Privacy Policy

1. Information we collect

We collect information you provide, information received from connected advertising platforms, and technical information generated when you use Grizzly.

Account and workspace information

This may include your name, email address, user identifier, organization or workspace name, workspace membership, and assigned role. We use an authentication provider to support sign-in and account security.

Connected advertising account information

When you or an authorized administrator connects an advertising account, we receive information available through the permissions granted to Grizzly. Depending on the platform and connection, this may include:

• Business, account, and campaign names and identifiers.
• Account currency, time zone, and connection status.
• Campaign settings, budgets, delivery status, and bidding information.
• Advertising metrics, including spend, impressions, clicks, reported conversions, conversion values, and attribution information.
• Authorization credentials, such as access tokens, and information needed to identify and maintain the connection.
• Results and error information associated with synchronization and requested campaign changes.

Our current advertising integrations retrieve campaign-level reporting and conversion metrics. They do not retrieve the names, email addresses, phone numbers, or message contents submitted by individuals through advertising lead forms.

Information created in Grizzly

We store settings and records created through the service, such as client names, budget pools, budget groups, allocation settings, automation preferences, and activity logs.

Communications

If you contact us, we collect your contact information and the contents of your message, including any attachments or other information you choose to provide.

Technical and usage information

We and our service providers may collect information such as IP addresses, browser and device information, request timestamps, pages or features accessed, and diagnostic, error, and security logs.

2. How we use information

We use information to:

• Create and manage accounts and workspaces.
• Authenticate users and enforce workspace permissions.
• Connect advertising accounts and synchronize their data.
• Display advertising activity, budgets, and reporting.
• Calculate budget allocations and pacing information.
• Carry out campaign changes that you request or authorize through enabled features.
• Maintain activity records and explain changes made through the service.
• Provide support and send operational or security communications.
• Diagnose problems, maintain reliability, and improve the service.
• Detect and prevent unauthorized access, fraud, and misuse.
• Meet applicable legal obligations and enforce our agreements.

Features and available actions vary by advertising platform. Connecting a platform does not mean that every Grizzly feature is available for that platform.

We do not sell personal information or connected advertising account data. We do not use that information to serve targeted advertising or train general-purpose artificial intelligence models.

3. Information processed for customers

Grizzly serves businesses, agencies, and other organizations. When we process connected advertising account information on an organization's behalf, we do so to provide the service under that organization's instructions and our agreement with it.

The organization may separately determine how it collects and uses information in its advertising activities. Its own privacy notices and obligations apply to those activities.

If an agency or another organization manages your information through Grizzly, you may need to contact that organization to exercise your rights. We will assist it with requests where applicable.

4. When we disclose information

We disclose information only as needed for the purposes described in this policy and as permitted by applicable law and advertising-platform requirements.

Within your workspace

Information associated with a workspace may be available to other authorized members of that workspace, according to their permissions. Workspace administrators can manage membership, roles, and certain account connections.

Grizzly personnel

Authorized Grizzly personnel may access information when needed to provide support, investigate problems, and maintain or secure the service.

To service providers

We use service providers for functions such as authentication, application hosting, database storage, network security, email delivery, and support.

Our infrastructure currently includes Clerk for authentication, Fly.io for application hosting, Neon for database hosting, Cloudflare for network delivery and security, and Google Workspace for email. These providers receive or process information as needed to perform their services.

To connected advertising platforms

We exchange information with connected platforms to synchronize data and carry out authorized actions. For example, requesting a campaign-status change requires us to send the relevant campaign identifier and requested status to the platform.

For legal and security purposes

We may disclose information when reasonably necessary to comply with applicable law or a valid legal request, protect people or property, investigate misuse, or establish, exercise, or defend legal claims.

In a business transaction

Information may be disclosed or transferred as part of a proposed or completed merger, acquisition, financing, reorganization, or sale of business assets, subject to applicable law, platform restrictions, and appropriate confidentiality protections. We will provide notice and obtain consent where required.

At your direction

We may disclose information when you instruct us to do so or provide the necessary authorization.

5. Google and Meta information

Grizzly accesses Google Ads and Meta Ads information only through authorized connections and the permissions available to those connections.

We use information received from these platforms to provide and maintain the features described in this policy. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including applicable Limited Use requirements.

Information received from Meta is handled in accordance with applicable Meta Platform Terms and data-use requirements.

Google and Meta operate their own services under their respective terms and privacy policies. This Privacy Policy describes Grizzly's practices.

6. Cookies and similar technologies

Grizzly and its authentication and infrastructure providers use cookies and similar technologies to support sign-in, maintain sessions, protect the service, and remember relevant preferences.

We do not use advertising cookies or tracking pixels to build advertising profiles or track you across unrelated websites for targeted advertising.

You can manage cookies through your browser settings. Blocking certain cookies may prevent sign-in or other essential features from working.

Grizzly does not currently change its behavior in response to browser “Do Not Track” signals. Where applicable law requires us to honor another recognized privacy preference signal, we will do so.

7. How long we retain information

We retain information for as long as reasonably necessary to provide the service and fulfill the purposes described in this policy, subject to applicable law and advertising-platform requirements.

Retention depends on the type of information and why we hold it. For example:

• Account and workspace information is retained as needed to administer the service.
• Advertising data and settings are retained as needed to provide reporting, budget management, and activity history.
• Support, diagnostic, and security records are retained as needed to resolve issues, protect the service, and meet applicable obligations.

When information is no longer needed, we delete it or de-identify it where permitted. Some information may remain temporarily in backups until those backups expire or are replaced. Any retained information remains subject to appropriate restrictions and protections.

8. Disconnecting accounts and requesting deletion

Disconnecting an advertising account

An authorized administrator can disconnect a supported connection through Grizzly. Access may also be revoked through the advertising platform.

Disconnecting stops further access through that connection, subject to requests already in progress. It does not automatically erase previously imported records, pause advertising campaigns, or reverse changes already applied to the advertising platform.

Requesting access, correction, or deletion

To request access to, correction of, or deletion of your information, email [email protected].

Please identify the email address associated with your Grizzly account and the relevant workspace or connected advertising account. Do not send passwords or access tokens.

We may need to verify your identity or authority before acting on a request. We will respond within the period required by applicable law and explain any permitted limitation on fulfilling it.

Meta data-deletion requests

You may request deletion of information associated with your Meta connection by emailing [email protected] with the subject “Meta data deletion request.”

Meta may also send a deletion request to Grizzly through its integration-removal process. Grizzly provides a confirmation code and status link for requests received through its supported Meta data-deletion callback.

Removing a Meta integration and deleting a Grizzly workspace are separate actions. If you also want your Grizzly account, workspace, or previously imported advertising records deleted, identify that scope in your request.

We handle deletion requests subject to applicable law and platform requirements. Where retention is permitted and necessary for a legal obligation, security purpose, or legal claim, we restrict the retained information to that purpose.

9. Your privacy rights

Depending on where you live and the laws that apply, you may have rights to access, correct, delete, or obtain a copy of your personal information; object to or restrict certain processing; withdraw consent where processing depends on consent; or complain to a relevant supervisory authority.

These rights may be subject to exceptions and identity-verification requirements. We will not unlawfully discriminate against you for exercising them.

Contact [email protected] to make a request or ask about your rights. If we decline a request, you may ask us to reconsider by replying to our response. Additional appeal rights may apply under local law.

10. Security and international processing

We use technical and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, and loss. These include access controls and encryption of stored advertising-platform credentials.

No method of transmission or storage is completely secure.

Grizzly and its service providers may process information in the United States and other countries where they operate. Where applicable law requires safeguards for international transfers, we use the required safeguards.

11. Children

Grizzly is intended for business use by adults. It is not directed to children under 18, and we do not knowingly collect personal information from children under 18.

If you believe a child has provided personal information to Grizzly, contact [email protected] so we can investigate and take appropriate action.

12. Changes to this policy

We may update this Privacy Policy as the service or our practices change. The effective date above identifies the current version.

For material changes, we will provide additional notice through the service or another appropriate channel. Where required, we will obtain consent before using information for a new purpose.

13. Contact

Grizzly Lab LLC
Email: [email protected]

For privacy questions or requests, please include “Privacy request” in the subject line.