Buy Own Build, Inc. (DBA GroundUp) | Effective September 2, 2026 | Version 1.0
This Policy explains how GroundUp handles personal information. It is a notice, not a contract. At first login, users acknowledge receiving it. Separate affirmative consent is requested when law requires consent or GroundUp proposes an optional material secondary use.
AT A GLANCE
GroundUp uses personal information to provide, secure, support, and improve its property-development and manufacturer-partner Platform.
GroundUp does not use non-public project data or personal information to train a general-purpose or foundation model without separate, affirmative opt-in consent.
When GroundUp processes personal information solely for a business customer, that customer generally controls the purpose and GroundUp follows the customer's lawful instructions.
You may have rights to access, correct, delete, obtain, or limit use of personal information, depending on where you live and GroundUp's role.
1. Scope and roles
This Policy applies to GroundUp websites, applications, accounts, communications, events, sales and support activity, and related services that link to it. GroundUp means Buy Own Build, Inc., a Delaware corporation doing business as GroundUp. GroundUp is a controller or business when it decides why and how to use information for accounts, websites, sales, security, billing, and its own operations. GroundUp may be a processor or service provider when it handles personal information solely for a business customer under that customer's instructions. If you submit a request about customer-controlled data, GroundUp may direct you to that customer. This Policy does not cover a third party's independent practices, including manufacturers, developers, lenders, contractors, payment providers, mapping providers, or sites linked from the Platform. Their notices apply to their processing.
2. Information we collect
The information depends on how you interact with GroundUp. GroundUp seeks to collect only what is reasonably needed for the stated purpose.
Information categories
| Category | Examples | Main sources |
|---|---|---|
| Identifiers and account data | Name, work email, phone, employer, title, user ID, login and authority confirmation | You, your organization, identity and authentication providers |
| Commercial and project data | Company, project ID, site, order status, product interest, manufacturer, square footage, deposit and production-event records | You, customers, manufacturers, project participants, public records |
| Property and location data | Address, parcel, zoning, site characteristics, approximate or precise location when enabled | You, devices, public and licensed data sources |
| Content and communications | Files, prompts, messages, support requests, survey answers, meeting notes and call recordings when disclosed | You, your organization, communications and support tools |
| Device and usage data | IP address, browser, device, cookies, pages, clicks, logs, session IDs, timestamps and diagnostics | Devices, cookies, analytics, security and hosting providers |
| Financial and transaction data | Billing contact, invoice status, payment token or limited bank-payment metadata | You and payment providers; GroundUp does not need full payment-card numbers |
| Inferences | Likely project fit, preferences, workflow status, fraud or security risk | Derived from the information above |
| Compliance data | Consent and acceptance records, requests, complaints, sanctions checks and audit records | You, systems, advisers, public and compliance sources |
Please do not submit highly sensitive information unless GroundUp expressly requests it and appropriate safeguards are in place.
3. Why we use information
GroundUp uses personal information for the following business purposes:
Create accounts, authenticate users, provide the Platform, route projects, support workflows, and deliver requested outputs.
Communicate about accounts, projects, services, support, security, legal terms, and transactions.
Operate billing, reconciliation, reporting, recordkeeping, and contract administration.
Secure the Platform; prevent fraud, misuse, and unlawful activity; debug; monitor availability; and investigate incidents.
Analyze performance and improve features using information permitted by contract, this Policy, and applicable law.
Personalize lawful business content and measure outreach; honor cookie and marketing choices.
Comply with law, lawful process, professional advice, audits, sanctions, disputes, and enforcement.
Create aggregated or de-identified information and use it for analytics, planning, security, and product improvement without attempting re-identification. Where a legal basis is required, GroundUp relies on contract performance, legitimate interests balanced against individual rights, legal obligations, vital or public interests where applicable, or consent. You may withdraw consent prospectively where consent is the basis.
4. Artificial intelligence and automated processing
Some Platform features may use automated or artificial-intelligence systems to organize information, generate drafts, match projects, identify patterns, or assist workflows. GroundUp does not intend those features to make a solely automated decision that produces legal or similarly significant effects about a person. Human review is required for material decisions. GroundUp will not use non-public project data, customer confidential information, or personal information to train a general-purpose or foundation model unless the relevant customer or individual gives separate, affirmative opt-in consent identifying that use. A user may withdraw an optional opt-in prospectively. GroundUp may use aggregated or de-identified operational data to operate, secure, measure, and improve the Platform if it does not identify a person, organization, customer, or project and GroundUp does not attempt re-identification. If an external model provider processes content for a Platform feature, GroundUp will use contractual and technical controls appropriate to the service and will not authorize the provider to use customer content for its own model training except where separately disclosed and affirmatively approved. Privacy Policy | September 3, 2026 Page 2
5. How we disclose information
GroundUp may disclose only the information reasonably needed for the stated purpose to:
Your organization, Authorized Users, and project participants you direct GroundUp to involve.
Manufacturers, developers, consultants, and other counterparties when needed to evaluate or perform a requested project, subject to applicable agreements and permissions.
Hosting, security, analytics, communications, support, payment, professional, and other vendors that process information for GroundUp under appropriate restrictions.
Government, regulators, courts, and others when GroundUp reasonably believes disclosure is required by law or needed to protect rights, safety, security, or the integrity of the Platform.
A buyer, investor, lender, affiliate, or successor in a financing, merger, restructuring, or sale, subject to confidentiality and applicable notice requirements.
Other recipients at your direction or with your consent. GroundUp does not sell personal information for money. GroundUp does not knowingly share personal information for cross-context behavioral advertising. If a future practice is treated as a sale or sharing under applicable law, GroundUp will provide required notice and a method to opt out before that practice begins.
6. Cookies, analytics, and communications
GroundUp and its providers may use necessary cookies, local storage, pixels, and similar tools for login, preferences, security, diagnostics, analytics, and lawful outreach. Where required, non-essential tools are used only after the required choice. Browser settings may limit cookies but can affect features. You may unsubscribe from promotional email through the message link or by contacting GroundUp. GroundUp may still send transactional, security, contractual, or service messages. GroundUp honors legally required browser or universal opt-out signals for covered processing when technically recognized and applicable.
7. Retention
GroundUp keeps personal information only as long as reasonably needed for the purpose collected, the customer relationship, security, backups, dispute and claims periods, accounting, audit, and legal obligations. Retention considers the amount, sensitivity, context, risk, contract requirements, and whether GroundUp can use a less identifiable form. Typical records may be kept as follows unless a longer or shorter period is required: account and contract records for the relationship plus applicable claims periods; first-login acceptance records for the account life plus the applicable claims period; project and payment-verification records under the relevant agreement; security logs based on operational need; and backups until rotated under standard schedules. When GroundUp no longer needs information, it deletes, de-identifies, or securely isolates it.
8. Security
GroundUp uses reasonable administrative, technical, and physical safeguards designed for the nature and risk of the information. Measures may include access controls, least privilege, authentication, encryption in transit, secure development and change management, vulnerability management, logging, backups, vendor review, personnel duties, and incident response. No system is completely secure. You should use unique credentials, enable available security features, protect devices, verify payment-instruction changes through a known channel, and promptly report suspected unauthorized access to admin@trygroundup.ai. Privacy Policy | September 3, 2026 Page 3
9. Your privacy choices and rights
Depending on your location, GroundUp's role, and applicable exceptions, you may ask to access, confirm, correct, delete, or obtain a portable copy of personal information; limit or object to certain processing; opt out of covered sale, sharing, targeted advertising, profiling, or automated decisions; withdraw consent; or appeal a denied request. GroundUp will not unlawfully discriminate against you for exercising a right. Send a request to admin@trygroundup.ai with the subject Privacy Request. Describe the right and the account, organization, or interaction involved. GroundUp will verify the request proportionately and may ask for information needed to prevent unauthorized disclosure. An authorized agent may submit a request where law permits, subject to proof of authority and identity. If GroundUp acts only for a customer, GroundUp may forward the request to that customer or tell you how to contact it. If GroundUp denies a request and local law provides an appeal, reply with Privacy Appeal. You may also contact the privacy or data-protection regulator where you live. GroundUp responds within legally required periods and will explain applicable exceptions.
10. U.S. state disclosures
The categories collected, sources, purposes, and recipients are described in Sections 2, 3, and 5. GroundUp does not use or disclose sensitive personal information to infer characteristics except as reasonably necessary to provide requested services, protect security, or as otherwise permitted by applicable law. For California residents, the listed categories correspond generally to identifiers; commercial information; internet or electronic activity; geolocation; professional information; inferences; and, only when necessary, limited sensitive information such as account credentials or precise location. GroundUp retains each category under Section 7. GroundUp does not knowingly sell or share personal information of people under 16.
11. International transfers
GroundUp is based in the United States and its providers may process information in the United States and other countries. Those countries may have different privacy laws. When required, GroundUp uses recognized transfer safeguards, such as approved contractual clauses, transfer assessments, or another lawful mechanism. Contact GroundUp to request information about an applicable safeguard.
12. Children
The Platform is for business users and is not directed to children under 13. GroundUp does not knowingly collect personal information from a child under 13. If you believe a child supplied information, contact GroundUp so it can investigate and take appropriate action. Higher local age thresholds apply where required.
13. Changes to this Policy
GroundUp may update this Policy to reflect changed practices, services, or law. GroundUp will post the new effective date and provide additional notice when a change is material or law requires. A policy update applies prospectively. GroundUp will not rely on a silent policy change to authorize a new material secondary use of previously collected personal information; it will provide notice and obtain affirmative consent where required.
14. Contact
Privacy questions and requests: admin@trygroundup.ai. Buy Own Build, Inc. (DBA GroundUp), 8 The Green, Ste A, Dover, DE 19901. Privacy Policy | September 3, 2026 Page 4