Grit

Privacy Policy

Grit Solutions Group LLC | Effective date October 3, 2026

Contents

1. Who we are and what this policy covers

Grit Solutions Group LLC (Grit, we, us, or our) operates the Grit, Grit Tracks, Grit Ops, and Grit Equipment IQ offerings identified as ours. This Policy describes our handling of personal information through gritinc.co, grit-tracks.com, other Grit-operated websites that link to this Policy, related customer portals, purchases, inquiries, warranty claims, communications, and business services. Personal information means information identifying or reasonably linked to an individual or household, as defined by applicable law. Business contact information may also be personal information.

This Policy is a notice about our practices, not consent to every form of processing and not a waiver of your rights. Where law requires consent, we request it separately. Independent platforms and businesses have their own notices. Where we process a client's employee or customer information only on that client's instructions, the client's privacy notice and our applicable data processing agreement also govern that processing. This Policy does not replace a required employee or applicant privacy notice.

2. Information you provide

We collect contact and account information such as name, company, role, email, telephone number, billing and delivery addresses, and account credentials where an account is offered. We collect order and commercial information such as products considered or purchased, quotations, invoices, payments, returns, tax-exemption records, and warranty history. We collect payment-related information necessary to administer a transaction, which may include processor transaction identifiers, payment status, and masked payment details. Payment credentials entered into a processor's hosted checkout are handled by that processor under its notice.

For fitment, sourcing, fleet support, and warranty review, we collect information you submit about equipment make, model, serial numbers, track sizes and serial stamps, hour readings, photographs, installation, maintenance, failures, and delivery locations. Equipment records can identify a person when linked to an owner or contact. Communications may include email, text, voicemail, attachments, support requests, and reviews. We retain voicemail you choose to leave; this does not mean all live calls are recorded.

For contracted business support, information can include authorized vendor and customer contacts, inventory records, work orders, dispatch details, project records, and operational or financial records within the agreed scope. We do not request unnecessary sensitive personal information. Do not send full payment credentials, Social Security numbers, medical records, or unrelated private information through ordinary email, text, or public forms. If an engagement requires sensitive information, we agree on an appropriate authorized collection method first.

3. Information collected automatically and from others

Our websites and their providers may collect IP address, approximate location inferred from IP address, device and browser information, pages viewed, timestamps, referring pages, interaction events, cookie identifiers, and security logs. These records support website operation, security, and built-in usage measurement. QR service requests may associate a submitted request with a machine or service record. They do not, by themselves, authorize GPS or continuous location monitoring.

We receive information from hosting and ecommerce providers, payment processors, carriers, manufacturers and suppliers, authorized service providers, clients, and public business sources when relevant to a request or transaction. Examples include payment and fraud status, shipment tracking and delivery confirmation, supplier availability, and warranty review results. If someone provides another person's information, we expect them to have a lawful basis to share it and to provide required notice.

4. How we use information

We use information to respond to inquiries; verify fitment details; prepare quotations; process and fulfill orders; administer payment, tax, shipping, returns, and warranties; create and secure accounts; provide authorized operations and fleet services; communicate service updates; and maintain business records. We also use it to troubleshoot and improve our websites and services, measure basic website use, prevent fraud and abuse, protect safety and legal rights, and comply with legal duties.

We may send relevant email about our offerings where lawful, subject to your unsubscribe choices. A marketing opt-out does not prevent necessary order, security, warranty, or legal communications. We do not use client-confidential records for public case studies or testimonials without permission. If we materially change the purposes of processing, we provide any required notice and obtain required consent before the new use.

5. How we disclose information

We disclose relevant information to service providers assisting with hosting, ecommerce, payments, accounting, communications, security, and business administration, subject to appropriate restrictions where required. We disclose delivery information to carriers and fulfillment partners, and equipment and claim information to suppliers, manufacturers, or service providers as needed for sourcing, fitment, fulfillment, or warranty review. These businesses receive only information reasonably relevant to their roles; some also process information independently for their own legal, security, or transaction purposes under their privacy notices.

Where used for your transaction, GoDaddy or its commerce and payment services and Stripe may process information as website, commerce, or payment providers. Other covered websites may use different disclosed providers. Our sharing for payment processing does not mean we control a bank's or processor's separate processing. You can review GoDaddy's Privacy Policy at https://www.godaddy.com/legal/agreements/privacy-policy and Stripe's Privacy Policy at https://stripe.com/privacy.

We may disclose information to professional advisers and insurers, to a client or organization you represent within an authorized engagement, when directed by you, or when reasonably necessary to comply with law or valid legal process, investigate fraud, enforce agreements, or protect rights and safety. In a proposed or completed merger, acquisition, financing, restructuring, or asset transfer, information may be disclosed under appropriate confidentiality and legal protections. A successor must handle transferred information consistently with applicable law and provide required notices of changes.

Public reviews or posts may be visible to others when you choose to submit them for publication. Do not include information you intend to keep private. We do not sell personal information for money. We do not use advertising pixels or retargeting to disclose personal information for cross-context behavioral advertising or targeted advertising. Where a provider's processing constitutes a sale, sharing, or targeted advertising under applicable law, we apply the legally required notice, choice, and contractual controls. We do not give mobile opt-in information or consent records to third parties for their own marketing or promotional purposes. Limited disclosure to providers delivering our authorized messages is permitted subject to appropriate restrictions.

6. Cookies and similar technologies

Cookies and comparable tools may support cart and checkout functions, account sessions, preferences, fraud prevention, security, and built-in website analytics. Essential tools may be needed for a requested feature. Nonessential tools are subject to any legally required consent or opt-out. We do not currently deploy separate advertising pixels or retargeting tools. An independent checkout or embedded service may use its own technologies; its notice and any applicable controls also apply.

You may adjust browser settings to block or delete cookies, though doing so can affect functionality. Where our website offers cookie controls, use them to manage available categories. Blocking cookies on one browser does not necessarily change settings on another browser or device. Where law requires us to recognize a valid universal opt-out preference signal, including Global Privacy Control, we treat it as a request to opt out of applicable sale, sharing, or targeted advertising associated with that browser and, where required and technically identifiable, the linked profile. A generic Do Not Track setting is different and may not produce the same result. Consent-required nonessential tools will not be enabled before the required consent.

7. Email phone and text messages

We use contact details to respond to requests and provide transaction-related communications. Providing a telephone number or accepting website Terms alone does not authorize automated promotional texts or calls. If we offer promotional SMS or automated marketing calls, we obtain the required separate consent and disclose the program terms before enrollment. Marketing consent is not a condition of purchase.

You may unsubscribe from marketing email through its unsubscribe link or contact [email protected]. For an enabled SMS program, message frequency varies and message and data rates may apply; reply STOP to opt out or HELP for assistance, or email us. We honor other reasonable opt-out methods as required by law. After an opt-out, we may send a permitted confirmation and will stop covered messages within legally required timeframes. We do not condition these choices on creating an account or paying a fee.

8. Retention

We retain information only as reasonably needed for the purposes described and applicable legal requirements. Retention depends on information type, the relationship, order and warranty history, tax and accounting obligations, dispute periods, security needs, and contractual instructions. Order, tax, authorization, and claim records can be retained beyond account closure where needed for those purposes. Marketing suppression records may be retained to honor your opt-out. Client-controlled data is returned or deleted according to the engagement and legal obligations. Deleted information may remain in restricted backups until ordinary backup expiration, without restoration to ordinary use except for legitimate recovery or legal purposes.

9. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the information and service, such as access restrictions and protections offered by our authorized systems and providers. No website, email system, or transmission method is completely secure. We cannot promise absolute security. You should protect account credentials, use available authentication safeguards, and contact us about suspected misuse. We investigate incidents and provide legally required notifications when applicable. This section does not disclaim our legal security obligations.

10. Your choices and privacy rights

You may ask about our information practices, request correction of contact or equipment information, and change marketing preferences by contacting [email protected]. Depending on your residence, the information, and whether a law applies to Grit, you may have rights to access or know personal information and disclosure categories; obtain a portable copy; correct inaccuracies; delete information; opt out of sale, sharing, targeted advertising, or certain profiling; limit specified uses of sensitive information; withdraw consent; or appeal a denied request. We will not unlawfully discriminate for exercising protected rights. Deletion or withdrawal may affect a service that requires the information but does not waive your other rights.

Send a request to [email protected] with the subject Privacy Request. Identify your request and provide enough information for us to locate relevant records. We use reasonable identity and, where needed, authorized-agent verification proportionate to the request; we do not request unnecessary identification. Opt-out requests are not subject to burdensome verification where law prohibits it. We respond within the applicable statutory period, explain permitted extensions, and explain any denial and available appeal. To appeal, email the same address with the subject Privacy Appeal. You may contact the appropriate regulator where a law provides that right.

Information may be retained or withheld where an applicable exception permits it, such as security, completing a requested transaction, tax obligations, legal claims, or another person's rights. If your information is processed solely for our client, we may direct your request to that client and assist as required. Processor or platform information controlled independently should also be requested from that business.

11. State privacy disclosures

For residents whose state privacy law applies to Grit, the categories of personal information, sources, purposes, recipient categories, and retention criteria are described in Sections 2 through 8. They include identifiers and contact details; account and transaction records; commercial and equipment records associated with individuals; internet or device activity; approximate location; professional information; and submitted communications, photographs, or voicemail. These categories may have been collected or disclosed during the prior 12 months to the extent you interacted with the relevant offering. We do not knowingly sell or share personal information of minors under 16.

We do not use sensitive personal information to infer personal characteristics or for unrelated advertising. Payment processors may handle financial credentials for requested transactions. Grit does not use solely automated profiling to make decisions producing legal or similarly significant effects about you. Automated transaction-security screening by a provider can affect payment acceptance; contact us if a legitimate order is declined. Applicable privacy rights, including rights concerning automated decisions where provided, are addressed through the request procedure above. These disclosures do not imply that every state privacy law applies to Grit; applicable thresholds and exceptions determine coverage.

12. Children and visitors outside the United States

Our websites and business services are directed to adults and are not intended for children under 18. We do not knowingly collect personal information from children under 18. Contact us if you believe a child supplied information so we can investigate and delete it where required. Purchases and service contracts require an adult authorized to contract.

Our business operates in the United States, and information may be processed there and in countries where authorized providers operate. Laws and protections may differ from those where you live. Visiting a website does not waive legally required transfer safeguards. If a law outside the United States applies to our processing, we comply with its applicable requirements, including required transfer safeguards and lawful grounds. We do not rely solely on website visitation as international-transfer consent.

13. Changes and contact

We may update this Policy to reflect actual practices or legal requirements and will revise its effective date. Material changes receive additional notice where required, and we obtain new consent when required before applying a new practice. Existing rights and legally required restrictions continue to apply.

Privacy questions, requests, and appeals: [email protected] or by calling 586-819-9012. For information controlled independently by a payment provider, carrier, marketplace, or other business, consult that business's privacy notice as well.