This Privacy Notice explains how Graze Social PBC (“Graze”) collects and treats information through the Graze platform, our website graze.social, and the products and services we offer (collectively, our “Services”). This Privacy Notice is governed by and part of our Terms of Service. Any terms defined in the Terms of Service have the same meaning when used in this Privacy Notice.
You consent to our privacy practices described in this Privacy Notice by accessing the Services or allowing us to process Personal Data following receipt of a notice from Graze that your Personal Data is included in our records. If you do not agree with this Privacy Notice, do not access or use our Services.
PRIVACY SUMMARY:
Our Services provide Users and their companies (“Feed Curators”) with tools to create and monetize custom content feeds (“Feeds”) from publicly available usage and content data on Bluesky (“Bluesky Content”). Our Services are sophisticated, but we aim to keep our privacy practices simple. We offer this summary of our privacy practices to give you a quick overview of how we treat your data:
If you have questions about this Privacy Notice or any of our Services, please contact us at legal@graze.social.
PERSONAL DATA
As used in this Privacy Notice, “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Data falls within certain categories, for example:
Identifiers (e.g., name, email, telephone number, address, username);
Sensitive Personal Data (e.g., government identification number; precise geolocation; racial or ethnic origin; religious beliefs; health data; contents messages when Graze is not the recipient);
Legally protected information (e.g., race, citizenship, marital status, sex);
Employment-related information (e.g., current or past employment);
Non-public educational information, including information protected under the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99);
Biometrics (e.g., DNA, face/voice prints, health data) and audio, electronic, visual, thermal, or olfactory information;
Commercial information (e.g., products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies);
Internet or other similar activity (e.g., browsing history; content interactions); and
Inferences drawn from Personal Data to create a profile about preferences, characteristics, trends, predispositions, behavior, attitudes, intelligence, and aptitudes.
Not all information is protected as Personal Data under privacy laws. Information may not be covered by the privacy laws applicable to you if it is: (a) publicly available; (b) aggregated information, meaning data summaries or reports with the Personal Data removed; or (c) anonymized or de-identified.
Graze may collect Personal Data with your consent, with a legitimate interest, or as authorized or required by law. We only collect, use, retain, and disclose Personal Data as is adequate and relevant to the specific, express purposes described below or as reasonably necessary and proportionate to provide our Services or for other purposes that we disclose to you and are compatible with the context of how we collected your Personal Data.
Categories of Personal Data: Over the last 12 months, we have collected identifiers, commercial information, internet or similar activity, and inferences.
Sources of Collection: Graze collects Personal Data through our website, your Graze account, and your use of our Services, as detailed below:
Your interactions with Graze. If you request information about our Services or contact us for customer support, we will collect your contact information and other details you provide, and we will use it to respond to your inquiry. If you register as a User, we will also collect information about your Bluesky account and company (if applicable). If you complete a survey, we will collect your responses with your consent and we will use the information you provide in your responses to improve our Services. By including Personal Data in your communication to Graze, you consent to this processing. If you do not want us to process your Personal Data, please omit it from your communication to Graze.
If you opt-in to receive marketing communications from Graze, we may use the Personal Information in these communications to send you marketing messages about Graze and the Services we offer. If you opt out of Graze marketing, we will not use your Personal Information for marketing purposes.
Technical Data and Cookie Use. Graze automatically collects technical data from your use of the website and our Services, such as your IP address, browser type, operating system, device details, and pages visited. We may also collect data about your interactions with content on the Services, Feeds created, or Campaigns launched.
Graze uses essential cookies and related technology to collect and process this data, including:
Graze does not use any non-essential cookies.
Graze will not collect additional categories of Personal Data or use already collected Personal Data for purposes that are materially different, unrelated, or not reasonably necessary or compatible with the original purpose without notice and consent to you as required by law. Graze might also use your Personal Data to:
Monitor your compliance with any of your agreements with us
Protect your privacy and enforce this Privacy Notice
If we believe it is necessary, to identify, contact, or bring legal action against persons or entities who may be causing injury to you, to us, or to others
Comply with a law, regulation, legal process, or court order
Fulfill any other purpose to which you consent
DATA DISCLOSURES
Graze will only disclose Personal Data to third parties as described in this section, with permission, or as required by law. In the preceding 12 months, Graze has disclosed Personal Data for business purposes to the following recipients:
Other Third Parties, as permitted by applicable law. For example: if we go through a business transition (e.g., merger, acquisition, or sale of a portion of our assets); to comply with a legal requirement or a court order; when we believe it is appropriate to take action regarding illegal activities or prevent fraud or harm to any person; to exercise or defend our legal claims; or for any other reason with your consent.
Law enforcement, and other governmental agencies, at our sole discretion in connection with an investigation of any matter that is illegal or that could expose Graze or our affiliates or subsidiaries to liability.
Graze reserves the right to disclose aggregated, anonymized, or de-identified information about any individuals with non-affiliated entities for research, product development, marketing, or other purposes, without restriction.
The data we collect and process is retained as an essential asset to our provision of Services as long as it serves a legitimate interest. If we learn that any data is inaccurate or stored or used unlawfully, we will correct or delete that data as required by law and our company policies. Personal Data associated with a User’s account is retained while that account remains active and is deleted within 90 days after account closure. We retain data collected from cookies and similar technologies for trends analysis and data security purposes for up to 24 months or according to the cookie hosting entity’s policies. We reserve the right to retain data, including Personal Data, for longer periods if it is critical to our business and securely stores that retained data. We regularly review and delete or deidentify unnecessary data.
Graze provides the following methods and to directly control how we collect and use your Personal Data, including but not limited to:
In the United States, consumer privacy is governed by federal privacy laws covering specific industries or data uses and state privacy laws providing general consumer privacy rights. This section provides a notice of privacy rights under the privacy laws of U.S. states that provide consumer privacy protections. Residents of states offering privacy protections (each a “Consumer”) may have some or all the following rights over their Personal Data:
Right to Nondiscrimination. We will not discriminate against you for exercising your privacy rights. For example, unless permitted by law we will not: (i) deny you goods or services; (ii) charge you different prices or rates for goods or services; (iii) provide you a different level or quality of goods or services; (iv) retaliate against you as an employee, applicant for employment, or independent contractor for exercising your privacy rights; or (v) suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services, because you exercised a right under applicable privacy laws.
Health Data Rights. Some state laws entitle consumers to certain details about health data collected about them, including (i) confirmation of whether the entity collects, shares, or sells the consumer’s health data and access that data, including a list of all third parties and affiliates with whom the entity has shared or sold the health data and a method to contact those third parties, (ii) a method to withdraw consent related to use of health data, and (iii) the right to have their health data be deleted. Graze does not intend to collect any health data. However, if a Bluesky user includes health data in a public post on Bluesky, that health data may be collected and processed as Bluesky Content and may be included in the Feeds generated through our Services. A Bluesky user can request that Graze delete the health data and/or filter it out of future processing by emailing a request to legal@graze.social.
Right to Disclosure of Marketing Information. California’s Shine the Light Act (Civil Code sections 1798.83-1798.84) entitles California residents to request certain disclosures regarding Personal Data sharing with affiliates and/or third parties for marketing purposes.
Consumers may exercise these rights by submitting a verifiable privacy request to legal@graze.social. We will respond within the legally required timeline to the extent the applicable law applies to you and our business activities. If your Privacy Request is not addressed in a timely manner, you can appeal it by contacting legal@graze.social.
This notice of Canadian Privacy Rights relates to Canada’s Personal Data Protection and Electronic Documents Act (“PIPEDA”). This section applies solely to residents of Canada where PIPEDA applies. PIPEDA grants specific rights regarding Personal Data offering details on an identifiable person without the inclusion of name, title, telephone number, and business address of an employee of a business or organization. The following paragraphs describe PIPEDA rights and explain how to exercise those rights.
Right to know why we collect, use, and distribute the Personal Data we process. We have set the required notices in this Privacy Notice. We may provide you with additional notices about other ways we process your Personal Data, such as by sending you a notice via email or by other means of communication.
Right to expect us to collect, use, or disclose Personal Data responsibly and not for any other purpose other than which you consented. We set your expectations in this Privacy Notice and collect express or implied consent at various stages of collection or processing. If we collect or use your Personal Data based on your consent, we will also notify you of any changes and will request your further consent as needed. You may withdraw your consent at any time with reasonable notice by contacting us at legal@graze.social.
Right to accuracy of your Personal Data. Please notify us if your Personal Data on our systems is not current, complete, and accurate. We will reasonably assist you to ensure that your Personal Data is accurate in our systems and with our service providers.
Right to access your Personal Data. Upon written request and identity authentication, we will provide you with copies of your Personal Data under our control, information about the ways in which that information is being used and a description of the individuals and organizations to whom that information has been disclosed. Some Personal Data may be unavailable if we are limited by law or determine there is a potential for infringement on another’s privacy rights. If we must refuse an access request, we will notify you in writing, document the reasons for refusal, and outline further steps that are available to you.
We adopted this section to comply with the General Data Protection Regulations (“GDPR”) and its counterpart regulation applicable to residents of the United Kingdom. This section applies solely to residents of the European Economic Area and the United Kingdom. If you are subject to GDPR protections, you have the following privacy rights:
Right to know how we process your Personal Data. We have set the required notices in this Privacy Notice, and we may provide you with additional notices about other ways we process your Personal Data.
Right to rectify your Personal Data. Please notify us if you become aware that the Personal Data that we hold about you is incorrect or if your information changes and we will update our records.
Right to restrict processing of your Personal Data. You can request that we restrict the processing of your Personal Data if: (i) the data is inaccurate; (ii) the processing is unlawful; (iii) we no longer need the Personal Data; or (iv) you exercise your right to object.
Right to access your Personal Data. You can request to access your Personal Data. Upon request, we will provide you with a copy of your Personal Data, along with details about the types of Personal Data we process, why we process it, and any third parties we work with to collect Personal Data on our behalf. We may have one or more legally valid reasons to refuse your request in whole or in part, for example, to protect the rights of other individuals.
Right to erasure (a.k.a. the “right to be forgotten”). Upon request, we will delete your Personal Data under certain circumstances and where required by law. This right is not absolute, and we may be entitled to retain and process your Personal Data despite your request. If you make this request, we balance certain legal, contractual, and business interests against your right to request the deletion of your Personal Data.
Right to data portability. In some circumstances, we are required to provide your Personal Data to another organization at your request and in a structured, commonly used machine-readable format, so that the other organization can read and use it.
Right to object to certain processing of your Personal Data. Upon your request, and in certain circumstances and where we are required to do so by law, we will limit our processing of your Personal Data as you request.
Right to not be subject to Automated Decision-Making (“ADM”). Graze does not use ADM in a manner that produces legal effects concerning or significantly affecting any individual.
If you are subject to GDPR protections and you believe we are unlawfully processing your Personal Data, you have the right to complain to your local data protection supervisory authority. If you are a resident in Switzerland, you have the right to complain to the Swiss data protection authorities.
In addition to the above notices of privacy rights and details about our privacy practices described in this Privacy Notice, Graze provides the following supplemental notices of privacy practices for the jurisdictions listed below:
Graze has implemented and maintains reasonable and appropriate security procedures and practices to help protect your Personal Data from unauthorized or illegal access, destruction, use, modification, or disclosure. Our security measures are appropriate to the volume, scope, and nature of the Personal Data processed and designed to meet our duty of care with respect to your Personal Data. The Services are designed with data security in mind to continuously protect your data and our systems. Graze maintains internal policies to govern the collection, processing, and handling of data. Access to Personal Data is limited to employees and contractors as needed to perform their job functions. Anyone with this access is subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations. We also ensure that our employees, contractors, and agents responsible for handling privacy inquiries are informed of applicable legal requirements and we restrict access to those who need that information to process it.
Please note that no transmission of data over the internet is 100% secure, and Graze cannot guarantee that unauthorized third parties will not defeat our security measures or use your Personal Data for improper purposes. Users are responsible for maintaining the confidentiality of their login credentials and account access.
Graze is owned and operated in the United States. We use technical infrastructure in the United States and other jurisdictions to provide our Services to Users wherever they are located. This means data must sometimes be transferred across jurisdictional boundaries. When your information is moved from your home country to another country, the laws and rules that protect your Personal Data in the country to which your information is transferred may be different from those of the country where you live. For example, if your information is in the United States, it may be accessed by government authorities in accordance with U.S. law.
Graze is committed to transferring Personal Data using a lawful data transfer mechanism. Specifically, when we transmit data from the EU, UK, or Switzerland to the U.S. or other jurisdictions, we do so pursuant to the standard contract clauses approved by the European Commission and employ those security measures required by the country in question to secure the data. Any such transfer is performed on the legal basis that the transfer is necessary to provide you with the Services.
Graze does not warrant that the Services are appropriate or authorized for use in any other jurisdictions. Each User is solely responsible for determining whether their use of our Services complies with applicable laws. Your use of our Services constitutes your consent to the transfer and processing of your Personal Data as described in this section.
The Services are available via integrations with Bluesky and third-party websites or platforms. Graze is not responsible for and has no ability to control the privacy and data collection, use, and disclosure practices of any third party. Use of third-party websites or platforms is subject to the third party’s privacy policies and practices, not ours. Graze has no control over any third party’s privacy practices. Please review the privacy policies of such websites and platforms before submitting any information.
For Data Brokers, Privacy Services, and Authorized Agents
If you are a data broker, data removal service provider, authorized agent, or privacy compliance service acting on behalf of individuals to submit data removal requests, we provide a dedicated API endpoint to streamline the processing of such requests.
Please note: To ensure efficient processing and avoid unnecessary manual review, we require that all bulk or automated removal requests from third-party services be submitted through our designated API endpoint rather than through standard support channels or web forms.
API Documentation and Implementation
Complete technical documentation for our privacy compliance API, including request formatting, authentication requirements, and response handling, is available at:
https://www.graze.social/docs/api-documentation-privacy-compliance-endpoints
Requirements for Third-Party Services
Organizations submitting requests on behalf of users must:
Processing Timeline
Requests submitted through the API are processed automatically where possible, with manual review conducted as necessary. We aim to comply with all valid removal requests within the timeframes required by applicable law.
For questions regarding API access or technical implementation, please contact our privacy team at legal@graze.social.
Note: This streamlined process is designed to facilitate compliance with data protection regulations while ensuring the security and integrity of our systems. Individual users seeking to exercise their privacy rights should continue to use our standard data removal request process outlined above.
Pursuant to the California Consumer Privacy Act, Graze Social PBC provides the following Consumer Requests Metrics. “Requests” refers to all of the following type of requests: