Privacy Policy

Effective Date: September 25, 2026
Company Name: Grizzly Beam LLC
Company Address: 7901 4th St N Ste 300, St. Petersburg, FL 33702, United States
Website: https://grizzlybeam.com/
Email: hello@grizzlybeam.com

1. Introduction and Scope

This Privacy Policy ("Policy") explains how Grizzly Beam LLC ("Grizzly Beam," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information when you visit https://grizzlybeam.com/ (the "Website"), contact us, request a free website audit, book a call, or engage us to provide digital strategy, web design and development, conversion optimization, local SEO and online presence, brand and messaging, ongoing care, or related services (collectively, the "Services").

Grizzly Beam is a Florida limited liability company. We provide our Services exclusively to businesses and not to consumers for personal, family, or household purposes. This Policy therefore primarily concerns the personal information of individuals who interact with us in a business capacity, such as owners, employees, contractors, and representatives of our clients and prospective clients, as well as visitors to our Website.

This Policy is designed to address the requirements of United States federal and state laws that apply to us and, where applicable, the European Union General Data Protection Regulation and the United Kingdom General Data Protection Regulation. Certain sections apply only to individuals located in specific jurisdictions, as indicated in those sections.

This Policy should be read together with our Terms of Service, Refund and Cancellation Policy, and Cookie Policy. By using the Website or the Services, you acknowledge that you have read and understood this Policy. Where applicable law requires your consent for a specific processing activity, we request that consent separately.

2. Definitions

In this Policy, the following terms have the meanings set out below:

"Personal Information" or "Personal Data" means any information that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable natural person.
"Processing" means any operation performed on Personal Information, including collection, recording, organization, storage, use, disclosure, transfer, and deletion.
"Controller" means the party that determines the purposes and means of Processing Personal Information.
"Processor" or "Service Provider" means a party that processes Personal Information on behalf of, and on the documented instructions of, a Controller.
"Client" means a business that has approved an estimate, signed an agreement, or otherwise engaged Grizzly Beam to provide Services.
"Client Materials" means content, data, files, brand assets, access credentials, and other materials that a Client provides to us in connection with the Services.
"End-User Data" means Personal Information relating to a Client's own customers, website visitors, or other individuals that we may access or process while providing Services on behalf of that Client.
"Applicable Data Protection Laws" means all data protection and privacy laws that apply to a given Processing activity, which may include the GDPR, the UK GDPR, and United States federal and state privacy laws.
"GDPR" means Regulation (EU) 2016/679, and "UK GDPR" means the GDPR as retained in the law of the United Kingdom, together with the UK Data Protection Act 2018.

3. Our Role: Controller and Processor

3.1 When We Act as a Controller

We act as the Controller of Personal Information that we collect for our own business purposes, including Website operation, responding to inquiries, preparing free website audits, scheduling and conducting calls, managing Client relationships, billing and payments, marketing, and legal compliance. This Policy governs that Processing.

3.2 When We Act as a Processor

When we build, host, maintain, or optimize a Client's website or digital properties, we may access or process End-User Data, such as submissions to contact forms on the Client's website, analytics data in the Client's accounts, or data stored in the Client's hosting environment. In those cases, the Client is the Controller and we act as a Processor or Service Provider. We process End-User Data only to provide the Services, in accordance with the Client's documented instructions, our agreement with the Client, and, where required by Applicable Data Protection Laws, a data processing agreement.

The Client's own privacy policy, and not this Policy, governs how the Client handles End-User Data. If you are an individual whose data we process on behalf of a Client and you wish to exercise your privacy rights, please contact that Client directly. If we receive such a request, we will, where appropriate and permitted by law, forward it to the relevant Client and assist the Client in responding.

4. Personal Information We Collect

4.1 Information You Provide to Us

Contact and inquiry information: name, business email address, telephone number, company name, job title, website address, and the content of your message.
Free website audit requests: the website address you submit, the email address to which the report should be sent, and any additional information you choose to provide.
Call booking information: name, email address, company name, selected date and time, time zone, information you provide about your business or project, and notes taken during the call.
Client account and project information: names and contact details of Client representatives, project requirements, feedback, approvals, estimates, change requests, and other Client Materials.
Access credentials: login credentials or access permissions for accounts that a Client chooses to share with us, such as domain registrar, hosting, content management system, analytics, and business listing accounts.
Billing and payment information: billing contact name, business name, billing address, invoicing email address, payment method type, and transaction records. Card details are collected and processed directly by our payment processor, as described in Section 7.
Communications: emails, messages, meeting notes, support requests, feedback, and, with your permission, testimonials.
Marketing preferences: your choices regarding receiving marketing communications from us.

4.2 Information Collected Automatically

Device and usage information: IP address, browser type and version, operating system, device type, referring URL, pages viewed, time spent on pages, links clicked, and the date and time of your visit.
Approximate location: general location, such as country, region, or city, derived from your IP address. We do not collect precise geolocation.
Cookies and similar technologies: information collected through cookies, pixels, and similar technologies, as described in our Cookie Policy. Where required by law, non-essential cookies are used only after you provide consent.
Email engagement information: where supported by our email tools, whether an email we sent was delivered or opened and whether links in it were clicked.
Security and server logs: technical records generated when the Website is accessed, used to maintain security and detect misuse.

4.3 Information from Third Parties and Public Sources

Publicly available sources: information about your business that is publicly available, such as your website, search engine results, business listings, business directories, and professional networking profiles. We use this information primarily to prepare website audits, competitor comparisons, and call preparation.
Service providers: information from our scheduling, analytics, and payment service providers, such as booking confirmations, aggregated usage statistics, payment status, and fraud-prevention signals.
Clients: contact information of individuals whom a Client designates as project contacts, approvers, or billing contacts.
Referrals: contact information provided by a person who refers you to us.

4.4 Sensitive Personal Information

We do not intentionally collect sensitive Personal Information, such as government identification numbers, health information, racial or ethnic origin, religious beliefs, or biometric data. Please do not submit such information through the Website or in communications with us.

Login credentials for business accounts that a Client provides may be treated as sensitive Personal Information under certain US state laws. We use such credentials solely to perform the Services requested by the Client, and not to infer characteristics about any individual.

4.5 Consequences of Not Providing Information

Providing Personal Information to us is voluntary. However, if you do not provide certain information, we may be unable to respond to your inquiry, deliver a website audit, schedule a call, prepare an estimate, process payments, or perform the Services.

5. How We Use Personal Information and Our Legal Bases

We use Personal Information for the purposes described below. Where the GDPR or UK GDPR applies, we rely on the legal basis indicated for each purpose.

Responding to inquiries and providing requested information. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in responding to business inquiries.
Preparing and delivering free website audits. Legal basis: steps taken at your request, and our legitimate interest in demonstrating our expertise to prospective clients.
Scheduling and conducting calls. Legal basis: steps taken at your request before entering into a contract, and our legitimate interests.
Preparing estimates, entering into agreements, and performing the Services, including project management, approvals, change requests, delivery, handover, and ongoing care plans. Legal basis: performance of a contract.
Billing, invoicing, payment processing, collections, refunds, and handling payment disputes and chargebacks. Legal basis: performance of a contract, compliance with legal obligations, and our legitimate interest in receiving payment and protecting against fraud.
Operating, maintaining, and securing the Website, including preventing spam, fraud, abuse, and unauthorized access. Legal basis: our legitimate interest in operating a secure website.
Analyzing and improving the Website and Services. Legal basis: your consent where required for non-essential cookies, and otherwise our legitimate interest in improving our offering.
Sending marketing communications, including follow-up communications after a website audit or call, and information about our Services. Legal basis: our legitimate interest in business-to-business marketing, or your consent where required by applicable law.
Showcasing our work in our portfolio and case studies. Legal basis: the permission granted in our agreement with the Client, or consent. We do not publish an individual's name, photograph, or quote without permission.
Complying with legal obligations, including tax, accounting, and record-keeping requirements and responding to lawful requests from public authorities. Legal basis: compliance with legal obligations.
Establishing, exercising, or defending legal claims and enforcing our agreements. Legal basis: our legitimate interest in protecting our rights.
Business transactions, such as a merger, acquisition, financing, or sale of assets. Legal basis: our legitimate interest in conducting and evaluating such transactions.

We will not use Personal Information for purposes materially different from those described in this Policy without providing notice and, where required, obtaining your consent.

5.1 Automated Decision-Making

We do not make decisions based solely on automated Processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

5.2 Aggregated and De-identified Information

We may create aggregated or de-identified information that can no longer reasonably be linked to an individual, and use it for any lawful business purpose. We maintain such information in de-identified form and do not attempt to re-identify it, except as permitted by law.

6. How We Disclose Personal Information

We disclose Personal Information only as described in this Policy, including to the following categories of recipients:

Service providers that support our business operations, including website hosting and cloud infrastructure providers, analytics providers, scheduling tools, email and communication tools, customer relationship and project management tools, file storage and collaboration tools, consent management tools, security and spam-prevention services, accounting and bookkeeping providers, payment processors, and banking institutions.
Team members and independent contractors who work on our projects, on a need-to-know basis and subject to confidentiality obligations.
Third-party platforms at a Client's direction, such as domain registrars, hosting providers, search engine and business listing platforms, and other services connected to the Client's digital properties. These platforms process information under their own terms and privacy policies.
Professional advisors, such as lawyers, accountants, auditors, and insurers, under duties of confidentiality.
Payment processors, card networks, and banks in connection with processing payments, refunds, and payment disputes, as described in Section 7.
Legal and safety recipients, such as courts, law enforcement, and government authorities, where we believe in good faith that disclosure is required by law or legal process, or is necessary to protect our rights, property, or safety, or the rights, property, or safety of others.
Parties to a business transaction, such as a successor or acquirer in the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business. Any successor will be required to handle Personal Information consistently with this Policy or will provide notice of changes.
Other recipients with your consent or at your direction, including the public display of testimonials you have approved.

We require our service providers to use Personal Information only to provide services to us, to protect it with appropriate safeguards, and to comply with Applicable Data Protection Laws.

We do not sell Personal Information and do not share Personal Information for cross-context behavioral advertising or targeted advertising, as those terms are defined under applicable US state privacy laws. We do not knowingly sell or share the Personal Information of individuals under the age of 16.

7. Payment Information

We accept payment by credit and debit card, ACH bank transfer, and wire transfer.

Card payments are processed by Stripe, a third-party payment processor. Card details are entered into and processed by Stripe's systems. We do not receive or store full card numbers or security codes. We may receive limited information, such as the card brand, the last four digits of the card number, the expiration date, the billing postal code, and the payment status. Stripe processes Personal Information in accordance with its own privacy policy, available at https://stripe.com/privacy, and may use certain information as an independent Controller for purposes such as fraud prevention and legal compliance.
ACH payments are processed through our payment processor or our bank. Bank account details are handled by the processor or bank. We receive only the information necessary to identify, reconcile, and record the payment.
Wire transfers are received through our bank. We receive the information included in the transfer record, such as the remitter's name, the remitting bank, and payment reference details, and use it to identify, reconcile, and record the payment.

If a payment is disputed or subject to a chargeback, we may provide the payment processor, card network, or issuing bank with relevant records, such as the approved estimate, agreement, invoices, communications, approvals, and evidence of delivery, to the extent necessary to respond to the dispute.

8. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Website, remember your preferences, and, with your consent where required, understand how the Website is used. You can review and change your choices at any time through the "Cookie preferences" or "Manage consent" link on the Website. For details, please see our Cookie Policy.

Where required by applicable law, we treat a Global Privacy Control signal sent by your browser as a valid request to opt out of the sale or sharing of Personal Information for the browser or device that sends it.

9. Marketing Communications

We send marketing communications to business contacts in accordance with the CAN-SPAM Act and other applicable laws.
When you request a free website audit, we use your email address to send you the report. We may also send a limited number of follow-up messages related to the report and our Services. Where applicable law requires prior consent for such messages, we send them only with your consent.
You may opt out of marketing communications at any time by using the unsubscribe link in any marketing email or by contacting us at hello@grizzlybeam.com. We process opt-out requests within 10 business days.
After you opt out, we will retain your email address on a suppression list solely to ensure that we honor your request.
Opting out of marketing does not stop service-related communications, such as messages about estimates, projects, invoices, payments, or changes to our policies.
We do not send marketing text messages.

10. International Data Transfers

Grizzly Beam is based in the United States, and we process Personal Information in the United States. Our service providers, team members, and contractors may be located in, or access Personal Information from, other countries. These countries may have data protection laws that differ from those in your country.

Where we transfer Personal Information from the European Economic Area or the United Kingdom to a country that has not been recognized as providing an adequate level of protection, we rely on an appropriate transfer mechanism, such as:

the Standard Contractual Clauses approved by the European Commission;
the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses;
the EU-U.S. Data Privacy Framework or its UK Extension, where the recipient is certified; or
a derogation permitted by applicable law, such as where the transfer is necessary for the performance of a contract with you or at your request.

You may request more information about the safeguards we use by contacting us as described in Section 20.

11. Data Retention

We retain Personal Information only for as long as necessary for the purposes for which it was collected, including to meet legal, tax, accounting, and reporting requirements, resolve disputes, and enforce our agreements. When determining retention periods, we consider the nature and sensitivity of the information, the purposes of Processing, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.

Our general retention periods are as follows:

Inquiries, free website audit requests, and call booking records that do not result in an engagement: up to 24 months after our last interaction.
Client project records, including estimates, agreements, approvals, change requests, and related communications: for the duration of the Client relationship and up to 7 years after it ends.
Invoices, payment records, and accounting records: up to 7 years after the end of the relevant tax year, or longer where required by law.
Access credentials: only for as long as needed to perform the Services. We delete our copies of credentials within 30 days after the completion of a project, the end of a care plan, or a Client's request, whichever is earliest. Clients should also change passwords and revoke our access at that time.
Client Materials and project files: up to 12 months after project completion or the end of a care plan, to support handover, follow-up, and warranty requests, unless a different period is agreed in writing.
Marketing suppression records: for as long as necessary to honor your opt-out request.
Website analytics data: in accordance with the retention settings described in our Cookie Policy.
Security and server logs: up to 12 months, unless needed longer to investigate a security incident.

We may retain Personal Information for longer periods where required by law, where necessary to establish, exercise, or defend legal claims, or where subject to a legal hold. Information stored in backups is deleted or overwritten in accordance with regular backup cycles.

12. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect Personal Information from unauthorized access, use, alteration, disclosure, and loss. These measures include restricting access to Personal Information to those who need it, using multi-factor authentication where supported, using encrypted connections for data in transit, selecting service providers that maintain appropriate security practices, and imposing confidentiality obligations on team members and contractors.

No method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security of Personal Information.

You also play a role in protecting information. Clients should share access credentials only through the secure methods we specify and not in plain email or chat messages, use strong and unique passwords, and grant us the minimum level of access required for the Services. Please notify us promptly at hello@grizzlybeam.com if you believe that information you shared with us has been compromised.

If a security incident affects Personal Information, we will notify affected individuals, Clients, and authorities as required by Applicable Data Protection Laws.

13. Your Choices

Regardless of where you are located, you may:

request access to, or correction of, Personal Information we hold about you;
opt out of marketing communications, as described in Section 9;
manage cookie preferences through the Website, as described in Section 8; and
choose not to provide certain information, subject to the consequences described in Section 4.5.

Additional rights may apply depending on your location, as described in Sections 14 and 15.

14. Additional Information for Individuals in the EEA and the UK

This section applies where the GDPR or the UK GDPR applies to our Processing of your Personal Information.

14.1 Controller

Grizzly Beam LLC, 7901 4th St N Ste 300, St. Petersburg, FL 33702, United States, is the Controller of Personal Information processed as described in Section 3.1. You can contact us at hello@grizzlybeam.com.

14.2 Your Rights

Subject to conditions and exceptions under applicable law, you have the right to:

Access: obtain confirmation of whether we process your Personal Information and receive a copy of it.
Rectification: have inaccurate Personal Information corrected and incomplete information completed.
Erasure: have your Personal Information deleted in certain circumstances.
Restriction: have the Processing of your Personal Information restricted in certain circumstances.
Data portability: receive Personal Information you provided to us in a structured, commonly used, and machine-readable format, and have it transmitted to another Controller where technically feasible.
Objection: object to Processing based on our legitimate interests, on grounds relating to your particular situation. You have an absolute right to object to Processing for direct marketing purposes.
Withdrawal of consent: withdraw your consent at any time where we rely on consent. Withdrawal does not affect the lawfulness of Processing before the withdrawal.
Complaint: lodge a complaint with a supervisory authority, in particular in the EEA member state of your habitual residence, place of work, or place of the alleged infringement, or, in the United Kingdom, with the Information Commissioner's Office.

We would appreciate the opportunity to address your concerns before you contact a supervisory authority.

14.3 Legitimate Interests

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may request information about this balancing by contacting us.

14.4 Response Time

We respond to requests within one month of receipt. We may extend this period by up to two additional months where necessary, taking into account the complexity and number of requests, and we will inform you of any extension within the first month. Requests are free of charge, except that we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

15. Additional Information for US State Residents

15.1 Applicability

Several US states have enacted comprehensive privacy laws. Many of these laws apply only to businesses that meet certain revenue or data-volume thresholds, and some exclude or limit their application to Personal Information collected in a business-to-business context. This section applies only to the extent that such a law applies to our Processing of your Personal Information.

15.2 Categories of Personal Information

In the preceding 12 months, we have collected the following categories of Personal Information, as described in Section 4:

Identifiers, such as name, email address, telephone number, and IP address.
Customer records, such as billing contact details and limited payment information.
Commercial information, such as estimates, services purchased, and transaction history.
Internet or other electronic network activity information, such as Website usage and email engagement information.
Approximate geolocation data derived from IP address.
Professional or employment-related information, such as company name and job title.
Sensitive Personal Information, limited to account login credentials that Clients provide for business accounts, used solely to perform the Services.

We collect these categories from the sources described in Section 4, use them for the purposes described in Section 5, and disclose them for business purposes to the categories of recipients described in Section 6. We do not sell or share Personal Information as described in Section 6.1, and we do not use or disclose sensitive Personal Information for purposes that would give rise to a right to limit its use under applicable law.

15.3 Your Rights

Depending on your state of residence and subject to exceptions under applicable law, you may have the right to:

know and access the Personal Information we have collected about you, including the categories of information, sources, purposes, and recipients;
request deletion of your Personal Information;
request correction of inaccurate Personal Information;
receive your Personal Information in a portable format;
opt out of the sale or sharing of Personal Information, targeted advertising, and certain profiling, although we do not engage in these activities;
appeal our decision regarding your request; and
not receive discriminatory treatment for exercising your rights.

15.4 Submitting Requests

To submit a request, email us at hello@grizzlybeam.com with the subject line "Privacy Request," or write to us at the address in Section 20. We will verify your identity by matching information you provide with information we hold, and we may request additional information for this purpose. We will use any information provided for verification only to verify your identity.

You may use an authorized agent to submit a request on your behalf. We may require the agent to provide written authorization signed by you and may require you to verify your identity directly with us, except where the agent holds a valid power of attorney.

We respond to verifiable requests within 45 days of receipt. Where reasonably necessary, we may extend this period by an additional 45 days, and we will inform you of the extension and the reason for it within the first 45 days.

15.5 Appeals

If we decline to take action on your request, you may appeal by emailing hello@grizzlybeam.com with the subject line "Privacy Request Appeal." We will respond to your appeal within the period required by applicable law and explain the reasons for our decision. If your appeal is denied, you may contact the Attorney General of your state.

15.6 Additional State Disclosures

California Shine the Light: we do not disclose Personal Information to third parties for their own direct marketing purposes.
Nevada: we do not sell covered information as defined under Nevada law.

16. Children's Privacy

The Website and the Services are intended for businesses and for individuals who are at least 18 years of age. We do not knowingly collect Personal Information from individuals under 18. If we learn that we have collected Personal Information from an individual under 18, we will delete it promptly. If you believe that we may have collected such information, please contact us at hello@grizzlybeam.com.

17. Third-Party Websites, Platforms, and Services

The Website may contain links to third-party websites and platforms, including our LinkedIn page and the websites of Clients featured in our portfolio. In performing the Services, we may also work within third-party platforms that Clients use. We are not responsible for the privacy practices of these third parties. Their collection and use of Personal Information is governed by their own privacy policies, and we encourage you to review them.

18. Client Responsibilities for End-User Data

Where we build, host, or maintain a website or digital property for a Client, the Client is responsible, as Controller, for:

publishing its own privacy policy, cookie policy, and other required notices;
establishing a lawful basis for its Processing and obtaining any required consents from its end users;
configuring and maintaining consent management on its website in accordance with the laws that apply to its business;
responding to requests from its end users to exercise their privacy rights; and
entering into a data processing agreement with us where required by Applicable Data Protection Laws.

We may implement consent tools, forms, analytics, and similar features on a Client's instructions. Implementation of such features does not constitute legal advice, and the Client remains responsible for determining whether its website complies with the laws that apply to it.

19. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we update this Policy, we will revise the Effective Date at the top of this page. If we make material changes, we will provide notice through the Website or by email to Clients before the changes take effect. Your continued use of the Website or the Services after the Effective Date of an updated Policy means that you acknowledge the updated Policy. Where required by law, we will obtain your consent to material changes.

20. Contact Us

If you have questions about this Policy, wish to exercise your privacy rights, or have a concern about how we handle Personal Information, please contact us:

Grizzly Beam LLC
Address: 7901 4th St N Ste 300, St. Petersburg, FL 33702, United States
Email: hello@grizzlybeam.com
Website: https://grizzlybeam.com/

For privacy requests, please use the subject line "Privacy Request" so that we can route your message promptly.