Introduction:
This Privacy Policy explains how Grassroots Carbon Public Benefit LLC (“Grassroots Carbon,” “we,” “us,” or “our”) collects, uses, and discloses information about users of our website ( grassrootscarbon.com and its subdomains, the “Site”) and our mobile application PastureMap (the “App”). By using the Site or App (collectively, the “Services”), you agree to the collection and use of information in accordance with this Policy and our Terms & Conditions. If you do not agree, please do not use our Services.

We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), Texas Data Privacy And Security Act (TDPSA) and the California Consumer Privacy Act (CCPA). This Policy outlines what data we collect, how we use it, your rights regarding your data, and how you can exercise those rights.

We may update this Privacy Policy from time to time. If changes are significant, we will notify you by posting a notice on our Services or via other communication. Your continued use of the Services after any changes indicates your acceptance of the updated Policy.

Information We Collect

We collect several types of information from and about you in connection with the Services:

• Information You Provide Directly: When you create an account or use our Services, we may ask for personal information such as your name, email address, ranch or organization name, phone number, and other profile details. For example:
  

  • During registration, you provide your name, ranch name, and email address.

  • If you correspond with us (e.g., via email or support requests), you may provide your contact information and the content of your communications.

  • If you purchase products or subscribe to paid features, our payment processor Stripe ( a third-party service ) will collect payment details like credit card number and billing address. (We do not store full payment card information on our servers; it is handled by the third-party processor as described below.)

  • Through your use of the App’s features, you may enter data related to your ranch operations. For instance, you might input field and paddock names, sizes, locations (coordinates), grazing records, photos, notes, and other information relevant to managing your pastures and livestock. This data is stored to provide you with the App’s functionality.

• Information Collected Automatically: When you use our Site or App, we automatically collect certain information about your device and usage:
  

  • Device and Log Information: We collect technical information such as your device type, unique device identifiers or installation ID, operating system version, browser type, IP address, and device Identifiers. Our servers log usage data including the pages or screens you access, the date/time of visits, the features or functions used, errors or crash reports, and other statistics. For example, when you download or use the App, we may record your device’s unique ID and IP address. When you visit our website, our servers automatically log your IP address, browser type, pages viewed, and how you navigated to the Site.

  • Location Data: With your permission, we may collect precise location information from your device. For instance, the App may use your device’s GPS to help map your fields or track your position for grazing management. You can always choose whether to allow location access via your device settings. If you grant permission, location data may be recorded (for example, tagging the location of a paddock or a photo); if you deny or revoke permission, the App will either not collect location data or use alternative methods to allow manual location input. (Any location data collected is used to support features in the App and, according to our disclosures on app stores, is not linked to your identity.)

  • Cookies & Similar Technologies: We use cookies and similar tracking technologies on our website to collect information and improve user experience. Cookies are small text files placed on your device that allow us to recognize your browser and remember certain information. For example, we use cookies to keep you logged in, remember your preferences, and understand how you navigate our Site. We and our third-party analytics and advertising partners may set cookies or use pixel tags and local storage to collect information about your usage of the Services over time and across different websites or apps. This information may include things like the pages you visit, features you use, links clicked, and other usage patterns. We may also use cookies to enhance navigation and personalize content (for instance, to show you content relevant to your interests). You can set your browser to refuse cookies or alert you when cookies are being sent. Please note that if you disable or reject cookies, some features of the Services may not function properly. For more information about cookies and how to manage them, visit allaboutcookies.org, which provides helpful guidance.

• Analytics Data: We use third-party analytics tools (such as Google Analytics) to gather information about site/app usage. These tools collect information sent by your browser or mobile device, including the pages you visit, your browser’s details, and other data that helps us understand usage trends. For example, analytics tools may record how often users visit the Site or use the App, what pages or screens they view, and what other sites or apps they used prior to coming to our Site. We use this information in aggregate form (i.e., it does not identify you personally) to improve our Services and troubleshoot issues. Google Analytics may set its own cookies to perform these services. To learn more about Google Analytics privacy practices and opt-out options, you can visit Google’s website or use the Google Analytics Opt-Out Browser Add-on.
  
  

• Information from Third Parties: If you choose to connect or log in to our Services via a third-party platform (for example, signing in with Google or another service), or if you interact with our content on a social network (e.g., by clicking a Facebook “like” or sharing via Twitter), the third-party service may send us certain information about you. This could include your name, email, and any other information you have authorized that platform to share. We do not control the data that third parties share, and any such sharing is governed by the third-party’s privacy policy. We recommend you review the privacy settings on any third-party accounts you link to our Services. You may disconnect third-party accounts from our Service at any time via the third-party platform’s settings. Additionally, we may receive contact information for you from event partners or referral programs if you have consented to such sharing.
  

Note: Certain information is required to create an account or use specific features of the Services. If you choose not to provide required information, you may not be able to register or access some features (for example, we cannot create an account without an email address, and the App’s mapping features may be limited if you do not allow location access or input location data manually).

How We Use Your Information

We use the collected information for the following purposes:

• To Provide and Maintain the Services: We process your personal information to operate our Site and App, create and manage user accounts, and provide the features and functionality you expect. For example, we use your information to display your pasture maps and herd data back to you, to sync your data across devices, and to enable core features like grazing planning and record-keeping. If you make a purchase or subscribe, we use your provided information to fulfill those transactions (through our payment processor).
  
  

• To Improve and Customize the Experience: We analyze usage data (often in aggregated form) to understand how our Services are used. This helps us troubleshoot problems, develop new features, and improve performance and usability. For instance, understanding which features are most used can guide us in making enhancements, and analyzing where users encounter errors helps us fix bugs. We may also use your information to personalize the Services for you, such as content recommendations or remembering your preferences so you don’t have to re-enter information.
  
  

• To Communicate with You: We use contact information (like your email address or phone number) to send you updates and important notices. This includes:
  

  • Service and Transactional Messages: We may send confirmations, invoices, technical notices, security alerts, and support messages. For example, if we update our app or need to inform you of maintenance downtime, we might email you. These Service-related communications are necessary for us to perform our contract with you and you may not opt out of these essential emails.

  • Promotional & Newsletter Communications: With your consent (or as otherwise permitted by law), we may send newsletters, product announcements, or special offers from us that we think may be of interest. You have the choice to opt out of marketing emails at any time. If you do not wish to receive promotional emails, you can click the “unsubscribe” link in those emails or contact us at support@buildgrassroots.com to be removed from our mailing list. We will process opt-out requests promptly. (Even if you opt out of marketing messages, you will still receive essential account and service communications as noted above.)

• For Advertising and Marketing (Including Third-Party Offers): We may use information about you to tailor and provide you with ads, content, or features that match your profile or interests. This can include showing you marketing on our Site or App, as well as on third-party sites (see “Advertising & Analytics” below for details). We do not sell your personal information to unrelated companies for money; however, we may share limited personal data with certain partners or affiliates for joint marketing or promotional activities as described in How We Share Your Information. For example, if we run a co-sponsored event or promotion with a partner, we might share participant names or contact info with that partner (and we will disclose this at the time of collecting your information for such an event). If you are a resident of California, please see Your California Privacy Rights below for information on how to opt out of certain data sharing. If you are in the EU/EEA, we will ensure we have an appropriate legal basis (such as your consent or our legitimate interests) for any marketing uses of your data, and you can object to or opt out of marketing communications as described above.
  
  

• To Fulfill Legal Obligations and Security: We may process and retain your information as needed to comply with applicable laws, regulations, legal processes, or enforceable governmental requests. For example, we might retain certain transaction records for tax or accounting requirements. We also use and disclose information as necessary to enforce our Terms & Conditions, to detect, investigate and help prevent security incidents or other malicious, deceptive, fraudulent, or illegal activity, and to protect the rights and safety of Grassroots Carbon, our users, and others. This includes using your information to prevent fraud, resolve disputes, and enforce agreements or policies.
  
  

• Other Purposes with Your Consent: If we want to use your information for a purpose not covered by this Privacy Policy, we will seek your consent where required. For instance, if we ever wanted to post a testimonial or case study featuring your personal story or your review of our services on our website, we would obtain your permission. You are free to withdraw any consent you have given at any time, by contacting us or through the mechanism provided (such as in-app settings), though doing so will not affect the lawfulness of processing based on consent before its withdrawal.
  

Legal Bases for Processing (GDPR): If you are located in the European Economic Area or the United Kingdom, we rely on certain legal grounds for processing your personal data under the GDPR/UK GDPR. These include: (i) processing necessary for the performance of a contract with you (providing the Services, customer support, etc.), (ii) your consent where applicable (for example, for sending marketing communications or for optional location data collection in the App), (iii) our legitimate interests in maintaining and improving our Services (such as understanding usage and ensuring security), and (iv) compliance with legal obligations (such as retaining records for tax compliance or responding to lawful requests by authorities). We will always consider your rights and interests before processing under legitimate interests, and you have the right to object as described below.

How We Share Your Information

We understand the importance of your personal information and share it only in the circumstances described below, with appropriate safeguards:

• Service Providers and Business Partners: We may share personal information with third-party companies and individuals who perform functions on our behalf to support the Services. These include, for example:
  

  • Hosting and Infrastructure: We use cloud hosting providers (such as Amazon Web Services) to store and process data. These providers may have access to personal data for storage, backup, and related services.

  • Analytics Providers: As noted, we use analytics tools like Google Analytics. These providers may receive information through the use of their services (for instance, Google Analytics may receive and process data about your device and site usage as described in their privacy policy).

  • Payment Processors: When you make payments, your payment details are collected directly by third-party payment processors (for example, Stripe, PayPal, or others we might use) which specialize in secure payment processing. These payment processors will handle and store your payment card information; we do not receive or keep full credit card numbers. Payment processors only share with us limited information necessary for us to record that a payment was made (such as your name, contact info, payment method, and a confirmation that payment was completed). The use of your data by these payment providers is governed by their own privacy policies, and we encourage you to review those policies when providing payment information.

  • Email and Communication Tools: We may share your email and name with an email service provider (for example, HubSpot or SalesForce) that assists us in sending out newsletters or notifications. They are authorized to use your email only to send communications on our behalf.

  • Other Service Providers: We may also use providers for functions such as customer support ticketing (for example ZenDesk), product feedback, advertising networks, or co-branded services. In all cases, these service providers are given access only to the information necessary to perform their specific tasks and are contractually obligated to protect your information and use it only for our legitimate business purposes in providing the Services to you.

• Within Our Corporate Family and Affiliates: Grassroots Carbon may share information with its affiliates, subsidiaries, and companies under common ownership or control. Any such entity will only use your information in accordance with this Privacy Policy. For example, if Grassroots Carbon establishes additional products or services under the Grassroots Carbon umbrella, data from PastureMap users might be shared with those affiliated services to streamline operations or improve offerings. (Currently, PastureMap is a service provided by Grassroots Carbon; if this changes, we will update you.)
  
  

• Joint Marketing or Co-Sponsored Activities: If we offer contests, sweepstakes, events, or promotions in partnership with other organizations, we may share information (such as your name, email, or contest entry details) with those partners as necessary to administer the event or provide related benefits. We will let you know at the time of collection if your information will be shared in this way and, if required by law, we will obtain your consent. Any partner with whom we share data for these joint activities will be bound to use the information only for the stated purposes in compliance with applicable privacy laws.
  
  

• Advertising and Analytics Partners: We may allow third-party advertising networks and analytics companies to collect information about your interaction with our Services over time, so that they can display or deliver ads on our behalf tailored to your interests on other websites or apps. For example, third-party advertisers may use cookies or pixels to gather usage information (such as pages visited or links clicked) and use that data to serve targeted ads relevant to regenerative agriculture or other topics that align with our Services. These third-party advertisers or ad networks may place cookies on your browser to recognize your device each time they send you an online advertisement, compiling information about your visits over time. We do not share information that directly identifies you (such as your name, email, location or phone number) with these third parties for advertising purposes without your consent. However, they may associate the data they collect via cookies on our Site with you if you’ve provided consent to them elsewhere or if they have other identifying information. Please note: This Privacy Policy covers the use of cookies by Grassroots Carbon and our service providers; it does not cover the use of third-party cookies or other tracking by advertisers, which is subject to those third parties’ own privacy policies. You can learn more about our use of cookies and how to manage your preferences in the Cookies & Tracking Choices section below.
  
  

• For Legal Reasons: We will disclose your personal information outside of our company if we believe in good faith that such disclosure is necessary to:
  

  • Comply with any applicable law, regulation, legal process, or enforceable governmental request (for example, to respond to a subpoena or court order).

  • Protect against harm to the rights, property, or safety of Grassroots Carbon, our users, or the public as required or permitted by law. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

  • Investigate or assist in preventing any violation or potential violation of the law, this Privacy Policy, or our Terms & Conditions, including reporting any activity that we suspect is unlawful or unethical.
    In short, if required by law or if we have a good-faith belief that disclosure is necessary to prevent illegal activities or violations of our rights, we may share information with law enforcement or relevant authorities.

• Business Transfers: In the event Grassroots Carbon undergoes a business transaction such as a merger, acquisition by another company, reorganization, or sale of all or part of its assets, or in the unlikely event of bankruptcy or insolvency, your information may be transferred to a successor or affiliate as part of that transaction. We would ensure the new owner continues to respect your personal data in accordance with this Privacy Policy (or you would be provided with notice and an opportunity to opt-out of any materially new uses of your information). Similarly, if Grassroots Carbon invests in or divests certain business units, personal data relevant to that portion of the business may be transferred to the parties involved under appropriate confidentiality and security agreements.
  
  

• With Your Consent: Apart from the cases listed above, we will seek your explicit consent before sharing your personal information with third parties for purposes other than those described. For instance, if you request that we share your information with a third-party service or if you opt-in to a feature that requires sharing, we will do so under the terms you agreed to.
  
  

No Sale of Personal Information: We do not sell your personal information for monetary consideration. In the context of CCPA, “sell” is broadly defined, and while we do not sell data in the traditional sense, some of our data sharing (for example, with certain advertising partners or the “third parties who may offer you products or services you may enjoy” as described above) could be construed as a “sale” or “sharing” under California law. We provide California residents the right to opt out of such sharing – please see Your California Privacy Rights below for more details on how to exercise that right. If we ever decide to sell personal data, we will update this Policy accordingly and provide required notices and opt-in/opt-out mechanisms.

Aggregated or De-Identified Data: We may aggregate or anonymize the information we collect so it can no longer be linked to an individual user. We reserve the right to use and share such aggregated, anonymized data (e.g., total number of App users in a region, average pasture sizes, etc.) for any legitimate purpose, such as research, analysis, improving our Services, or promotion. This information will not identify you personally.

SMS Consent and Data Use

When you provide your mobile phone number or otherwise consent to receive SMS (text message) communications from us, you agree to the following terms regarding how we handle and use your SMS data:

• Purpose of SMS Communications:
  

  • We may use your phone number to send you text messages related to:

    • Service updates and alerts

    • Transactional notifications (e.g., purchase confirmations, appointment reminders)

    • Marketing and promotional offers (if you have opted in)

    • Customer support responses

• Consent and Opt-In:
  

  • By providing your phone number, you expressly consent to receive SMS communications from us.

  • Your consent is not a condition of purchasing any products or services.

  • You can opt in to SMS communications during the registration process or via your account settings.

• Opt-Out and Revocation of Consent:
  

  • You can opt out of receiving SMS messages at any time by replying “STOP” to any text message you receive from us.

  • After opting out, you will no longer receive SMS communications from us unless you explicitly re-enroll.

  • Standard messaging rates from your carrier may apply.

• Data Use and Sharing:
  

  • We use your phone number only for the purposes outlined above.

  • We do not sell, trade, or share your SMS data (including your phone number and consent information) with third parties for their independent marketing or promotional purposes.

  • We may use third-party service providers to manage SMS delivery (for example Dialpad or similar platforms). These providers are bound by contract to protect your data and use it only for the agreed-upon purposes.

• Security:
  

  • We take reasonable security measures to protect your SMS data from unauthorized access, disclosure, or loss.

  • If you suspect any unauthorized activity involving your SMS data, please contact us immediately.

• Changes to SMS Consent and Data Use Terms:
  

  • We may update these terms periodically. If significant changes are made, we will notify you via SMS or other means as appropriate.

  • Continued use of our SMS services after such updates constitutes your acceptance of the revised terms.

By providing your phone number and opting into SMS communications, you acknowledge that you have read, understood, and agreed to these SMS Consent and Data Use terms.

Cookies & Tracking Choices

Cookies and Online Tracking: As noted, we and third parties use cookies and similar technologies on our Site to collect information and provide certain features. Your choices regarding these are as follows:

• Browser Settings: You can configure your web browser to refuse some or all cookies, or to prompt you before accepting cookies. Refer to your browser’s help documentation to manage cookies or visit allaboutcookies.org for instructions on how to change your cookie settings in various browsers. Keep in mind, disabling cookies may affect the functionality of our website; for instance, you might need to log in each time or some interactive features might not work.
  
  

• Analytics Opt-Out: For Google Analytics, you can opt out of data collection by Google Analytics across websites by installing the official browser extension provided by Google (the  Google Analytics Opt-out Browser Add-on ). This prevents Google Analytics from using your data on any site that uses it, including ours. We respect any such signals from your browser indicating you’ve opted out via this extension.
  
  

• Interest-Based Advertising: If we use third-party advertising networks that track your browsing over time, you can opt out of many of these networks via industry programs. In the United States, the Digital Advertising Alliance (DAA) offers a tool at aboutads.info/choices that lets you opt out of behaviorally targeted ads from participating companies. Similarly, the Network Advertising Initiative (NAI) provides an opt-out mechanism at https://optout.networkadvertising.org. On your mobile device, you can typically limit ad tracking or reset your advertising ID in the device’s privacy settings (for example, on iOS devices, see Settings > Privacy > Advertising; on Android, see Settings > Google > Ads). Using these options will not stop ads from being shown, but it may make the ads less relevant to your interests.
  
  

• Email and Marketing Choices: As described above, you can unsubscribe from marketing emails at any time by using the unsubscribe link or contacting us. If we ever use SMS or push notifications for marketing, we will provide an easy way to opt out of those as well (such as replying “STOP” to SMS, or disabling push notifications in the App settings or your device settings).
  

Do Not Track Signals

“Do Not Track” (DNT) is a privacy preference that users can set in some web browsers to signal that they do not wish to be tracked across websites. At this time, our Site does not respond to Do Not Track signals or similar mechanisms sent by browsers. This is because there is currently no uniform industry standard for recognizing or honoring DNT signals. We continue to monitor developments around DNT and may re-evaluate our approach if a standard emerges.

Even though we don’t respond to DNT, we offer you the choices described in this Policy for managing cookie and advertising preferences. For example, you can refuse cookies or opt out of certain types of tracking as noted above. Using these methods, you have control over the collection and use of data about your browsing activities.

If you want to learn more about Do Not Track, you can visit https://www.w3.org/TR/tracking-dnt for additional information. Keep in mind that limiting tracking (via browser settings or opt-out tools) may affect some personalized services but will not prevent you from using our Site in a general way.

Data Retention and Security

• Data Retention: We retain personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. For example, as long as you have an account with us, we will keep your account information. We may retain certain data even after account deletion if needed to comply with legal obligations (such as keeping transaction records for financial reporting), to resolve disputes, or to enforce our agreements. When personal information is no longer necessary for these purposes, we will securely delete or anonymize it. If deletion is not technically feasible (for instance, stored in backups), we will ensure appropriate measures to prevent further use of the data until deletion is possible.
  
  

• Security Measures: We employ reasonable and appropriate security measures to protect your personal information from loss, misuse, and unauthorized access or disclosure. These measures include technical, administrative, and physical safeguards such as encryption of data in transit (e.g., SSL/TLS on our website), encryption of sensitive data at rest, regular security audits, and limiting access to personal data only to employees and service providers who need it to perform their duties. We also implement procedures to deal with any suspected data breach, including notifying you and regulators as required by law. However, please understand that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. It is also important for you to protect against unauthorized access to your account credentials and to your devices. You should choose a robust password and keep it secret, and log out of the Site or App when you’re finished using them on shared devices.
  
  

• International Data Transfers: Grassroots Carbon is based in the United States, and the majority of our data processing occurs in the U.S. If you are using our Services from outside the United States (for example, from the European Union or other regions with data protection laws), please be aware that your information will be transferred to and processed in the United States and possibly other jurisdictions. These countries may have data protection laws that are different and potentially less protective than the laws of your country. We ensure that when we transfer personal data internationally, we do so in compliance with applicable privacy laws. For instance, for personal data transferred from the EEA or UK to the U.S., we may rely on measures such as Standard Contractual Clauses approved by the European Commission, or your consent where appropriate, or other legal mechanisms to ensure an adequate level of data protection. By using our Services or providing us with your information, you acknowledge this transfer, processing, and storage of your information in the United States. If you have questions about international transfers or require more information about the safeguards we have in place, you can contact us using the details at the end of this Policy.
  

Your Privacy Rights and Choices

Depending on your jurisdiction, you have certain rights and choices regarding your personal information. We strive to honor these rights and provide all users with transparency and control over their data.

Rights of Individuals in the European Economic Area (EEA), United Kingdom, and Other Regions (GDPR Compliance)

If you are located in the EEA, UK, or in a jurisdiction with similar data protection laws, you have the following rights with respect to your personal data, subject to the conditions and exceptions in applicable law:

• Right of Access: You have the right to request confirmation of whether we are processing your personal data, and if so, to request a copy of the data we hold about you, as well as information about how we use it. This includes the categories of data, the purposes of processing, any recipients to whom the data has been disclosed, and how long we plan to store it (or the criteria we use to determine that period).
  
  

• Right of Rectification: If any of your personal information is inaccurate or incomplete, you have the right to request that we correct or update it. You can also make certain changes directly by logging into your account settings (for example, updating your contact information or ranch details).
  
  

• Right to Erasure (Right to be Forgotten): You may ask us to delete or remove your personal data in certain circumstances. For instance, if you withdraw your consent (where we rely on consent) or if you believe our processing is unlawful or no longer necessary for the purposes collected, you can request deletion. We will honor such requests to the extent required by law. Note that we may retain some information if required for legal obligations or legitimate business purposes (as described in the Data Retention section above). If you delete your account or request deletion, data that is not necessary to retain will be removed from our active systems and we will also instruct our service providers to delete the data where applicable.
  
  

• Right to Restrict Processing: You have the right to request that we limit the processing of your personal data in certain situations – for example, while we are verifying the accuracy of your data after you have contested its accuracy, or if you have objected to processing based on our legitimate interests, pending verification of that objection.
  
  

• Right to Data Portability: You have the right to obtain a copy of certain information you provided to us in a structured, commonly used, and machine-readable format and to request that we transmit it to another data controller, where technically feasible. This right applies to personal data that we process by automated means and on the basis of your consent or a contract with you (for example, profile information you provided).
  
  

• Right to Object: You have the right to object to our processing of your personal data when the processing is based on our legitimate interests (or those of a third party) and your particular situation gives rise to the objection. You also have the absolute right to object to your personal data being processed for direct marketing purposes at any time. If you exercise this right, we will stop processing your information for those purposes unless we have a compelling legitimate ground or a legal obligation to continue certain processing.
  
  

• Right Not to be Subject to Automated Decision-Making: We do not currently make any decisions about you that are based solely on automated processing (without human involvement) that have legal or similarly significant effects on you. However, you have the right not to be subject to such decisions in general. In the event we implement automated decision-making processes (for example, for fraud prevention or credit eligibility), we will ensure compliance with applicable laws and provide you with an opportunity to request human review of any decision made solely by automation.
  
  

If you wish to exercise any of these rights, please contact us at support@buildgrassroots.com. We may need to verify your identity before fulfilling your request (to protect your privacy, we will likely ask you to provide information or credentials that match our records). We will respond to your request within the timeframe required by law (for EEA/UK, typically within one month of receipt, extendable in certain cases). There is no fee for making such requests, however, repeated or excessive requests may incur a reasonable fee as permitted by law. We will inform you of any such fee before proceeding.

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have infringed your privacy rights. For example, in the UK you can contact the Information Commissioner’s Office (ICO); in the EU, you can contact the data protection authority in your country of residence or work, or where an alleged infringement occurred. We would, however, appreciate the chance to address your concerns directly before you approach a regulator, so please feel free to reach out to us first.

Rights of California Residents (CCPA/CPRA Compliance)

If you are a resident of California, you are protected by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), which grants you specific rights regarding your personal information. These rights include:

• Right to Know: You have the right to request that we disclose the following information to you about our collection and use of your personal information in the past 12 months:
  

  • The categories of personal information we collected about you;

  • The categories of sources from which the personal information was collected;

  • The business or commercial purpose for collecting, selling, or sharing your personal information;

  • The categories of third parties with whom we disclosed personal information; and

  • The specific pieces of personal information we collected about you.
    Additionally, if we sold or shared your personal information or disclosed it for a business purpose, you have the right to receive:

  • The categories of personal information that we sold or shared for cross-context behavioral advertising and the categories of third parties to whom each category of personal information was sold or shared; and

  • The categories of personal information that we disclosed for a business purpose and the categories of persons or entities to whom it was disclosed.

• Right to Delete: You have the right to request that we delete any personal information about you that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm a verifiable consumer request, we will delete (and notify our service providers to delete) your personal information from our records, unless an exception applies. We may deny deletion requests if retaining the information is necessary for us or our service providers to, for example, complete transactions or services you requested, detect security incidents, comply with legal obligations, or other reasons permitted by CCPA.
  
  

• Right to Correct: As of January 1, 2023 (CPRA amendments), California residents also have the right to request correction of inaccurate personal information maintained by us. Upon a verifiable request, we will correct the information at issue (taking into account the nature of the personal information and the purposes of processing).
  
  

• Right to Opt-Out of Sale or Sharing of Personal Information: You have the right to direct us not to sell your personal information to third parties or not to share it for cross-context behavioral advertising. As noted above, we do not sell personal data for money. However, we do share certain information with third parties for advertising and marketing purposes that could fall under the definition of “sharing” for targeted advertising. If you prefer that we not share your personal information with third parties for their direct marketing or for cross-context behavioral advertising, you can opt out. To exercise the right to opt-out, you may contact us at support@buildgrassroots.com with the subject “Do Not Sell or Share My Info” or follow any instructions on our Site or App that indicate how to opt out of cookies or data sharing. We will honor opt-out requests as required by CCPA. If we have actual knowledge that you are under 16, we will not sell or share your personal information in any case, unless we receive affirmative authorization (opt-in) from a parent or guardian if you are under 13, or from you directly if you are between 13 and 16 years old.
  
  

• Right to Limit Use of Sensitive Personal Information: The CPRA created a new category of “sensitive personal information” (for example, precise geolocation, racial or ethnic origin, etc.). We do not use or disclose sensitive personal information for purposes beyond what is necessary to provide the Services (which are considered expected uses), so this right likely does not apply in any material way to our operations. If we ever engage in uses of sensitive data that invoke this right, we will provide a clear way for you to limit those uses.
  
  

• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. This means we will not deny you goods or services, charge you a different price, or provide a different level of quality of service just because you exercised your privacy rights. However, if you refuse to provide certain data or ask us to delete it, it might affect our ability to deliver certain features you requested (for example, if you don’t allow us to use your location, some App features might not function, but we will not punish you—this is just a consequence of the service functionality).
  
  

Exercising Your California Rights: If you are a California resident and wish to exercise any of the above rights, you (or an authorized agent acting on your behalf) can submit a verifiable consumer request to us by emailing support@buildgrassroots.com or by mail at Grassroots Carbon, 122 E. Houston Street, San Antonio, Texas 78025. Please include “California Privacy Rights Request” in the subject line and let us know which right you wish to exercise. We will need to verify your identity or authority to make the request (for example, by confirming information associated with your account or asking for additional information). For an authorized agent making a request on your behalf, we may require proof of the agent’s registration with the California Secretary of State (if applicable) or a valid power of attorney, plus proof of your identity, or other written authorization. We aim to respond to verifiable requests within 45 days as required by the CCPA, or notify you if we need more time (up to an additional 45 days).

Shine the Light Law: In addition to CCPA rights, California Civil Code § 1798.83 (the “Shine the Light” law) permits California residents to request certain details about information we have shared with third parties for their own direct marketing purposes in the preceding calendar year. If applicable, this would include a list of the categories of personal information shared and the names/addresses of all third parties with which we shared that information. We do not disclose personal information to third parties for their independent direct marketing purposes without consent. However, if you are a California resident and would like to make a request under the Shine the Light law, please send a written request to support@buildgrassroots.com or to Grassroots Carbon, 122 E. Houston Street, San Antonio, Texas 78025. In your request, please specify that you are seeking “Shine the Light” information. Please note that we are only required to respond to one such request per customer per year, and we will respond within 30 days as required by the law.

Other State Privacy Rights

Several U.S. states (such as Colorado, Virginia, Connecticut, Texas and Utah) have enacted privacy laws providing their residents with rights similar to those under the CCPA (e.g., rights to access, correct, delete, opt out of certain processing, etc.). If you are a resident of one of these states, you may contact us to exercise your applicable privacy rights. We will consider and process state-specific rights requests in accordance with relevant laws. For instance, Colorado residents have a right to appeal a refusal to take action on a request. If we deny a request from a Colorado resident, we will provide instructions on how to appeal that decision. We are committed to honoring all applicable privacy rights, so no matter where you are located in the U.S., feel free to reach out with any privacy-related requests or questions.

App-Specific Permissions and Controls

When you use the Grassroots Carbon PastureMap App, certain data and permissions are specifically relevant to the mobile experience:

• Device Permissions: The App may request access to specific functions of your mobile device, such as:
  

  • Camera/Photos: to allow you to take photos of your fields, livestock, or other images and attach them within the App (for example, monitoring pasture conditions). You can choose whether to grant the App permission to your camera and photo library. If granted, photos you take within the App or select from your library will be uploaded and stored as part of your account data. If you deny camera access, you will simply be unable to capture images directly through the App (you might still upload existing photos if the OS allows a picker without full permission).

  • Location: as mentioned, to use GPS for mapping and tracking, the App will request your location. You have control to allow or deny this. If you allow, the App can use your location to, for example, drop a pin where you are standing for a new paddock, or to help measure acreage. If you deny, you may still manually enter location information. You can always toggle location permission off later in your device’s settings if you change your mind.

  • Notifications: the App may ask to send you push notifications (for instance, reminders for tasks or alerts about your grazing plan). You can opt in to receive these alerts. If you opt in and later decide you no longer wish to receive push notifications, you can turn them off in your device’s notification settings for our App.

  • Storage: The App might need storage permission to save certain data or caches on your device (like map data for offline use, or temporarily storing updates until they sync when you regain connection). This is generally managed by your device automatically, but if a permission is required, we will request it and explain why.

• User Controls: You have controls within the App and your device to manage your data:
  

  • Within the App’s settings or your account settings, you may have options to edit your profile information, configure preferences (e.g., units of measurement, notification settings), and possibly export your data (if we offer a data export feature for things like grazing records).

  • You can also delete certain data in the App (for instance, removing a photo or deleting a field entry). Be cautious, as deleting data in the App may permanently remove it from our servers if it’s already synced.

  • If you want to delete your account entirely, please contact us as described in Your Rights above; simply uninstalling the App will not by itself delete your account or data from our servers (though it will stop collecting any new data via the App). We will guide you through the account deletion process which will ensure your data is removed from our systems, except for any information we must retain by law.

• App Analytics: Our App may collect analytics data as described earlier (such as crash reports via platforms like Sentry (or usage analytics to see which features are popular). You typically cannot directly opt out of basic analytics in the App aside from not using the App, but this data is generally anonymized or aggregated. If you have enabled “Limit Ad Tracking” or a similar setting on your device, our App will respect that setting in that we will not use your data to build advertising profiles. (We do not serve third-party ads in the App; any advertising tracking would primarily relate to analytics or if we ever do cross-promotional marketing.)
  

We are transparent about the App permissions at install time (your device will show you the permissions the app requests). You are free to decline any permission; the core functionality of the App (managing your pastures and herds) will generally still be available, though some optional features might not work without the corresponding permission. If you have questions about why a certain permission is needed or how it is used, please refer to this Privacy Policy or reach out to us for clarification.

Children’s Privacy

Our Services are not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16 years old. In fact, you must be at least 18 years of age to use our Site and App (or the age of majority in your jurisdiction) as stated in our Terms & Conditions. We do not knowingly allow minors under 18 to create accounts. If you are under 18, please do not use or access the Services. If we learn that we have inadvertently collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe that a child under 16 (or under 18, in violation of our Terms) may have provided us personal information, please contact us immediately at support@buildgrassroots.com so that we can investigate and address the issue. Parents or legal guardians who discover that a child under their supervision has provided personal data to us can request us to remove that information from our records.

Changes to this Privacy Policy

We may amend or update this Privacy Policy from time to time. If we make material changes, we will notify you by posting an updated notice on our website, within our App, or by other appropriate means (such as email notification). The “Last Updated” date at the top indicates when the latest changes were made. Your continued use of the Services after the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the changes, you should stop using the Services and may request that we delete your personal information as described above.

We encourage you to review this Policy periodically to stay informed about how we are protecting your information. Any prior version of the Privacy Policy will be made available upon request, so you can see how the Policy has changed over time.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using the information below. We take your privacy inquiries seriously and will respond as promptly as possible.

Contact Information:
Email: support@buildgrassroots.com
Postal Mail: Grassroots Carbon, 122 E. Houston Street, San Antonio, Texas 78025

Please feel free to reach out for any clarification about our Privacy Policy, to exercise your rights as described above, or to ask any other questions about how Grassroots Carbon handles personal information. Your feedback is valuable and helps us ensure we are providing the transparency and privacy protections our users deserve.