Privacy Policy

In plain language: Foundry & Grit LLC builds and operates software for businesses, including Fossaris. We use personal information to provide, secure, support, and improve our services. When a dealership or other business uses Fossaris with its own customer information, that business generally decides why the information is used, and Foundry & Grit processes it to provide the service. We do not sell personal information, and we do not sell or rent mobile information or SMS consent data.

1. Scope of This Privacy Policy

This Privacy Policy explains how Foundry & Grit LLC ("Foundry & Grit," "we," "us," or "our") collects, uses, discloses, protects, and retains personal information when people visit our websites, communicate with us, or use products and services that we operate, including Fossaris.

This Policy applies to information that Foundry & Grit receives directly and to information that we process for businesses that use our products. It does not replace the privacy notices of dealerships or other businesses that use our services. Those businesses may have their own privacy obligations and policies.

2. Our Role and the Role of Our Business Customers

Foundry & Grit may act in different privacy roles depending on the context. When you interact directly with Foundry & Grit, such as by visiting our website, requesting information, creating an account, or contacting support, Foundry & Grit determines how that information is used for those purposes.

When a dealership or other business customer uploads, enters, or sends information through Fossaris or another Foundry & Grit service for its own business purposes, that customer generally determines the purpose and permitted use of the information. Foundry & Grit processes that information to provide the contracted service and related support, security, administration, and compliance functions.

Business customers are responsible for obtaining any permissions, notices, consents, or other legal authority required for information they provide to us and for communications they direct through our services.

3. Information We Collect and Process

A. Information provided directly to Foundry & Grit

• Business contact information, such as name, business name, job title, email address, telephone number, and other contact details.
• Account and profile information, including authentication details, role, organization, dealership assignment, preferences, and administrative settings.
• Communications with us, including support requests, feedback, inquiries, and related correspondence.
• Information submitted through website forms, demonstrations, onboarding, or other direct interactions with Foundry & Grit.

B. Information processed through Fossaris and other Company services

• Customer contact information, such as name, telephone number, email address, and other customer identifiers supplied by a business customer.
• Vehicle and transaction-related information, such as year, make, model, VIN, dealership assignment, salesperson assignment, lead or customer status, and other fields supplied by a business customer.
• Imported data, including CSV files and custom data fields selected or mapped by an authorized user.
• Digital pass information, including information necessary to create, issue, update, deliver, redeem, expire, cancel, or otherwise manage Apple Wallet, Google Wallet, or comparable passes.
• SMS and email information, including recipients, message content, sender or assigned user, consent or opt-out status, delivery status, replies, bounces, opens, clicks, unsubscribes, and related campaign activity where those features are enabled.
• Uploaded or recorded content, including images, documents, videos, templates, branding assets, and related metadata where those features are enabled.
• Engagement information, including pass activity, content views, video views, shares, button selections, referral activity, and other service interactions where those features are enabled.
• Administrative and audit information, including user actions, permissions, security events, account status, and records used to operate and protect the service.

C. Information collected automatically

• Device and browser information, IP address, operating system, approximate network-derived location, referring pages, and similar technical information.
• Usage information about how our websites and services are accessed and used, including timestamps, pages or features used, error information, and performance data.
• Cookies or similar technologies when used on our websites or services. We use these technologies only as needed for operation, security, preferences, analytics, or other purposes described at the point of collection.

4. How We Use Information

We use personal information for legitimate business and service purposes, including to:

• Provide, operate, maintain, and administer our websites, Fossaris, and other products and services.
• Create and manage user accounts, permissions, organization structures, authentication, and security controls.
• Process information and communications at the direction of our business customers.
• Issue and manage digital wallet passes and related lifecycle events.
• Deliver SMS, email, and other customer communications selected by authorized users, and process replies, opt-outs, and delivery events.
• Provide reporting, analytics, campaign measurement, service activity records, and operational insights.
• Host, deliver, and measure engagement with customer-specific or business-created content, including video where enabled.
• Provide customer support, troubleshoot problems, prevent abuse, and improve reliability and usability.
• Protect accounts, investigate suspected fraud or misuse, enforce agreements, and maintain system and audit records.
• Comply with law, legal process, regulatory obligations, and valid requests from authorities.
• Develop and improve our products and services using information we are permitted to use for that purpose, including aggregated or de-identified information.

5. SMS, Email, and Customer Communications

Fossaris may allow authorized business users to send SMS, email, and other communications to recipients using contact information and content supplied or approved by the business customer. Foundry & Grit processes the information needed to route, deliver, record, and manage those communications.

Business customers are responsible for using communication features in accordance with applicable law and for obtaining and maintaining required consent or other authority. Where supported, Fossaris records opt-out or consent-related status so that authorized users can manage communications appropriately.

Mobile information, including mobile phone numbers, text messaging originator opt-in data, and consent information, will not be shared, sold, rented, or otherwise disclosed to third parties or affiliates for their marketing or promotional purposes. This restriction does not prevent Foundry & Grit from using service providers as necessary to deliver and operate the messaging service, subject to appropriate contractual or operational restrictions.

6. Digital Wallet Passes

Fossaris may create and manage passes for Apple Wallet, Google Wallet, or similar platforms. To provide this functionality, we may process customer, dealership, offer, vehicle, expiration, redemption, device, and pass-status information. We may also exchange information with the applicable wallet platform as needed to create, update, deliver, or manage a pass. The wallet platform provider may independently process information under its own privacy terms.

7. Uploaded Content, Video, and Engagement Data

Authorized users may upload images, branding, templates, videos, or other content to our services. Where customer-facing content is delivered through Fossaris, we may process information about whether and how that content is accessed, viewed, shared, or acted upon. These records may be made available to authorized users of the relevant business customer for operational, service, follow-up, or reporting purposes.

Business customers are responsible for ensuring they have the rights and permissions necessary to upload and use content through our services.

8. How We Disclose Information

We disclose personal information only as reasonably necessary for the purposes described in this Policy. Recipients may include:

• The business customer that supplied the information and its authorized administrators, dealerships, managers, users, or personnel, according to configured permissions.
• Service providers and subprocessors that support hosting, databases, communications, digital wallet functionality, authentication, analytics, storage, monitoring, support, and other operational needs.
• Professional advisers, insurers, auditors, attorneys, accountants, or consultants when reasonably necessary for business, legal, compliance, or risk-management purposes.
• Government authorities, courts, or other parties when required by law, legal process, or to protect rights, safety, security, or the integrity of our services.
• A successor or transaction participant in connection with a merger, financing, acquisition, reorganization, sale of assets, or similar business transaction, subject to applicable confidentiality and legal requirements.

We do not sell personal information for money. We do not sell or rent mobile information or SMS consent information.

9. Data Retention

We retain personal information for as long as reasonably necessary to provide the applicable service, satisfy business and contractual needs, maintain security and audit records, resolve disputes, enforce agreements, and comply with legal obligations. Retention periods vary by data type and feature.

Some operational information may have shorter service-specific retention periods, while records such as account history, consent or opt-out records, audit logs, transaction records, legal records, or backup copies may be retained longer when necessary. When information is no longer reasonably needed, we may delete, anonymize, or aggregate it, subject to legal, contractual, technical, and backup requirements.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. Depending on the service and user role, safeguards may include authentication controls, multi-factor authentication, role-based permissions, encrypted connections, access logging, monitoring, backups, and vendor controls.

No method of electronic transmission, storage, or security is completely risk-free, and we cannot guarantee absolute security.

11. Access by Business Administrators and Authorized Users

Information within a business customer account may be accessible to authorized users according to organizational hierarchy, role, dealership, assignment, and permissions. Business or dealership administrators may be able to create, modify, deactivate, review, or manage users and may have access to activity and records associated with their organization. Users should contact their organization if they have questions about internal access or permissions.

12. Privacy Requests and Choices

Depending on applicable law and your relationship with Foundry & Grit, you may have rights to request access to, correction of, deletion of, or other action concerning personal information. You may contact us through the contact methods published on our website to make a privacy request.

If your information was provided to Fossaris by a dealership or other business customer, we may need to direct the request to that business or coordinate with it because the business may control the relevant customer relationship and determine how the information is used. We may take reasonable steps to verify identity and authority before fulfilling a request.

Recipients of SMS or email communications may also use the opt-out methods provided in the communication, such as replying STOP to supported SMS messages or using an unsubscribe method in supported email communications.

13. Cookies, Analytics, and Website Technologies

Our websites and services may use cookies, local storage, logs, or similar technologies for essential functionality, security, preferences, performance, and analytics. The technologies we use may change as our websites and services evolve. Where required by law, we will provide additional notice or choice regarding non-essential technologies.

14. Third-Party Services and Links

Our websites and services may interact with or link to third-party services, including communications providers, digital wallet platforms, hosting providers, analytics tools, or other technology services. Third parties may process information under their own terms and privacy policies when they act independently from Foundry & Grit. We encourage users to review the privacy practices of third-party services they use.

15. Children

Our websites and business software are not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 through our public websites. Business customers should not use our services to provide children's personal information unless the use is lawful and authorized.

16. U.S. Operations and Data Location

Foundry & Grit is a United States company. Information may be processed and stored in the United States and in other locations where our service providers operate, subject to applicable contractual and legal requirements.

17. Changes to This Privacy Policy

We may update this Privacy Policy as our business, products, technology, or legal obligations change. When we make material changes, we will update the effective date and provide additional notice when required by law or when we determine that additional notice is appropriate.

18. Contact Us

Questions or requests concerning this Privacy Policy or Foundry & Grit privacy practices may be submitted through the contact information or privacy contact method published on the Foundry & Grit website.