Privacy Policy

This Privacy Policy explains how Foundry & Grit, LLC (“Foundry & Grit,” “we,” “us,” or “our”) handles personal information in connection with Fossaris, our dealership software platform, websites, applications, communications services, digital wallet passes, and related services (collectively, the “Services”).

The short version

Fossaris helps automobile dealerships communicate with their customers, manage customer engagement, create and distribute offers and digital wallet passes, send authorized email and text communications, manage dealership content and media, and track engagement, activity, and redemption.

Dealerships generally determine which customer information is placed into Fossaris and how that information is used through the Services.

We do not sell personal information.

We do not rent personal information.

We do not sell, rent, or share mobile telephone numbers, SMS consent, or text-messaging opt-in data with third parties or affiliates for their own marketing or promotional purposes.

We do not use one dealership’s customer information to market another dealership’s products or services.

1. Who is responsible for your information

Dealership customer information

When Fossaris processes personal information that a participating dealership provides or directs us to process, the dealership generally determines the purposes for which that information is used. Foundry & Grit generally acts as a service provider or processor on behalf of that dealership.

For example, the dealership determines which customers it communicates with, what offers or campaigns it wishes to conduct, what dealership content is published, and which employees are permitted to use Fossaris.

The dealership remains responsible for its own compliance with laws governing its customer relationships, including applicable privacy, consumer-protection, financial-privacy, advertising, email, and telecommunications laws.

Fossaris does not replace any privacy notice a dealership may separately be required to provide, including a notice required under the Gramm-Leach-Bliley Act or other financial-privacy laws.

Information Foundry & Grit handles for its own operations

Foundry & Grit may independently determine how certain limited information is used when necessary to operate and protect Fossaris and our business. This may include dealership account information, business-contact information, authentication information, security and audit records, system logs, support communications, fraud and abuse-prevention information, and records necessary to comply with law or enforce our agreements.

2. Information we may process

The information processed through Fossaris depends on the features a dealership chooses to use.

Dealership customer information

A dealership may provide, upload, import, create, or authorize Fossaris to process information such as:

• name;
• email address;
• telephone or mobile number;
• mailing address;
• customer, lead, or CRM identifiers;
• vehicle information, including year, make, model, VIN, ownership, or lease information where supplied;
• sales, service, ownership, and customer-relationship information;
• dealership, salesperson, service advisor, or other staff relationships;
• lead and inquiry information;
• appointment information;
• communication preferences;
• email and text-message consent information;
• consent source, date, time, method, scope, and related records;
• unsubscribe, STOP, suppression, and other communication-preference records;
• communications sent through Fossaris and associated delivery information;
• replies and responses received through supported communication channels;
• offers, campaigns, coupons, and digital wallet passes associated with the customer;
• information about communications or offers being sent, delivered, opened, viewed, saved, played, redeemed, expired, cancelled, suppressed, or otherwise acted upon, where available;
• redemption information;
• customer-submitted information provided through an enabled Fossaris feature; and
• other information supplied by a dealership through an enabled Fossaris feature or authorized integration.

Dealership staff information

We may process information concerning dealership employees and other authorized users, including:

• name;
• work email address;
• work telephone number;
• dealership and location;
• job title and role;
• profile photograph or headshot;
• account status;
• authentication and security information;
• permissions and administrative roles;
• content created or uploaded by the user;
• communications and campaigns initiated by the user;
• approvals and administrative actions;
• login, security, and audit events; and
• other actions performed through Fossaris.

Media and content

Fossaris may permit dealerships, customers, or authorized users, depending on the feature, to create, submit, upload, store, distribute, or manage content such as:

• photographs;
• dealership logos and artwork;
• customer-facing graphics;
• videos;
• video thumbnails and previews;
• vehicle walk-around videos;
• customer-submitted vehicle videos;
• appraisal-related photographs, videos, and information;
• message templates;
• email content;
• text-message content;
• offers and campaign content; and
• other dealership-created or customer-submitted materials.

Dealerships and users are responsible for ensuring they have the rights and authority necessary to submit content to Fossaris.

Information from integrations

When a dealership enables an integration with a customer relationship management system, dealership management system, communications provider, wallet provider, or other supported service, Fossaris may exchange information with that system as necessary to provide the enabled functionality.

The information exchanged depends on the integration and the dealership’s configuration.

Where supported, activities performed through Fossaris may also be recorded in a dealership’s customer-management system so that the dealership maintains an appropriate record of customer communications and activity.

Technical and security information

When someone accesses Fossaris or a Fossaris-hosted page, we may automatically process limited technical information necessary to provide, protect, and maintain the Services, such as:

• IP address;
• browser and device information;
• session information;
• authentication events;
• date and time of access;
• requested application resources;
• security events;
• error and diagnostic information; and
• audit records.

We use this information for authentication, security, troubleshooting, abuse prevention, reliability, compliance, and administration of the Services.

3. Information Fossaris is not intended to collect

Fossaris is not designed to collect or store:

• Social Security numbers;
• consumer credit reports;
• credit applications;
• bank-account credentials;
• payment-card numbers;
• driver’s license images or numbers;
• dealership customer passwords;
• medical records; or
• other highly sensitive information unnecessary for Fossaris functionality.

Dealerships, customers, and users should not upload this information unless Foundry & Grit has expressly introduced and authorized a feature designed to process it.

4. How we use information

Depending on the Fossaris features a dealership uses, information may be processed to:

• create, administer, distribute, and redeem dealership offers and coupons;
• generate Apple Wallet and Google Wallet passes;
• distribute passes and offers through supported channels;
• send dealership-authorized email communications;
• send dealership-authorized SMS or MMS communications;
• manage individual and campaign communications;
• respond to customer communications;
• manage and document communication consent and preferences;
• maintain suppression and opt-out records;
• prevent communications to recipients who have opted out;
• create, store, deliver, and manage videos and other media;
• facilitate customer-to-dealership video or information submissions;
• facilitate vehicle appraisal or “sell us your vehicle” inquiries where offered;
• provide customer-facing pages associated with dealership content;
• record engagement with dealership communications, videos, passes, and offers;
• maintain customer and dealership activity history;
• synchronize permitted information with dealership systems and authorized integrations;
• provide dealership reporting and operational analytics;
• attribute actions to authorized dealership users;
• manage employee accounts and permissions;
• authenticate users;
• detect and prevent fraud, abuse, unauthorized access, and security incidents;
• diagnose errors and maintain system reliability;
• provide customer and dealership support;
• enforce our agreements and acceptable-use requirements;
• comply with legal obligations; and
• protect the rights, safety, security, and integrity of Foundry & Grit, participating dealerships, customers, and others.

5. SMS Communications

Fossaris may enable participating dealerships to send SMS or MMS text messages to their customers using telecommunications and messaging service providers.

If you choose to receive text messages from a dealership using Fossaris, we and the dealership may collect and use your mobile telephone number, messaging preferences, consent status, consent records, opt-out status, and related communication information to provide, administer, and document the messages you requested or agreed to receive.

Types of messages

Text messages sent through Fossaris may include communications regarding:

• vehicle inquiries;
• inventory availability;
• vehicle pricing;
• incentives and dealership offers;
• sales follow-up;
• appointment confirmations and reminders;
• service information and reminders;
• coupons and digital offers;
• customer-requested information; and
• other dealership communications that the recipient has requested, consented to receive, or that may otherwise lawfully be sent.

Consent to receive marketing text messages

Marketing text messages may be sent through Fossaris only after the customer provides the consent required by applicable law and applicable messaging-provider requirements.

Consent may be obtained through an affirmative opt-in process, including an in-person or telephone conversation with an authorized dealership representative that is appropriately documented by the dealership, a written or electronic consent process, an affirmative SMS opt-in process such as replying YES to a consent request, or another method permitted by applicable law and Fossaris messaging requirements.

Where required, Fossaris or the dealership may maintain records showing when, where, and how consent was obtained, the telephone number to which the consent applies, the dealership or sender for whom consent was provided, the type or scope of communications authorized, and the disclosure associated with that consent.

Providing a mobile telephone number, submitting an inquiry or lead, purchasing or servicing a vehicle, appearing in a dealership’s customer database, or having a previous business or customer relationship with a dealership does not by itself constitute consent to receive marketing text messages.

Consent to receive marketing text messages is voluntary and is not a condition of purchasing any goods or services.

Message frequency and charges

Message frequency varies depending on the dealership, the communications or programs to which the customer has consented, and the customer’s interactions with the dealership.

Message and data rates may apply.

Wireless carriers are not responsible for delayed or undelivered messages.

Opting out of text messages

You may withdraw your consent to receive text messages at any time.

Reply STOP to a supported dealership messaging number to opt out of applicable further text messages.

Fossaris also recognizes other legally required expressions of revocation, including QUIT, END, REVOKE, OPT OUT, CANCEL, and UNSUBSCRIBE, and may recognize other words or statements that reasonably communicate that you no longer wish to receive messages.

A valid opt-out request will be processed as promptly as practicable. A single text message confirming the opt-out may be sent where permitted by law.

Opting out of marketing text messages does not necessarily prevent a dealership from sending communications that are legally considered transactional or otherwise permitted without the withdrawn marketing consent.

Help

For assistance, reply HELP to a supported dealership messaging number or contact the dealership identified in the message using the contact information provided by that dealership.

Because Fossaris is used by multiple dealerships, dealership-specific telephone numbers and contact information are provided in the applicable messaging program or communication rather than in this Privacy Policy.

Mobile information and SMS consent

Mobile information, including mobile telephone numbers, SMS consent, and text-messaging opt-in data, will not be sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes.

We may disclose mobile information to service providers, telecommunications providers, carriers, messaging aggregators, and other vendors that assist Foundry & Grit or participating dealerships in providing SMS or MMS communications, but only as reasonably necessary for them to provide those services, maintain messaging compliance, prevent fraud or abuse, or as otherwise required by law.

Those service providers are not authorized by us to use mobile information, SMS consent, or opt-in data for their own marketing or promotional purposes.

Consent and opt-out records

To operate the messaging service, protect customers, and demonstrate compliance, Fossaris may maintain records concerning:

• whether consent was provided;
• the telephone number associated with the consent;
• the dealership or sender for whom consent was provided;
• the type and scope of consent;
• the source and method by which consent was obtained;
• the date and time consent was obtained;
• the disclosure or consent language associated with the opt-in;
• subsequent affirmative confirmations such as a YES response;
• revocation and opt-out requests;
• STOP and related keyword events;
• HELP requests;
• messaging suppression status; and
• other information reasonably necessary to administer the messaging service and demonstrate compliance.

An opt-out or suppression record may be retained after other customer information is deleted when retaining the minimum information necessary to prevent future unwanted communications or demonstrate compliance is permitted or required by law.

6. Email communications

Fossaris may allow participating dealerships to send individual and campaign email communications.

The dealership is the business on whose behalf the communication is sent.

Commercial email sent using Fossaris must comply with applicable law, including the CAN-SPAM Act.

Where required, commercial email includes a mechanism allowing recipients to unsubscribe from future marketing email.

Fossaris may maintain suppression information so that opt-out requests can continue to be honored. We design the Services to apply effective unsubscribe requests as promptly as practicable and prohibit participating dealerships from using Fossaris to evade a recipient’s opt-out request.

Transactional or relationship communications may be treated differently where permitted by law.

7. Artificial intelligence features

Fossaris may provide optional artificial-intelligence-assisted features that help authorized dealership users draft, revise, summarize, personalize, or otherwise prepare content such as emails, text messages, campaign content, or other dealership communications.

When such a feature is used, Fossaris may transmit information necessary to perform the requested task to the AI service provider selected or configured for that feature.

Dealership users should not submit sensitive personal information to an AI feature unless the feature expressly requires and permits it.

AI-generated material is intended to assist authorized users. Dealerships remain responsible for reviewing and approving customer-facing content where Fossaris provides such a review or approval workflow.

We do not authorize an AI provider to use dealership customer information for the provider’s independent advertising or marketing purposes.

Additional disclosures may be provided when particular AI providers or features are enabled.

8. Videos, media, and customer submissions

Fossaris may enable dealerships and their authorized users to create, upload, store, and send videos and other media. Depending on the feature, customers may also be invited to submit photographs, videos, vehicle information, or other information to a dealership.

Examples may include salesperson introductions, vehicle walk-around videos, dealership educational videos, Financial Services information, customer-requested vehicle videos, trade-in information, or information submitted when a customer wishes to sell a vehicle to a dealership.

When a customer submits information through one of these features, Fossaris processes that information on behalf of the dealership receiving the submission.

Fossaris may collect information concerning interaction with hosted media, such as whether a video was accessed, viewed, or played and, where supported, information concerning viewing duration or engagement. This information may be made available to the dealership and its authorized users.

Media may be subject to feature-specific expiration, archival, or deletion periods.

Customers should not include sensitive information in photographs, videos, or other submissions unless it is necessary for the dealership interaction and the feature expressly requests it.

9. Digital wallet passes

Fossaris can create digital passes for services such as Apple Wallet and Google Wallet.

When a customer chooses to add a pass, information necessary to create, store, display, update, or manage that pass may be processed by Apple or Google under their respective terms and privacy policies.

Depending on the pass and dealership configuration, this information may include the dealership, offer, expiration date, customer-related pass information, coupon or pass identifier, and other information displayed by or necessary to operate the pass.

Wallet platforms may use pass information, including relevant dates or dealership locations, to determine when a pass may be relevant on a customer’s device. That functionality is performed through the wallet platform and does not mean Fossaris continuously tracks the customer’s physical location.

When a wallet pass supports updates, the wallet provider may provide technical device-registration or push-notification information necessary to deliver those updates.

Fossaris does not use digital wallet passes to create advertising profiles or continuously track a customer’s movements.

10. Reporting, analytics, and engagement information

Fossaris provides participating dealerships with operational reporting concerning their own activity.

Depending on enabled features, reporting may include:

• communications sent;
• delivery or failure status;
• customer engagement;
• offers issued;
• wallet passes created or saved;
• coupon redemptions;
• campaign performance;
• video engagement;
• employee activity; and
• aggregate operational statistics.

A dealership’s customer-level information is not made available to an unrelated dealership for that dealership’s marketing.

Foundry & Grit may use aggregated or de-identified information that does not reasonably identify an individual to operate, secure, measure, understand, and improve Fossaris.

11. Service providers and subprocessors

We use service providers to operate Fossaris. Depending on the features being used, these may include providers of:

• cloud application hosting;
• databases and storage;
• authentication;
• email delivery;
• telecommunications and messaging;
• digital wallet services;
• security and monitoring;
• error diagnostics;
• artificial intelligence services; and
• dealership integrations.

Current significant providers include or may include:

• Vercel — application and website hosting and related infrastructure.
• Supabase — database, authentication, and storage infrastructure.
• Amazon Web Services, including Simple Email Service — infrastructure and email delivery.
• Twilio — SMS/MMS and related telecommunications and messaging services when those features are enabled.
• Apple — Apple Wallet functionality.
• Google — Google Wallet functionality.

Additional integration or AI providers may process information when a dealership elects to enable those features.

Service providers receive information only as reasonably necessary to provide their services, operate Fossaris, maintain compliance and security, or perform an authorized integration. They are subject to applicable contractual or legal restrictions concerning their use of information.

Nothing in this section changes our commitment that mobile telephone numbers, SMS consent, and text-messaging opt-in data will not be sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes.

12. When information may otherwise be disclosed

We may disclose personal information:

• to the dealership that controls or supplied the information;
• to service providers acting on our behalf;
• through an integration authorized by the dealership;
• when directed or authorized by the dealership or affected individual;
• when reasonably necessary to investigate fraud, abuse, or a security incident;
• to protect the rights, property, safety, or security of Foundry & Grit, participating dealerships, customers, or others;
• in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to applicable protections;
• when required by subpoena, court order, legal process, or applicable law; or
• when otherwise permitted by law.

We do not sell dealership customer information.

We do not disclose dealership customer information to data brokers or lead generators for their independent marketing.

The restrictions described in this Privacy Policy concerning mobile information and messaging consent continue to apply.

13. Dealership data separation

Fossaris is designed as a multi-tenant service.

Dealership and tenant records are logically separated and protected through database-level authorization controls and other security measures designed to prevent one tenant from accessing another tenant’s customer information.

Authorized users receive access according to their dealership, tenant, role, account status, and permissions.

14. Security

We maintain administrative, technical, and organizational safeguards appropriate to the nature of the information processed through Fossaris.

These safeguards may include:

• encryption of network traffic in transit;
• database-level tenant access controls;
• role-based authorization;
• authentication controls;
• additional authentication requirements for privileged users;
• session-management protections;
• audit logging;
• server-side enforcement of sensitive operations;
• consent and suppression controls for communications;
• controls intended to prevent unauthorized cross-tenant access;
• security monitoring; and
• incident-response procedures.

Dealerships are responsible for managing their authorized users, promptly disabling access that is no longer appropriate, protecting their own systems and credentials, and using Fossaris consistently with their legal and security obligations.

No information system can be guaranteed to be completely secure.

15. Financial information and dealership obligations

Many automobile dealerships are subject to the Gramm-Leach-Bliley Act, the FTC Privacy Rule, the FTC Safeguards Rule, or other financial-privacy requirements because they arrange financing or leasing or conduct other covered financial activities.

Fossaris is not intended to replace a dealership’s GLBA privacy notice, information-security program, or other regulatory obligations.

Where information processed by Fossaris constitutes protected customer information under applicable financial-privacy law, Foundry & Grit will handle that information in accordance with its contractual obligations as a service provider and applicable law.

Dealerships should configure their use of Fossaris so that information unnecessary for the Fossaris service—particularly Social Security numbers, credit applications, consumer credit reports, banking information, and similar financial information—is not imported or uploaded into Fossaris.

16. Data retention

We retain information for as long as reasonably necessary for the purposes for which it was collected or processed, subject to applicable legal and contractual requirements.

Retention periods may differ depending on the type of information and the Fossaris feature involved.

Certain videos, media, offers, passes, temporary uploads, or other feature-specific content may have shorter retention, expiration, archival, or deletion periods.

Customer and dealership operational information may be retained while the dealership’s Fossaris account remains active and for an appropriate period afterward to permit account closure, reporting, legal compliance, dispute resolution, security, backup expiration, and orderly deletion.

Communication-consent, suppression, opt-out, security, audit, transaction, and similar compliance records may be retained longer when reasonably necessary to demonstrate compliance, prevent unwanted communications, investigate security incidents, enforce agreements, resolve disputes, or satisfy legal obligations.

When information is no longer required, we delete, de-identify, or otherwise dispose of it in accordance with applicable requirements and our retention procedures.

17. Security incidents and breach notification

We maintain procedures for investigating suspected unauthorized access to personal information.

If Foundry & Grit determines that an incident requires notice to a participating dealership under applicable law or contract, we will provide notice within the applicable required period.

For information subject to the Alabama Data Breach Notification Act, where Foundry & Grit acts as a third-party agent, we will notify the affected covered entity as expeditiously as possible and within the period required by Alabama law after determining that a qualifying breach occurred or reasonably may have occurred.

We will reasonably cooperate with an affected dealership by providing information available to us that the dealership needs to satisfy applicable notification obligations.

Where Foundry & Grit itself has a direct legal obligation to notify affected individuals, governmental authorities, or others, we will provide the required notification in accordance with applicable law.

18. Your privacy choices and rights

Privacy rights vary depending on where you live and the laws applicable to you.

Depending on applicable law, you may have rights concerning access, correction, deletion, portability, restriction, objection, or other treatment of your personal information.

Dealership customers

Because the dealership generally controls its customer records, contacting the dealership is ordinarily the fastest way to exercise a privacy right concerning dealership customer information.

You may also contact Foundry & Grit at team [at] foundryandgritllc [dot] com.

When we receive a request concerning information controlled by a dealership, we may refer the request to that dealership, assist the dealership in responding, or act on the dealership’s instructions.

We may need to verify a request before acting on it.

We will not discriminate against an individual for exercising a privacy right protected by applicable law.

Communication preferences

For marketing email, use the unsubscribe mechanism included in the applicable email.

For text messages, reply STOP or otherwise communicate a valid revocation request using a reasonable available method.

Opting out of marketing communications does not necessarily prevent a dealership from sending communications that are legally considered transactional or otherwise permitted without the withdrawn marketing consent.

19. State privacy rights

Residents of certain U.S. states may have additional privacy rights under their state’s law.

Where an applicable state privacy law grants rights beyond those described here, Foundry & Grit and participating dealerships will process qualifying requests as required by that law and according to their respective legal roles.

Fossaris does not sell personal information.

Fossaris does not use mobile opt-in information or messaging consent for cross-context behavioral advertising.

20. Children

Fossaris is a business service intended for automobile dealerships and their customers and is not directed to children under 13.

We do not knowingly collect personal information directly from children under 13 through Fossaris.

If we learn that personal information from a child under 13 has been collected through the Services contrary to this policy, we will take appropriate steps to delete or otherwise address it.

21. Cookies and similar technologies

Our public informational website may operate without advertising or cross-site tracking technologies.

The authenticated Fossaris application may use cookies, local storage, or similar technologies necessary for authentication, security, session management, user preferences, and operation of the Services.

Customer-facing Fossaris pages may also process technical information necessary to deliver the requested page, content, pass, offer, video, or other functionality.

We do not use Fossaris customer information to create third-party advertising profiles.

If we introduce analytics, advertising, or other technologies that materially change these practices, we will update this Privacy Policy and provide any notice or consent mechanism required by applicable law.

22. Do Not Track and universal privacy signals

Because Fossaris does not engage in third-party cross-site behavioral advertising through the Services, browser “Do Not Track” signals generally do not alter how Fossaris operates.

Where applicable law requires recognition of a legally defined universal opt-out or privacy-control mechanism for a particular processing activity, we will honor that mechanism as required.

23. Business transfers

If Foundry & Grit or Fossaris is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable law and appropriate protections.

Any successor receiving personal information remains subject to applicable law and the commitments applicable to that information.

Mobile telephone numbers and messaging opt-in and consent information will not thereby become available for third-party or affiliate marketing or promotional use.

24. Changes to this Privacy Policy

Fossaris will continue to evolve.

We may update this Privacy Policy when our Services, features, service providers, legal requirements, or information practices change.

The effective date at the top of this Privacy Policy identifies the current version.

If a change materially affects how dealership customer information is processed, we will provide notice to affected participating dealerships or individuals when required by law or when otherwise appropriate.

A dealership’s or user’s continued use of Fossaris does not override any consent that applicable law requires Foundry & Grit or the dealership to obtain separately.

25. Contact us

Questions, privacy requests, or concerns about this Privacy Policy or Fossaris privacy practices may be directed to: