We are now in Incentivized Beta! Join our discord.

Grass

Blog

FAQ

Documentation

Privacy Policy

Grass - Privacy Policy

Last Modified: October 08, 2024

1. Introduction

This is the Privacy Policy of Grass OpCo (BVI) Ltd. (“Grass”, “we”, “us”, or “our”), a subsidiary of Grass Foundation.

We operate the Grass™ web extension, dashboard application, desktop application, mobile application, and related hardware, including as made available through the collective websites www.getgrass.io and www.grassfoundation.io (collectively, the “Website”). The Website, together with our web extension, dashboard, desktop application, mobile application, and related devices (collectively, the “Grass Services”) allow users to participate in a Decentralized Peer-to-Peer Internet Networking Ecosystem that facilitates access to and use of web data (the “Grass Network”).

We take privacy very seriously and we make limited use of personal information in connection with the operation of our business. We operate the Grass Services and Grass Network in a manner that ensures that we respect your privacy and your rights to any personal information you may provide to us. We limit the personal information that we collect to your email address, username, password, wallet address, referral codes, IP address, and other personal information that you choose to provide to us. We only use that personal information for the limited purposes described in this Privacy Policy. We do not sell or otherwise monetize your personal information.

The purpose of this Privacy Policy is to help you understand our data privacy practices. It is important to us that you understand how we use your personal information so that you can make an informed decision on whether you would like to access or use the Grass Services and participate in the Grass Network.

This Privacy Policy covers the following topics, which you can learn more about by clicking the links below:

2. Consent from users outside the EEA, UK, Switzerland and BVI

Unless you are based in the European Economic Area (EEA), the United Kingdom (UK), Switzerland or the British Virgin Islands (BVI), by accessing or using the Grass Services or participating in the Grass Network, you agree to accept this Privacy Policy (including the ways we collect, use, and disclose your personal information). If you are based in the EEA, UK, Switzerland or BVI please see below for our policies and procedures regarding how we process your personal informationhere.

You can withdraw your consent to our collection, use, or disclosure of your personal information by contacting us using the contact information that is included in this Privacy Policy (see below). Please note that if you choose to withdraw your consent, we may not be able to provide you with certain services, products, communications, and opportunities, including access to and use of the Grass Services and/or participation in the Grass Network.

3. What is personal information?

Personal information is any information relating to an identified or identifiable individual. Under certain laws that may apply to you, personal information may also include information that identifies a specific household or device.

4. Information that we collect

We may collect personal information from you based on the Grass Services that you choose to access and use. The personal information that we may collect from you in connection with your use of the Grass Services is as follows:

  • Account Information: contact and identification information, such as your email address, username, password, digital wallet public address, and any referral codes that you have been provided by us in connection with your use of the Grass Services;
  • Technical, Device & Usage Information: your IP address; and
  • Information provided when you contact us: any other personal information that you choose to provide to us when you contact us for support, provide us with feedback, or otherwise communicate with us.

The types of personal information that we collect will depend on what personal information you choose to provide to us based on your interactions with us and the Grass Services and Grass Network.

We may also collect certain non-personal information in connection with your use of the Grass Services, including information about your use of the Grass Services and participation in the Grass Network, the operating system of your device, application IDs, the type and version of your browser, crash data and analytics, other device identifiers, and other information relating to the manner in which you access or use the Grass Services or participate in the Grass Network.

5. Use of your personal information

We use the personal information that we collect to provide you with the functionality, features, and communications that are available on and through the Grass Services and to enable us to manage, maintain, and develop our operations. Specifically, we may use your personal information for the following purposes:

  • manage our relationship with you, including by assisting you to create an account, communicate with us, and provide you with the services that you request;
  • assess the quality of your IP address and determine the uptime associated with your IP address as part of the Grass Network;
  • support the Grass Network by permitting Grass to operate the Grass Network to facilitate access to and use of web data from public websites. The personal information used for this purpose is limited to your IP address;
  • allow you to participate in, subscribe to, and receive information, news, updates, and promotional materials from us and third parties;
  • comply with your requests and preferences regarding your use of the Grass Services and the manner in which we communicate with you;
  • understand your preferences and values so that we can tailor the Grass Services and communications to you;
  • protect us against error, fraud, theft, and damage to our Services, business, and property;
  • conduct research, analysis, evaluation, and development activities to understand the way the Grass Services are used and to improve the Grass Services, Grass Network, and our general operations, including with respect to the development of new products, services, and opportunities; or
  • allow us to comply with applicable laws and regulatory purposes.

For more information about how we use your personal information if you are based in the EEA, UK, Switzerland or BVI (including the legal bases we may rely on to process it), please seeAdditional information for users in the EEA, UK, Switzerland and BVI.

6. Promotional and transactional communications

We will collect your consent prior to sending you promotional emails and other electronic messages (e.g., texts, direct messages), except where we are permitted under applicable laws to send you such messages without doing so. You can opt-out or unsubscribe from receiving promotional messages from us at any time. Promotional messages include our newsletter and updates about our and our partners’ businesses, products, and services.

As part of the Grass Services, you will receive service related transactional communications about your account and activities. For example, when you create an account or reset your password you may receive an email confirming the details of such activity. You may not opt-out of receiving these transactional communications.

7. Disclosure and transfers of personal information

We may disclose your personal information in the manner and for the purposes that are described in the sections below.

  • Working with third parties. We work with third parties that provide services to us that help us facilitate one or more aspects of the products, services, communications, or features that we offer to you on and through the Grass Services. We may provide these third parties with your personal information directly or they may collect your personal information from you on our behalf. These include providers of the following types of services:
    • Customer support service providers. These service providers assist us in helping us track, manage and respond to customer support inquiries. We share personal information such as your Account Information (excluding passwords) and information provided when you contact us with them to enable them to provide these services to us, including in connection with your opportunity to receive rewards.
    • Communication service providers. These service providers assist us in sending marketing and transactional communications to you. We share your email address with them to enable them to provide these services to us.
    • Information technology service providers. These service providers enable us to operate our services in a reliable manner by providing us with services like data hosting and cloud computing resources. For example, we may share personal information such as Account Information, information provided when you contact us and Technical, Device & Usage Information with data hosting providers to enable them to provide data hosting services to us.
    • Professional advisors. In limited cases, we may need to share personal information with our professional advisors like our external lawyers or financial advisors who help us ensure we are compliant with our legal and financial obligations. Depending on the circumstances, we may share any of the information described inSection 4above with them.
  • Use of the Grass Network. Users of the Grass Network may have access to your IP address in connection with their participation or use of the Grass Network to facilitate access to and use of web data through the Grass Network. In addition, your IP address may be visible to websites when your IP address is being used as part of the Grass Network.
  • Business transactions. Your personal information described inSection 4above may, depending on the circumstances, be disclosed to a third party in connection with a business transaction, including a change of ownership of Grass or its affiliates, the sale of all or certain of our assets, or the grant of a security interest. We will take reasonable steps to ensure that the third party that receives your personal information is bound by appropriate agreements that require that your personal information is handled in a manner that is consistent with this Privacy Policy.
  • Legal requests or protecting rights and interests. We disclose your personal information if we determine that such disclosure is necessary to comply with the law, protect our or others’ rights, property or interests (such as enforcing our Terms & Conditions) or prevent fraud or abuse of our service. Depending on the circumstances, we may share any of the information described inSection 4above with these third parties.

Please note that as we may disclose your personal information to third parties (including our service providers) as described in this Privacy Policy, your personal information may be collected, used, disclosed, and otherwise processed outside of your jurisdiction of residence. As such, your personal information may potentially be accessible to law enforcement and national security authorities of another jurisdiction where local laws provide for a different level of protection for personal information. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security agencies in those other countries may be entitled to access your personal information.

If you would like further information about our policies and practices regarding the transfer and storage of your personal information, including disclosures to third parties such as our service providers, please contact us using the contact details below. If you are in the EEA, UK, Switzerland or BVI, you can find out more about these transfers and the legal frameworks we rely upon for them in transfers outside of the EEA, UK and Switzerland or Data transfers outside of BVI.

Unless you are based in the EEA, UK, Switzerland or BVI by providing your personal information to us, you consent to our disclosure of this information to our service providers (and other third parties) as described in this Privacy Policy, including those that may be located outside of your jurisdiction of residence.

8. Aggregated data

We may disclose aggregated non-personal information and related usage information, which does not contain personal information that directly identifies you, with third parties, including our customers, clients, partners, advertisers, service providers, vendors, suppliers, and content providers

9. Retention of personal information

We do not keep your personal information forever. We will retain your personal information for as long as is reasonably necessary for us to complete our dealings with you, or as may be required by law, whichever is longer. For example, we retain Account Information regarding you for as long as your account is active or as needed to provide you with the Grass Services. We also retain personal information for as long as is necessary to achieve the purposes described in this Privacy Policy, for example, to comply with our legal obligations, to protect us in the event of disputes, and to enforce our agreements and to protect our and others’ interests.

The precise periods for which we retain your personal information vary depending on the nature of the information and the purposes for which we use it. Factors we consider include any minimum retention period required by applicable or recommended best practices and the period during which a claim can be made with respect to an agreement or other matter.

10. Security and protection of personal information

We maintain commercially reasonable physical, technological, and procedural safeguards that are appropriate based on the sensitivity of the personal information in question. These safeguards are designed to prevent your personal information from loss and unauthorized access, collection, use, disclosure, copying, modification, disposal, or destruction.

Please advise us immediately of any incident involving the loss of or unauthorized access to or disclosure of your personal information that is relevant to your use of the Grass Services.

11. Your rights related to your personal information

Under the applicable data protection laws like the General Data Protection Regulation (“GDPR”), you may have certain rights in relation to our processing of your personal information. Please note that these rights are not absolute, and we may be entitled or obliged to refuse requests where exceptions or exemptions apply under applicable law.

Some of these rights which may apply (depending on your jurisdiction) include the right:

  • to obtain access to, and copies of, the personal data that we hold about you;
  • to require us to correct the personal data we hold about you if it incorrect;
  • to require us to erase your personal data in certain circumstances;
  • to require us to restrict your data processing activities in certain circumstances;
  • to withdraw your consent (where we relied upon it) - the withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal;
  • to object, on grounds relating to your particular situation, to any of our particular processing activities where you believe this has a disproportionate impact on you;
  • to receive from us the personal information we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal information to another data controller; and
  • to lodge a complaint with a supervisory authority (such as your local supervisory authority where you reside).

If you want to exercise your rights, please contact us to do so. We may request specific information from you to enable us to confirm your identity if necessary, as well as to search for and provide you with the personal information that we hold about you. If you require assistance in preparing your request, please contact us.

12. Consent; withdrawal of consent

Unless you are based in the EEA, UK, or BVI or you advise us otherwise, through the access and use of the Grass Services, you have consented to the collection, use and disclosure of your personal information as explained in this Privacy Policy.

13. Links to third party resources

The Grass Services may contain links to other websites that may be subject to less stringent privacy standards. These links are provided for your convenience only and you assume all risk for clicking these links to other websites. We cannot assume any responsibility for the privacy practices, policies or actions of the third parties that operate these websites. We are not responsible for how such third parties collect, use or disclose your personal information. You should review the privacy policies of these websites before providing them with personal information.

14. Cookies

Please see our Cookie Policy for more information about the cookies and other tracking technologies that we use on the dashboard and Website.

15. Changes to this Privacy Policy

We may make changes to this Privacy Policy from time to time. These changes may be made as a result of changes to our legal obligations or the ways in which we collect, use, disclose, or otherwise process your personal information.

We will post an updated version of our Privacy Policy on our website when we make changes and may also notify you of the changes we have made in other ways if we are required to do so by applicable law. We encourage you to check this Privacy Policy for updates on a regular basis.

16. Contact information

If you have any questions or concerns regarding this Privacy Policy, you should contact us at privacy@grassfoundation.io.

**If you choose to communicate with us via email, please be aware that email is not a 100% secure medium for sending any personal or confidential information to us. **

Additional information for users in the EEA, UK, Switzerland or BVIThis section is applicable to you only if you are in the EEA, Switzerland, BVI or the UK. To the extent there is any inconsistency in this Privacy Policy between what we say in this section and in the rest of the Privacy Policy, this section will govern if you are based in the EEA, UK, Switzerland or BVI.

For the purposes of the (1) GDPR, as it applies both in the EEA and the UK; (2) The British Virgin Island’s Data Protection Act (As Revised) (“DPA”); and (3) Swiss data protection law, Grass is a data controller and can be contacted using the details in section 16 of this Privacy Policy above.

Grass is a data controller subject to the GDPR only insofar as we are offering goods or services to individuals in the EEA / UK or where the Grass Services may be used to monitor individuals’ behavior as far as their behavior takes place in the EEA or UK.

Grass is a data controller subject to the DPA only insofar as we are offering goods or services to individuals in BVI or where the Grass Services may be used to monitor individuals’ behaviour as far as their behaviour takes place in BVI.

Our legal bases for using personal information

Data controllers need a lawful basis to collect and use your personal data.

We describe below the purposes of our processing (why we process your information) and our processing operations (how we process your information to achieve each purpose). We also list the categories of your information that we process for each purpose and the legal basis we rely upon to do so.

Processing Activity/PurposeLawful BasisCategories of Data Processed
Manage our relationship with you, including by assisting you to create an account, communicate with us, and provide you with the services that you request.Performing our contract with you.
  • Account Information
  • Information provided when you contact us
Assess the quality of your IP address and determine the uptime associated with your IP address as part of the Grass Network.Performing our contract with you.
  • Technical, Device & Usage Information
Support the Grass Network by permitting Grass to operate the Grass Network to facilitate access to and use of web data from public websites.Legitimate Interests (specifically, our legitimate interest in operating the Grass Network and our business to allow us to provide our products and services to our users and customers).
  • Technical, Device & Usage Information
Understand your preferences and values so that we can tailor communications to you.Legitimate Interests (specifically, our legitimate interest in understanding our users preferences so we can send them marketing communications that are considered likely to be of interest to them).
  • Account Information
  • Information provided when you contact us
Allow you to participate in, subscribe to, and receive information, news, updates, and promotional materials from us and third parties.Consent or, where consent is not required under applicable law, legitimate interests (specifically, our legitimate interest in sending you marketing communications (e.g. about news, products, services and us) that are considered to be of interest to you).
  • Account Information
  • Information provided when you contact us
Comply with your requests and preferences regarding your use of the Grass Services and the manner in which we communicate with you.Performing our contract with you.
  • Account Information
  • Information provided when you contact us
Understand your preferences and values so that we can tailor the Grass Services to you.Legitimate Interests (specifically, our legitimate interest in understanding how our users use the service to develop and tailor new features).
  • Account Information
  • Information provided when you contact us
Protect us against error, fraud, theft, and damage to the Grass Services or our business or property;Legitimate Interests (specifically, our legitimate interests in preventing error, fraud, theft, and damage to our Services, business, and property).
  • Account Information
  • Information provided when you contact us
Conduct research, analysis, evaluation, and development activities to understand the way the Grass Services are used and to improve the Grass Services, Grass Network, and our general operations, including with respect to the development of new products, services, and opportunities;Legitimate Interests (specifically, our and our users’ legitimate interest in us evaluating the use of our services to inform the development of future features and improve product direction and development.)
  • Information provided when you contact us
  • Technical, Device & Usage Information
Allow us to comply with applicable laws and regulatory purposes.Legal compliance or, in respect of laws from outside the applicable region, our legitimate interest in complying with applicable laws and regulatory purposes.
  • Account Information
  • Information provided when you contact us
  • Technical, Device & Usage Information
Data transfers outside of the EEA, UK and Switzerland

In the course of providing you with access to and use of the Grass Services, we may transfer your personal information outside of the EEA, UK and Switzerland, including to the United States. This means that your personal data will not have the automatic protection of data protection laws, including the GDPR, which apply in the EEA, UK and Switzerland. We rely upon a number of legal frameworks to transfer personal information in such a case. These include:

  • Adequacy decision. We transfer, in accordance with Article 45 GDPR (or equivalent), personal information to recipients that are in a country that the European Commission, UK or Swiss data protection supervisory authority has confirmed, by decision, offers an adequate level of data protection for transferred data (“adequacy decision”). We rely on these adequacy decisions to transfer personal information to recipients located in countries such as the United States, UK, EEA, and Canada. The adequacy decisions are available at the following links:
  • Data Privacy Frameworks. We transfer personal data, in accordance with Article 45 GDPR (or equivalent) from the EEA, Switzerland and the UK to recipients in the US that have certified to the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension to the EU-U.S.
  • Standard data protection clauses (“SCCs”) and other transfer methods. For countries without an adequacy decision, we transfer, in accordance with Article 46 GDPR (or equivalent), personal information to recipients that have entered into the European Commission, UK or Swiss approved form of transfer contract (SCCs) for the transfer of personal data. We rely on SCCs to transfer personal information to recipients located in countries such as the British Virgin Islands and The Bahamas. We may, where there is no adequacy decision, alternatively make a transfer based upon Article 46 GDPR (or equivalent) using alternative appropriate safeguards such an approved certification mechanism or code of conduct or binding corporate rules or based upon a derogation provided under law (such as Article 49 GDPR). The European Commission approved SCCs are available here and you can request a copy of the SCCs we use from us by using the contact details above.
Data transfers outside of BVI

Personal data will be held in, and may be freely transferred between, countries that are located inside the EU and third countries that have adequate protection for your rights in relation to the processing of your personal data, including the United States.

Where a personal data transfer is made to a jurisdiction which provides a level of data protection lower than that prescribed by the DPA, we will take steps to ensure the security and confidentiality of your personal information in accordance with the DPA.

Grass

HomeBlogFAQMedia KitDocumentation
AMTSO Member

© Grass Foundation, 2024. All rights reserved.

Privacy PolicyTerms & ConditionsCookie Policy

Cookie Settings