement. 
  • In both above instances, the Brand Customer or Creator Customer (as applicable) is the data controller and our relationship with them is governed by our Data Processing Addendum.

Depending on the Services we provide to you and how you interact with us, we may collect, use, store, and transfer different kinds of personal data about you. You aren’t required to provide us with personal data. However, if you don’t share certain data with us, we may not be able to provide you with our Services or respond to your requests. 

We May collect and process the following categories of Personal data:

Third-Party Services

This Policy does not apply to the privacy practices of third parties that we do not own or control, including but not limited to any third-party websites, services, applications, online resources to which Grin Services may link or otherwise reference (collectively “TPS”) that you may access through the Services. 

• For example, the Services utilize the YouTube API Services as a TPS, and you are agreeing to be bound by the YouTube Terms of Service (https://www. youtube.com /t/terms), Privacy Policy (https://policies.google.com/privacy?hl=en-US), and API Services Terms of Service (https://developers.google.com/youtube/terms/api-services-terms-of-service) when engaging YouTube content and services through the Service. 
• We take no responsibility for the content or privacy practices of any TPS. We encourage you to carefully review the privacy policies of any TPS you access.
• You may have the option to register using a TPS or connect your account to a TPS such as Instagram, Facebook, Twitter or YouTube. By authorizing us to access your TPS account, you understand that we may obtain certain information from your TPS account, you authorize us to obtain certain information from your TPS account. We only obtain information from your TPS account that you specifically authorize and grant us permission to obtain.

How We Use Your Personal Data

Advertising (On & Off the Services)

We may use your personal data to enable our advertising.

• We may use personal data we collect from you, our affiliates, and third parties to personalize ads for our Services. 
• We may also use data we collect via our Services and third-party ad partners to measure the effectiveness of ads and to help recognize your device(s) to serve you ads on third-party surfaces. 

Communications With Grin

We may send service-related and promotional communications to our users. We may also send promotional communications to prospective users and customers to inform them about our Services.

• These communications may be via email, text message, calls, push notifications, direct messages, or otherwise.
  
  • To opt out of receiving text messages, you must reply “STOP” from the device receiving the messages. 
  • To unsubscribe from emails, please use the unsubscribe or email settings link in the email(s) you receive. If you unsubscribe only from an individual type of email communication, you may continue to receive other emails. We may also offer a settings function via our Services to manage your email preferences. 
  • To turn off push notifications, use in-app and/or operating system settings on your device.

If you use our chat feature, we and our service providers may record your chats and keep transcripts. If you talk to us on the phone, we may record your phone calls.

Unless you choose to delete your account, you cannot unsubscribe from certain communications that are required as part of your use of our services (e.g., communications about changes to this Policy.)

Communications with Third Parties via Grin

• We may allow Brand Customers to invite additional Brand Customer users to utilize our Services, 
• Brand Customers may also communicate with Content Creators and Potential Creators using Grin Services.
• We may allow you to sync or upload a list of contacts in order to facilitate these communications.
• Users you interact with can see what you send them; if you send a message, the recipient can read your message and potentially share it outside of our services. You should never share more information than you are comfortable with.

If you provide us access to your email data by connecting your email account to our Services, our use of your email data will be subject to these additional restrictions:

• We will only use access to read, write, modify or control email message bodies (including attachments), metadata, headers, and settings to provide a web email client that allows users to compose, send, read, and process emails and will not transfer this email data to others unless doing so is necessary to provide and improve these features, comply with applicable law, or as part of a merger, acquisition, or sale of assets.
• We will not use this email data for serving advertisements.
• We will not allow humans to read this data unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or for the Services’ internal operations when the data have been aggregated and anonymized.

Customer Relationship Management

We will utilize your personal data to facilitate your customer relationship with us. This includes providing customer support, managing and troubleshooting your account, executing contracts, billing, etc.

Facilitate Contracts

If you connect with another user on our Services, we may process your personal data to facilitate your contractual relationship with the other user. This includes managing contracts and other documentation.

Fraud Detection & Prevention

We monitor use of the Services to detect fraud, abuse, and violations of our Terms. We may actively or passively monitor Services activity, including communications, transactions, and usage. 

Grin Brand and Creator Services

We process data to make the Grin Services available to you. This includes personal data used to manage your account and profile on the Services, provide the Services’ features, and fulfill our contractual relationship.     

If you connect your social media account to your Grin account, you may authorize us to access aspects of your social media account, including your messages, drafts, posts, analytics, etc. 

Grin Potential Creator Services

In some instances, we process personal data about Potential Creators. We source public information about Potential Creators to make it available to our Brand Customers so they can identify creators for their brand deals. This benefits Potential Creators, who gain visibility for potential business, and our Brand Customers who gain access to additional creators who may create or advertise content for them. This is considered a “sale” of personal data under applicable law.

Payments (sent and received via Grin)

When you utilize the Services to send or receive payments between you and other users, we process your data to facilitate these transactions.

Registration

You will need to create an account and provide personal data to access most of our services. If you register for or purchase our Services, we use your personal data to create a Grin account for you. 

Service Improvements

We may use your data for data analytics to improve our Services. This may include data you explicitly provide as well as data we collect via cookies, pixels, tags, beacons, and other technologies.

We also collect and share personal data with third-party service providers acting on our behalf, including providers of analytics services that may record or log your activities on our services, including text you enter, pages you visit, and features you interact with. By using our Services, you agree to this data processing and sharing.

We may share information with service providers (also known as third-parties) who perform services on our behalf. Those companies will be permitted to obtain only the personal data they need to provide services to us, will be required to maintain the confidentiality of the information, and will be prohibited from using it for any other purpose unless permitted by law.

Other Instances When We May Disclose Your Personal Data

We may disclose personal data if we believe in good faith the disclosure is necessary in order to:

1. Comply with relevant laws or to respond to subpoenas, warrants, or legal processes served on us (though we reserve the right at our sole discretion to take action on behalf of our users when we believe there is a legitimate basis to do so)
2. Enforce our Terms of Use, this Policy, and any other agreements we may have;
3. Prevent physical harm or financial loss, or in connection with an investigation of suspected or actual illegal activity;
4. Act in a manner we otherwise deem necessary and is permitted by applicable laws to protect and defend the rights or property of us, the users of our services, or third parties; or
5. Act as permitted under applicable laws to meet national security and similar requirements.

We may also disclose personal data in a reorganization or sale of our company or assets, subject to the acquirer and its affiliates (as applicable) accepting the commitments made in this Policy and compliance with applicable law.

Data Security

While we endeavor to maintain physical, electronic, and procedural safeguards to protect the personal data that we collect, we cannot guarantee its absolute security. 

Cookies we use

The Services use the following types of cookies for the purposes set out below:

Disabling cookies

You can typically remove or reject cookies via your browser settings. In order to do this, follow the instructions provided by your browser (usually located within the “settings,” “help” “tools” or “edit” facility). Many browsers are set to accept cookies until you change your settings. If you do not accept our cookies, you may experience some inconvenience in your use of the Services. For example, we may not be able to recognize your computer or mobile device and you may need to log in every time you use the Services

Pixel Tags

We may also use pixel tags (which are also known as web beacons and clear GIFs) on the Services to track the actions of users on our sites and applications. Unlike cookies, which are stored on the hard drive of your computer or mobile device by a website, pixel tags are embedded invisibly on webpages. Pixel tags measure the success of our marketing campaigns and compile statistics about use of the Services, so that we can manage our content more effectively. The information we collect using pixel tags is not linked to our users’ personal data.

Do Not Track Signals

Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to do not track signals. 

Cookies

For further information on cookies (including how we use them, when we will request your consent before placing them, and how to disable them), please see our detailed Cookie Notice, which includes a list of all cookies on our services and instructions for updating your cookie preferences.

International transfers of your information

The data we process is hosted, controlled, and services are provided by Grin Technologies Inc., including, where applicable, outside of the European Economic Area (EEA), Switzerland, and the UK, including in the United States. Your personal data may be transferred to or accessed by entities around the world, including Grin-affiliated companies and our services providers, to perform processing activities such as those described in this Policy. Grin complies with laws on the transfer of personal data between countries to help ensure your data is protected, wherever it may be.

• Grins transfers of personal data collected in the European Economic Area, the United Kingdom, and Switzerland are governed by European Commission or UK Information Commissioner adequacy decisions about certain countries, as applicable, or the EU-US, Swiss-US, or UK Extension to the Data Privacy Framework, Standard Contractual Clauses, and/or UK International Data Transfer Agreements or Addendums.

Additional Information About Our Data Practices

Anonymized, Aggregate, and De-Identified Data

We may anonymize, aggregate, and/or otherwise de-identify your data and subsequently use and/or disclose such data for the purpose of research, improving our services, or for another business purpose authorized by applicable law, provided that we have implemented technical and contractual safeguards and business processes designed to prevent the re-identification or inadvertent release of anonymized, aggregate, or de-identified data. 

Automated Decision-Making

We do not use algorithms or profiling to make any decision that would have a significant legal effect on you without the opportunity for human review.

How long we keep your information

We keep your personal data only so long as we need it to provide or offer our Services to you and fulfill the purposes described in this Policy. Retention periods can vary significantly based on the type of data and how it is used. Our retention periods are based on criteria that include legally mandated retention periods, pending or potential litigation, our intellectual property or ownership rights, contract requirements, operational directives or needs, the expected lifetime of our users’ use of our services, and historical archiving. When we no longer need to use your personal data and there is no need for us to keep it to comply with our legal or regulatory obligations, resolve disputes, and enforce our agreements, we’ll either remove it from our systems or, anonymize, aggregate, or de-identify it so that we can’t identify you.

Privacy of Minors

Our Terms require that Users be (i) 18 or older, or (ii) 13 and older if either (a) an emancipated minor, or (b) they possess legal parental or guardian consent. Grin does not knowingly collect personal data from users under 13. In the event that we learn that we have collected any personal data from a user under the age of 13, we will attempt to identify and delete that information from our database. If you believe that a child under the age of 13 has provided personal data to us, please contact us.

Controlling Your Personal Data

Depending on where you live, you may have certain rights for controlling your personal data. You may avail yourself of your rights by contacting us using the contact methods described at the end of this Policy.

Access/Portability: In certain jurisdictions, you may request certain copies of your personal data held by us. You may also be entitled to request copies of personal data that you have provided to us in a structured, commonly used, and machine-readable format and/or request us to transmit this data to another service provider (where technically feasible).

Erasure/Deletion: In certain jurisdictions, you may request to have your personal data deleted. Please note that if you request the erasure of your personal data:

• We may retain some of your personal data as necessary for our legitimate business interests, such as fraud detection and prevention and enhancing safety. For example, if we suspend an account for fraud or safety reasons, we may retain certain data from that account to prevent that user from opening a new account in the future.
• We may retain and use your personal data to the extent necessary to comply with our legal obligations. For example, for tax, legal reporting, and auditing obligations.
• Because we maintain the Service to protect from accidental or malicious loss and destruction, residual copies of your personal data may not be removed from our backup systems for a limited period of time.

Withdrawing Consent and Restriction/Objection to Processing: In certain jurisdictions, if we are processing your personal data based on your consent, you may withdraw your consent at any time by changing your account settings or by sending a communication to us specifying which consent you are withdrawing. 

• Additionally, in some jurisdictions, applicable law may give you the right to limit the ways in which we use your personal data. For example, you may object to our processing of your personal data based on legitimate interests.
• Where your personal data is processed for direct marketing purposes, you may, at any time, ask us to cease processing your data for these direct marketing purposes by contacting us or using the unsubscribe function found in the communication.

Rectification of Inaccurate or Incomplete Information: If you have an account, you may access and update some of your information through your account settings. If you have connected your account to a TPSl, you may change your settings and remove permission for the TPS app by changing your account settings.

You may also have the right to ask us to correct inaccurate or incomplete personal data about you.

Additional Information about Controlling your Personal Data

• We do not discriminate against any user for exercising their privacy rights.
• Authorized agents may utilize the same processes as described above when making a request on behalf of a user; we will still require the user to authenticate their request. 
• We may need to request specific information from you to help us confirm your identity and ensure your right to control your personal data.
• If you are unsatisfied with our response to your request, please use the contact information found at the bottom of this Policy to appeal. We will follow the same processes and policies as we do for the initial request, including verifying your identity and the nature of your request.
• If you are in the EEA, you may contact our appointed EEA data representative at datarep.com/data-request. Similarly, if you are in the UK, you may contact our appointed UK data representative at datarep.com/data-request.
• If you are in the EEA, you have a right to submit a complaint with your local supervisory authority. Click here for the contact details of each EEA country’s supervisory authority. If you are in the UK, you may submit complaints to the Information Commissioner’s Office.
• Grin sells personal data as defined under applicable law. To opt out of the sale of your personal data, please use the contact method found at the bottom of this Policy and linked in our web footer. Grin does not knowingly sell personal data of data subjects under the age of 16.
• Grin does not “share” (as defined by applicable US State law; for behavioral advertising purposes) any personal data about its users or customers.
• Grin did not “sell” or “share” personal data as defined by applicable law in calendar year 2023.

GRIN Technologies Inc. Privacy Request Metrics

Metrics for Calendar Year 2024

* All requests not complied with in full were due to an inability to verify a user’s identity

**May include multiple requests from the same individual due to the use of different devices

***The response time is the time between a user confirming a request and the completion of that request.

Updates to this Privacy Policy

We reserve the right to update this Policy at any time. When we make changes, we will revise the “last updated” date at the top of the policy. If there are changes to the Policy that we believe materially reduce your rights or increase your responsibilities, we will notify you by prominently posting a notice of such changes here or on our home page, and/or by sending you an email. We encourage you to review this Policy whenever you use our Services.

How to contact us

For questions, to avail yourself of a privacy right, or to lodge a complaint, email us at privacy @ grin.co, or by mail to Grin Data Inquiries, 901 H St Ste 120, Sacramento, CA 95814, Legal Department.

‍THE ENTITY MAINTAINING THIS WEBSITE IS A DATA BROKER UNDER TEXAS LAW. TO CONDUCT BUSINESS IN TEXAS, A DATA BROKER MUST REGISTER WITH THE TEXAS SECRETARY OF STATE (TEXAS SOS). INFORMATION ABOUT DATA BROKER REGISTRANTS IS AVAILABLE ON THE TEXAS SOS WEBSITE.