This is the Privacy Policy of Grass OpCo (BVI) Ltd. (“Grass”, “we”, “us”, or “our”), a subsidiary of Grass Foundation.

We operate the Grass™ web extension, dashboard application, desktop application, mobile application, and related hardware, including as made available through the collective websites www.getgrass.io and www.grassfoundation.io (collectively, the “Website”). The Website, together with our web extension, dashboard, desktop application, mobile application, and related devices (collectively, the “Grass Services”) allow users to participate in a Decentralized Peer-to-Peer Internet Networking Ecosystem that facilitates access to and use of web data (the “Grass Network”).

We take privacy very seriously and we make limited use of personal information in connection with the operation of our business. We operate the Grass Services and Grass Network in a manner that ensures that we respect your privacy and your rights to any personal information you may provide to us. We limit the personal information that we collect to your email address, username, password, wallet address, referral codes, IP address, and other personal information that you choose to provide to us. We only use that personal information for the limited purposes described in this Privacy Policy. We do not sell or otherwise monetize your personal information.

The purpose of this Privacy Policy is to help you understand our data privacy practices. It is important to us that you understand how we use your personal information so that you can make an informed decision on whether you would like to access or use the Grass Services and participate in the Grass Network.

This Privacy Policy covers the following topics, which you can learn more about by clicking the links below:

• Consent from users outside the EEA, UK, Switzerland and BVI
• What is personal information?
• Information that we collect
• Use of your personal Information
• Promotional and transactional messages
• Disclosure and transfers of personal information
• Aggregated data
• Retention of personal information
• Security & protection of personal information
• Your rights related to your personal information
• Consent; withdrawal of consent
• Links to third party resources
• Cookies
• Changes to this Privacy Policy
• Contact information
• Additional information for users in the EEA, UK, Switzerland or BVI

Unless you are based in the European Economic Area (EEA), the United Kingdom (UK), Switzerland or the British Virgin Islands (BVI), by accessing or using the Grass Services or participating in the Grass Network, you agree to accept this Privacy Policy (including the ways we collect, use, and disclose your personal information). If you are based in the EEA, UK, Switzerland or BVI please see below for our policies and procedures regarding how we process your personal informationhere.

You can withdraw your consent to our collection, use, or disclosure of your personal information by contacting us using the contact information that is included in this Privacy Policy (see below). Please note that if you choose to withdraw your consent, we may not be able to provide you with certain services, products, communications, and opportunities, including access to and use of the Grass Services and/or participation in the Grass Network.

Personal information is any information relating to an identified or identifiable individual. Under certain laws that may apply to you, personal information may also include information that identifies a specific household or device.

We may collect personal information from you based on the Grass Services that you choose to access and use. The personal information that we may collect from you in connection with your use of the Grass Services is as follows:

• Account Information: contact and identification information, such as your email address, username, password, digital wallet public address, and any referral codes that you have been provided by us in connection with your use of the Grass Services;
• Technical, Device & Usage Information: your IP address; and
• Information provided when you contact us: any other personal information that you choose to provide to us when you contact us for support, provide us with feedback, or otherwise communicate with us.

The types of personal information that we collect will depend on what personal information you choose to provide to us based on your interactions with us and the Grass Services and Grass Network.

We may also collect certain non-personal information in connection with your use of the Grass Services, including information about your use of the Grass Services and participation in the Grass Network, the operating system of your device, application IDs, the type and version of your browser, crash data and analytics, other device identifiers, and other information relating to the manner in which you access or use the Grass Services or participate in the Grass Network.

We use the personal information that we collect to provide you with the functionality, features, and communications that are available on and through the Grass Services and to enable us to manage, maintain, and develop our operations. Specifically, we may use your personal information for the following purposes:

• manage our relationship with you, including by assisting you to create an account, communicate with us, and provide you with the services that you request;
• assess the quality of your IP address and determine the uptime associated with your IP address as part of the Grass Network;
• support the Grass Network by permitting Grass to operate the Grass Network to facilitate access to and use of web data from public websites. The personal information used for this purpose is limited to your IP address;
• allow you to participate in, subscribe to, and receive information, news, updates, and promotional materials from us and third parties;
• comply with your requests and preferences regarding your use of the Grass Services and the manner in which we communicate with you;
• understand your preferences and values so that we can tailor the Grass Services and communications to you;
• protect us against error, fraud, theft, and damage to our Services, business, and property;
• conduct research, analysis, evaluation, and development activities to understand the way the Grass Services are used and to improve the Grass Services, Grass Network, and our general operations, including with respect to the development of new products, services, and opportunities; or
• allow us to comply with applicable laws and regulatory purposes.

For more information about how we use your personal information if you are based in the EEA, UK, Switzerland or BVI (including the legal bases we may rely on to process it), please seeAdditional information for users in the EEA, UK, Switzerland and BVI.

We will collect your consent prior to sending you promotional emails and other electronic messages (e.g., texts, direct messages), except where we are permitted under applicable laws to send you such messages without doing so. You can opt-out or unsubscribe from receiving promotional messages from us at any time. Promotional messages include our newsletter and updates about our and our partners’ businesses, products, and services.

As part of the Grass Services, you will receive service related transactional communications about your account and activities. For example, when you create an account or reset your password you may receive an email confirming the details of such activity. You may not opt-out of receiving these transactional communications.

We may disclose your personal information in the manner and for the purposes that are described in the sections below.

• Working with third parties. We work with third parties that provide services to us that help us facilitate one or more aspects of the products, services, communications, or features that we offer to you on and through the Grass Services. We may provide these third parties with your personal information directly or they may collect your personal information from you on our behalf. These include providers of the following types of services:
  • Customer support service providers. These service providers assist us in helping us track, manage and respond to customer support inquiries. We share personal information such as your Account Information (excluding passwords) and information provided when you contact us with them to enable them to provide these services to us, including in connection with your opportunity to receive rewards.
  • Communication service providers. These service providers assist us in sending marketing and transactional communications to you. We share your email address with them to enable them to provide these services to us.
  • Information technology service providers. These service providers enable us to operate our services in a reliable manner by providing us with services like data hosting and cloud computing resources. For example, we may share personal information such as Account Information, information provided when you contact us and Technical, Device & Usage Information with data hosting providers to enable them to provide data hosting services to us.
  • Professional advisors. In limited cases, we may need to share personal information with our professional advisors like our external lawyers or financial advisors who help us ensure we are compliant with our legal and financial obligations. Depending on the circumstances, we may share any of the information described inSection 4above with them.
• Use of the Grass Network. Users of the Grass Network may have access to your IP address in connection with their participation or use of the Grass Network to facilitate access to and use of web data through the Grass Network. In addition, your IP address may be visible to websites when your IP address is being used as part of the Grass Network.
• Business transactions. Your personal information described inSection 4above may, depending on the circumstances, be disclosed to a third party in connection with a business transaction, including a change of ownership of Grass or its affiliates, the sale of all or certain of our assets, or the grant of a security interest. We will take reasonable steps to ensure that the third party that receives your personal information is bound by appropriate agreements that require that your personal information is handled in a manner that is consistent with this Privacy Policy.
• Legal requests or protecting rights and interests. We disclose your personal information if we determine that such disclosure is necessary to comply with the law, protect our or others’ rights, property or interests (such as enforcing our Terms & Conditions) or prevent fraud or abuse of our service. Depending on the circumstances, we may share any of the information described inSection 4above with these third parties.

Please note that as we may disclose your personal information to third parties (including our service providers) as described in this Privacy Policy, your personal information may be collected, used, disclosed, and otherwise processed outside of your jurisdiction of residence. As such, your personal information may potentially be accessible to law enforcement and national security authorities of another jurisdiction where local laws provide for a different level of protection for personal information. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security agencies in those other countries may be entitled to access your personal information.

If you would like further information about our policies and practices regarding the transfer and storage of your personal information, including disclosures to third parties such as our service providers, please contact us using the contact details below. If you are in the EEA, UK, Switzerland or BVI, you can find out more about these transfers and the legal frameworks we rely upon for them in transfers outside of the EEA, UK and Switzerland or Data transfers outside of BVI.

Unless you are based in the EEA, UK, Switzerland or BVI by providing your personal information to us, you consent to our disclosure of this information to our service providers (and other third parties) as described in this Privacy Policy, including those that may be located outside of your jurisdiction of residence.

We may disclose aggregated non-personal information and related usage information, which does not contain personal information that directly identifies you, with third parties, including our customers, clients, partners, advertisers, service providers, vendors, suppliers, and content providers

We do not keep your personal information forever. We will retain your personal information for as long as is reasonably necessary for us to complete our dealings with you, or as may be required by law, whichever is longer. For example, we retain Account Information regarding you for as long as your account is active or as needed to provide you with the Grass Services. We also retain personal information for as long as is necessary to achieve the purposes described in this Privacy Policy, for example, to comply with our legal obligations, to protect us in the event of disputes, and to enforce our agreements and to protect our and others’ interests.

The precise periods for which we retain your personal information vary depending on the nature of the information and the purposes for which we use it. Factors we consider include any minimum retention period required by applicable or recommended best practices and the period during which a claim can be made with respect to an agreement or other matter.

We maintain commercially reasonable physical, technological, and procedural safeguards that are appropriate based on the sensitivity of the personal information in question. These safeguards are designed to prevent your personal information from loss and unauthorized access, collection, use, disclosure, copying, modification, disposal, or destruction.

Please advise us immediately of any incident involving the loss of or unauthorized access to or disclosure of your personal information that is relevant to your use of the Grass Services.

Under the applicable data protection laws like the General Data Protection Regulation (“GDPR”), you may have certain rights in relation to our processing of your personal information. Please note that these rights are not absolute, and we may be entitled or obliged to refuse requests where exceptions or exemptions apply under applicable law.

Some of these rights which may apply (depending on your jurisdiction) include the right:

• to obtain access to, and copies of, the personal data that we hold about you;
• to require us to correct the personal data we hold about you if it incorrect;
• to require us to erase your personal data in certain circumstances;
• to require us to restrict your data processing activities in certain circumstances;
• to withdraw your consent (where we relied upon it) - the withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal;
• to object, on grounds relating to your particular situation, to any of our particular processing activities where you believe this has a disproportionate impact on you;
• to receive from us the personal information we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal information to another data controller; and
• to lodge a complaint with a supervisory authority (such as your local supervisory authority where you reside).

If you want to exercise your rights, please contact us to do so. We may request specific information from you to enable us to confirm your identity if necessary, as well as to search for and provide you with the personal information that we hold about you. If you require assistance in preparing your request, please contact us.

Unless you are based in the EEA, UK, or BVI or you advise us otherwise, through the access and use of the Grass Services, you have consented to the collection, use and disclosure of your personal information as explained in this Privacy Policy.

The Grass Services may contain links to other websites that may be subject to less stringent privacy standards. These links are provided for your convenience only and you assume all risk for clicking these links to other websites. We cannot assume any responsibility for the privacy practices, policies or actions of the third parties that operate these websites. We are not responsible for how such third parties collect, use or disclose your personal information. You should review the privacy policies of these websites before providing them with personal information.

Please see our Cookie Policy for more information about the cookies and other tracking technologies that we use on the dashboard and Website.

We may make changes to this Privacy Policy from time to time. These changes may be made as a result of changes to our legal obligations or the ways in which we collect, use, disclose, or otherwise process your personal information.

We will post an updated version of our Privacy Policy on our website when we make changes and may also notify you of the changes we have made in other ways if we are required to do so by applicable law. We encourage you to check this Privacy Policy for updates on a regular basis.

If you have any questions or concerns regarding this Privacy Policy, you should contact us at privacy@grassfoundation.io.

**If you choose to communicate with us via email, please be aware that email is not a 100% secure medium for sending any personal or confidential information to us. **