Privacy Policy
GrassFed Services LLC ("GrassFed," "we," "us," or "our") respects your privacy and is committed to handling your information responsibly. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in connection with our email marketing services (the "Services").
This Privacy Policy applies to: - Agents and Clients — real estate professionals who use the Services. - Recipients — homeowners and other individuals whose contact information is used in Campaigns sent through the Services.
This Privacy Policy is incorporated by reference into the Terms of Service. Agents are also subject to Section 19 (Data Processing Terms) of the Terms of Service, which governs the Agent's relationship with GrassFed as it relates to Recipient data.
1. Information We Collect
1.1 Information Agents provide
When you subscribe to the Services, we collect: - Name and contact information (email, phone number, business address) - Business information (brokerage legal name, DBA, real estate license number, license type, license state, supervising broker) - Billing information (processed securely through Stripe) - Territory preferences, MLS identifier, MLS event filters, and Campaign criteria - Custom email copy and outreach persona configuration - Block lists of contacts to exclude
1.2 Information we collect automatically from Agents
When you use the Services, we automatically collect: - Campaign performance data (sends, opens, replies, bounces) - Login and access timestamps - Device and browser information - IP address - Subject lines, headers, send timestamps, and opt-out events maintained as a compliance log (see Section 4)
1.3 Recipient data sourced from third parties
We obtain homeowner contact data from third-party data providers to power Campaigns sent on behalf of Agents. This data may include: - Names and email addresses - Phone numbers (where available) - Property addresses and property characteristics - Other publicly-available real estate data
GrassFed sources Recipient data from third-party providers and may, depending on the activities involved, qualify as a "data broker" under California Civil Code § 1798.99.80 et seq., Vermont 9 V.S.A. § 2446, Texas Bus. & Com. Code Ch. 509, and Oregon HB 2052. GrassFed has registered as a data broker in jurisdictions where required. See Section 8 for Recipient rights and the data-broker delete-request process.
Recipient data sourced for an Agent's Campaigns is made available to that Agent through the Services for the purpose of operating those Campaigns and managing the resulting replies and opt-outs.
1.4 Categories of personal information (CCPA / CPRA enumeration)
For purposes of California Civil Code § 1798.140 and equivalent state privacy laws, the categories of personal information we collect are: - Identifiers — name, email, phone number, mailing address, IP address, account identifiers - Commercial information — billing records, transaction history, subscription details - Internet or other electronic network activity — login timestamps, device and browser information - Geolocation data — coarse, derived from IP address; mailing address for billing - Professional or employment-related information (Agents only) — license number, license type, brokerage affiliation, DBA registration - Inferences — derived from the above to operate and improve the Services
We do not collect biometric information, racial or ethnic origin, religious beliefs, union membership, or other "sensitive personal information" categories as defined by the CCPA/CPRA.
2. How We Use Information
We use information to: - Provide and operate the Services - Process payments and manage subscriptions - Send Campaigns on behalf of Agents - Receive, route, and process replies, opt-outs, and bounces - Communicate with Agents about accounts and Campaigns - Provide customer support - Maintain a global suppression list across all Agents - Improve the Services and develop new features - Comply with legal obligations, including subpoenas, regulatory inquiries, and data-broker delete requests - Protect against fraud and abuse
2.1 Master inbox; staff and AI access to replies
Replies, opt-outs, and bounces from Recipients are routed into GrassFed's master inbox and the Agent's portal. GrassFed personnel and automated systems (including machine-learning systems used for sentiment analysis, opt-out detection, and deliverability anomaly flagging) may access the contents of replies, opt-outs, and bounces in the course of operating the Services, providing support, ensuring quality, and processing opt-outs. GrassFed does not use AI to generate or send Campaign content without human review, and does not use Recipient reply contents to train models served to third parties.
3. How We Share Information
We do not sell or share personal information within the meaning of California Civil Code § 1798.140(ad)–(ah) or equivalent state privacy laws. We have not sold or shared personal information for at least the prior twelve (12) months.
We may share information with:
3.1 Service Providers (subprocessors)
We use third-party service providers to operate the business. Subprocessors that handle personal data are contractually obligated to protect that data. The current list of subprocessors that handle Recipient personal data is available on request by emailing admin@grassfed.tech. Examples of categories include: - Payment processing (Stripe) - Email sending infrastructure - Lead data sourcing - Email validation - Edge / transit - Hosting and backend - Internal reply notifications (notification metadata only) - Transactional email to Agents and operators
3.2 Legal Requirements
We may disclose information if required by law, subpoena, court order, or government request, or to protect our rights, property, or safety, or that of our users or the public.
3.3 Business Transfers
If GrassFed is acquired, merged, or sells substantially all of its assets, information may be transferred to the new owner. Recipients will be notified of any such transfer through this Privacy Policy and any required public disclosure.
4. Data Retention
We retain information for as long as needed to provide the Services and as required by applicable law:
| Category | Retention |
|---|---|
| Agent account data | Active account duration, plus 90 days after cancellation |
| Recipient reply content | 24 months from receipt |
| Lead data (third-party sourced) | 24 months from sourcing |
| Global suppression list | Permanent — maintained as a permanent compliance record across all Agents and Campaigns |
| Campaign performance data | 24 months in identifiable form; thereafter, retained in anonymized / aggregated form |
| CAN-SPAM compliance log (subject lines, headers, send timestamps, opt-out events) | Minimum of three (3) years from the date of the relevant Campaign |
| Billing records | As required by law (typically 7 years) |
5. Data Security
We implement reasonable security measures to protect information, including: - Encryption of data in transit (HTTPS/TLS) - Secure payment processing through Stripe (PCI-compliant) - Access controls limiting who can view information - Regular security reviews - Subprocessor contractual security obligations
However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.
5.1 Breach notification
If GrassFed becomes aware of a confirmed unauthorized acquisition of personal information that triggers a notification obligation under applicable law, GrassFed will provide notice to affected individuals and regulators as required, and in accordance with Section 19 of the Terms of Service where applicable.
6. Your Rights — Agents and Recipients
Depending on your residence, you may have the right to: - Access — request a copy of your personal information - Correct — request we correct inaccurate information - Delete — request we delete your information (subject to legal retention requirements such as the CAN-SPAM compliance log and suppression list) - Portability — request your data in a portable format - Opt out — opt out of marketing communications (Agents); opt out of further Campaigns (Recipients) by using the keyword-reply mechanism described in Section 8 - Non-discrimination — exercise your rights without retaliatory or discriminatory treatment
6.1 How to exercise these rights
Email admin@grassfed.tech with your request. We will respond within the timeframe required by applicable law: - California, Colorado, Connecticut, Virginia: 45 days (extendable to 90 days with notice) - Texas, Oregon: 45 days - Other jurisdictions: as required by applicable law
We may need to verify your identity before fulfilling certain requests.
6.2 Authorized agents
A consumer's authorized agent may submit a request on the consumer's behalf with appropriate verification.
7. State-Specific Rights
7.1 California (CCPA / CPRA)
California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act: - Right to know what personal information we collect and how it's used - Right to know what personal information we disclose - Right to delete personal information (subject to retention exceptions) - Right to correct inaccurate personal information - Right to limit the use of sensitive personal information (we do not collect sensitive personal information as defined by CPRA) - Right to opt out of sale or sharing for cross-context behavioral advertising (we do not sell or share) - Right to non-discrimination
To submit a request, email admin@grassfed.tech with "California Privacy Request" in the subject line.
7.2 Virginia (VCDPA)
Virginia residents have the rights described in Section 6 under the Virginia Consumer Data Protection Act. To exercise these rights or to appeal a denied request, email admin@grassfed.tech with "Virginia Privacy Request" in the subject line.
7.3 Colorado (ColoPA)
Colorado residents have the rights described in Section 6 under the Colorado Privacy Act, including the right to opt out of profiling that has legal or similarly significant effects. To exercise these rights or appeal, email admin@grassfed.tech with "Colorado Privacy Request" in the subject line.
7.4 Connecticut (CTDPA)
Connecticut residents have the rights described in Section 6 under the Connecticut Data Privacy Act. To exercise these rights or appeal, email admin@grassfed.tech with "Connecticut Privacy Request" in the subject line.
7.5 Texas (TDPSA)
Texas residents have the rights described in Section 6 under the Texas Data Privacy and Security Act. To exercise these rights or appeal, email admin@grassfed.tech with "Texas Privacy Request" in the subject line.
7.6 Oregon (OCPA)
Oregon residents have the rights described in Section 6 under the Oregon Consumer Privacy Act. To exercise these rights or appeal, email admin@grassfed.tech with "Oregon Privacy Request" in the subject line.
8. Email Campaign Recipients
If you received an email from one of our Agents' Campaigns:
- How we got your information. Your contact information was obtained from public records or third-party data providers (see Section 1.3). The real estate Agent on whose behalf the email was sent is identified in the email's body and signature.
- How to opt out. You can opt out by replying to the email with "stop," "remove," "unsubscribe," or a similar instruction. Opt-out requests are processed automatically and added to our permanent global suppression list, which applies across all Agents on the GrassFed platform. Once you opt out, you will not receive further Campaigns from any GrassFed Agent.
- About this email and GrassFed's role. The email was transmitted from GrassFed-owned sending infrastructure on behalf of the identified Agent. GrassFed personnel and automated systems may access the contents of any reply you send to a Campaign email, including for purposes of processing your opt-out, providing support to the Agent, ensuring quality, and detecting deliverability issues (see Section 2.1).
- Questions about a specific email should be directed to the real estate Agent identified in the message.
- Data broker delete requests. GrassFed is registered as a data broker in jurisdictions where required (see Section 1.3). California residents may submit deletion requests through the California Privacy Protection Agency's data broker registry. Residents of any jurisdiction may also submit a delete request directly to GrassFed by emailing admin@grassfed.tech with "Data Broker Delete Request" in the subject line. We will respond within 45 days and will, where the request is verified, delete the information across our systems and add the email address to our permanent suppression list to prevent future contact.
9. Cookies and Tracking
Our website and Agent portal use cookies and similar technologies for: - Authentication and session management - Remembering your preferences - Analytics (understanding how the Services are used)
You can control cookies through your browser settings, but disabling them may affect functionality.
We do not use cookies for cross-context behavioral advertising and do not share personal information through advertising cookies.
10. Children's Privacy
The Services are not intended for individuals under 18. We do not knowingly collect information from children. If you believe we have collected information from a child, contact us immediately at admin@grassfed.tech.
11. International Users
The Services are intended exclusively for use in the United States. We do not knowingly collect or process personal information from individuals located outside the United States. If you are located outside the United States, do not use the Services.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Your continued use of the Services after changes take effect constitutes acceptance.
13. Contact Us
Questions about this Privacy Policy or our data practices? Contact us:
GrassFed Services LLC 8 The Green, Suite B Dover, DE 19901
Email: admin@grassfed.tech Website: https://www.grsfd.ai
For subprocessor information: email admin@grassfed.tech For Data Processing terms (Agent-applicable): see Section 19 of the Terms of Service at https://www.grsfd.ai/terms