Privacy Policy

Grainbin, LLC, a Montana limited liability company ("Grainbin", "we", "us" or "our"), respects your privacy and the privacy of your farm's data. This Privacy Policy describes how we collect, use, disclose, retain and protect information in connection with the Grainbin applications for iPhone and the web, the website at grainbin.farm, and related services (together, the "Service"), and the choices and rights you have.

This Privacy Policy is incorporated into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service. By using the Service, you acknowledge that you have read this Privacy Policy.

Summary

• We claim no ownership of your farm's data. We use it to provide the Service to you, and only for the other purposes this policy describes or that you authorize.
• We do not sell your data, we do not share one farm's data with another, and we do not compare your farm with other farms.
• We do not use your data to train artificial intelligence models, and our artificial intelligence provider is contractually prohibited from doing so.
• We do not use advertising, advertising cookies or cross-site tracking.
• You can disconnect a platform, export your data or delete your Account at any time.

This summary is for convenience only. The full Privacy Policy below governs.

1. Scope

1.1 This Privacy Policy applies to information we collect through the Service.

1.2 It does not apply to the practices of any Connected Platform, such as John Deere Operations Center or CNH FieldOps, or of any third-party website or service, each of which is governed by its own privacy policy. Platform Data also remains subject to the rules each Connected Platform provider sets for applications such as Grainbin, which in some respects are stricter than this Privacy Policy.

1.3 The Service is offered only to farm operations located in the United States. It is not offered to, or directed at, individuals or farm operations in Canada, the European Union, the United Kingdom or any other country, even where it can be reached from there. If we learn that an account belongs to a farm operation outside the United States, we may close it and delete its data.

1.4 We store information on servers in the United States. Some of the service providers listed in Section 8.1 may process information elsewhere; our product analytics provider, for example, operates in the European Union.

2. Definitions

2.1 "Personal Information" means information that identifies, relates to or is reasonably capable of being associated with an identified or identifiable individual.

2.2 "Agricultural Data" means information about your farm operation, including field boundaries, field operations, crops, yields, inputs, machinery, grain inventory, sales and costs, whether you enter it yourself or it comes from a Connected Platform. Agricultural Data may include Personal Information, such as an operator's name.

2.3 "Platform Data" means Agricultural Data that the Service obtains from a Connected Platform under your authorization, together with any copy, extract, aggregation, inference, derivative, report, metadata or other information generated from or reflecting it. Platform Data remains Platform Data when it is combined with other information or included in an Advisor answer or report.

2.4 "De-identified Information" means information that cannot reasonably be used to identify you, your farm or any individual.

3. Information We Collect

3.1 Information you provide

• Account information: your name and email address, which we use to set up your Account, and your password. We store your password only as a one-way cryptographic hash.
• Farm information: the name of your farm or operation and the people your farm's administrator asks us to give access.
• Agricultural Data you enter: notes, bins and grain inventory, grain samples, sales and contracts, prices and expenses, corrections to fields and crops, bin-site locations, and photos you upload.
• Advisor content: the questions you ask Advisor, its answers, and any ratings you give them.
• Communications: information you provide when you contact us, including by email or during a setup call.
• Access requests: if you request access on grainbin.farm, your name, email address, crops, acreage, how you heard about Grainbin, whether you are interested in our data services, and any message you include.

When you book a call, we receive your name, email address and the time you chose from our scheduling provider, and keep them to prepare for the call.

3.2 Information from Connected Platforms

When you connect a Connected Platform, you sign in on that platform's own page and authorize Grainbin to access your records. Grainbin never receives your password for that platform; it receives an access authorization, which we store in encrypted form. With your authorization, the Service reads, and never changes, records that may include:

• organizations, farms, clients and fields, including field boundaries;
• field operations, such as seeding, application, harvest and tillage, with their dates, areas, products, rates, varieties, yields and moisture;
• map images of those operations;
• machines, engine hours and fuel recorded for an operation; and
• operator names as recorded on the platform.

3.3 Information collected automatically

• Usage information: the screens and features you use and when, your device type, operating system, app version and IP address. This information is associated with your Account. It records which features are used and when, and

does not include Platform Data.

• Log information: records of requests to our servers, including IP address, date and time, and the address requested.
• Map requests: to display a map, your device requests map images for the area on screen from our map provider, which reveals the general location of the area you are viewing. Field boundaries are drawn on your device and are not sent to the map provider. Bin-site address searches are sent to the map provider.

We do not collect your device's precise location, contacts, photos (other than those you choose to upload) or advertising identifiers.

4. Cookies and Similar Technologies

4.1 The Service uses only the cookies and similar technologies needed for it to work and to remember your preferences:

4.2 We do not use advertising cookies, third-party analytics cookies or cross-site tracking technologies. Usage information from the web app is sent to our own servers, not directly from your browser to a third party. The one exception is booking a setup call: after you request access, Calendly's booking page loads inside the request form and may set its own cookies, under Calendly's privacy policy. Nothing from Calendly loads until you have submitted the form.

4.3 You can set your browser to refuse cookies, but the web app requires the strictly necessary cookies to sign you in.

4.4 Do Not Track and Global Privacy Control. Because we do not sell Personal Information, use it for targeted advertising or track you across other websites, there is no such activity for these signals to switch off. We honor Global Privacy Control signals as a request to opt out of sale and targeted advertising, which we do not engage in.

5. How We Use Information

We use information for the following purposes:

(a) to provide the Service, including displaying your fields, operations, economics, bins and sales, preparing your reports and operating the features you use;

(b) to operate Advisor, as described in Section 7;

(c) to keep Platform Data current by synchronizing with your Connected Platforms;

(d) to provide support, when you ask for help or when something does not work as it should;

(e) to understand and improve the Service, using usage information;

(f) to secure the Service, including to detect, prevent and respond to fraud, abuse and security incidents;

(g) to communicate with you about your Account, transactions, the Service and changes to our terms and policies. We do not send marketing communications built from your Agricultural Data, and we do not use Personal Information obtained from a Connected Platform to contact you; and

(h) to comply with law and to establish, exercise or defend legal claims.

We will not use information for a purpose materially different from those described in this Privacy Policy without your consent.

6. Our Commitments About Agricultural Data

6.1 Ownership. We claim no ownership of your Agricultural Data. We hold and process it on your behalf. Platform Data is also subject to the rights of the Connected Platform provider under its own terms.

6.2 No sale. We do not sell Agricultural Data or Personal Information.

6.3 No sharing between farms. We do not disclose one farm's Agricultural Data to another farm, and we do not compare or benchmark your farm against other farms.

6.4 No model training. We do not use your data to train artificial intelligence or machine-learning models.

6.5 Use for your benefit. We use Platform Data solely within the Service and solely for your benefit. We do not use your Agricultural Data for advertising, profiling, data brokerage or the benefit of any third party.

6.6 Portability. You may export your Agricultural Data at any time, as described in Section 12.

6.7 Aggregated statistics. We may compile De-identified Information that combines many farms, such as the number of farms using the Service or how often a feature is used. We compile it only from usage information and from data you enter, and never from Platform Data. We maintain De-identified Information in de-identified form and do not attempt to re-identify it.

6.8 Public data. Market briefings, grain prices and input-cost benchmarks in the Service are compiled from public sources, such as the US Department of Agriculture, and do not contain your Agricultural Data.

7. Advisor and Artificial Intelligence

7.1 Advisor is an artificial intelligence feature. When you ask Advisor a question, we send the question, the conversation so far and the portions of your Agricultural Data needed to answer it to our artificial intelligence provider, Anthropic, PBC, which returns an answer.

7.2 Anthropic processes this information as our service provider, only to provide its service to us, and is contractually prohibited from training its models on it. Anthropic may retain it for a limited period, generally no more than 30 days, to operate its service and to detect misuse.

7.3 Ratings you give Advisor's answers are stored by Grainbin and are not sent to Anthropic.

7.4 Advisor can be inaccurate. Verify any fact or figure before you rely on it.

8. How We Disclose Information

We disclose information only as described in this Section.

8.1 Service providers

We disclose information to service providers that process it on our behalf, under written obligations to use it only to provide services to us and to protect it:

We will update this Privacy Policy before engaging a new service provider that processes Agricultural Data.

8.2 At your direction

• Reports you share. You may download your reports and share them yourself, for example with your lender, crop insurance agent or the Farm Service Agency. Once you share a report, the recipient's use of it is governed by its own policies.
• Optional programs. We may offer optional programs that share information with a named third party for a stated purpose, such as providing acreage or production records to your insurance provider. Each program is off unless you enroll. Before you enroll, we will tell you who receives what information, for what purpose and for how long. You may leave a program at any time, which ends further sharing. A program that includes Platform Data is offered only with the written authorization of the Connected Platform provider, in addition to your consent.

8.3 Connected Platforms

We exchange information with a Connected Platform only as needed to retrieve your records, renew and manage the authorization you granted, and operate your connection to it.

8.4 Legal requirements and protection

We may disclose information if we believe in good faith that doing so is required by law, subpoena, court order or other legal process, or is reasonably necessary to protect the rights, property or safety of Grainbin, our users or others, including to prevent fraud or abuse. Where permitted by law, we will notify you before disclosing your Agricultural Data in response to legal process.

8.5 Business transfers

If Grainbin is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of its assets, information may be transferred as part of that transaction. Any successor will be required to handle information collected under this Privacy Policy in accordance with it, and we will notify you before your information becomes subject to a different privacy policy. Platform Data is transferred only where the Connected Platform provider consents; otherwise it is deleted.

8.6 Personnel

Our personnel may access a farm's information only as needed to support that farm, to resolve a problem, or to secure the Service, and are bound by confidentiality obligations.

9. Data Retention

9.1 We retain information for as long as your Account is open and as needed to provide the Service.

9.2 If you disconnect a Connected Platform, we stop retrieving data from it immediately and revoke Grainbin's access on the platform. Platform Data already retrieved stays in your Account unless the provider requires its deletion. You may ask us to delete it at any time, by email or from the platform's page in the Service's settings. We will tell you first which of your own records are attached to it and would go with it, such as notes on those fields, and will delete it within 30 days of your confirmation.

9.3 If our access to a Connected Platform ends for any reason, we stop using the Platform Data obtained from it and delete it where the provider requires.

9.4 If you delete your Account, we delete your Account information and Agricultural Data within 30 days, including from backups, except for limited information we must retain to comply with legal obligations, such as transaction records. If we ever restore a backup, we reapply deletions made since that backup was taken.

9.5 Server logs are retained for no more than 90 days.

9.6 De-identified Information, which never includes Platform Data, may be retained indefinitely.

9.7 Booking details are kept with your account or signup and deleted when it is.

10. Data Security

10.1 We maintain administrative, technical and physical safeguards designed to protect information against unauthorized access, use, alteration and destruction, including:

• encryption of data in transit between your device and the Service;
• encryption of the authorizations you grant for Connected Platforms;
• one-way hashing of passwords;
• multi-factor authentication and logging for administrative access; and
• regular, encrypted backups.

10.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security breach affecting your Personal Information or Agricultural Data, we will notify you and the appropriate authorities as required by applicable law.

11. Children's Privacy

The Service is intended for agricultural businesses and is not directed to individuals under the age of 18. We do not knowingly collect Personal Information from children under 13, or from anyone under 18. If you believe we have collected such information, contact us and we will delete it.

12. Your Rights and Choices

12.1 Rights available to everyone. Wherever you live, you may:

• access the Personal Information and Agricultural Data we hold about you, and obtain a copy in a portable format;
• correct inaccurate information, in the Service or by contacting us;
• delete your Account and associated information, in the Service's settings or by contacting us;
• disconnect a Connected Platform in the Service, or revoke Grainbin's access on the Connected Platform itself;
• withdraw consent, including by leaving an optional program. Withdrawing stops future sharing but cannot recall a report or data a recipient already holds; and
• opt out of non-essential email by following the instructions in the email. We will still send messages about your Account and the Service.

12.2 State privacy rights. Residents of certain states, including California, Colorado, Connecticut, Montana, Oregon, Texas, Virginia and other states with comprehensive privacy laws, may have additional rights, including the right to know the categories of Personal Information collected and disclosed, to opt out of the sale of Personal Information, targeted advertising and profiling, and to limit the use of sensitive Personal Information. We do not sell Personal Information, share it for cross-context behavioral advertising, engage in profiling that produces legal or similarly significant effects, or use sensitive Personal Information (such as account log-in credentials) other than to provide the Service. We extend the rights in Section 12.1 to all users regardless of whether a state law applies.

12.3 Categories of Personal Information. In the preceding 12 months we have collected the following categories of Personal Information, from the sources and for the purposes described in Sections 3 and 5, and disclosed them for a business purpose only to the recipients described in Section 8:

12.4 Submitting a request. To exercise any right, email karl@grainbin.farm. We will verify your request by confirming it from the email address associated with your Account, and may take further reasonable steps to verify a request to export or delete data. Requests to export or delete all of a farm's data must come from an administrator of the farm, as described in the Terms of Service. We will respond within 30 days, or within the period required by applicable law if shorter. An authorized agent may submit a request on your behalf with your signed permission, subject to verification.

12.5 Appeals. If we decline your request, you may appeal by replying to our decision with "Appeal" in the subject line. We will respond to an appeal within 45 days. If you are not satisfied with the outcome, you may contact your state attorney general.

12.6 Non-discrimination. We will not deny you the Service, charge you a different price or provide a different quality of service because you exercised your privacy rights.

13. Third-Party Links and Services

The Service may link to third-party websites and services, including Connected Platforms. We are not responsible for their privacy practices, and we encourage you to review their privacy policies.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you through the Service or by email at least 30 days before it takes effect. We will not use information we have already collected for a materially different purpose without your consent. If a change is required sooner by law or to protect the security of the Service, it may take effect sooner, and we will notify you as soon as reasonably practicable. The "Last Updated" date above shows when this Privacy Policy was last revised.

15. Contact Us

If you have questions about this Privacy Policy or our practices, contact:

Grainbin, LLC
karl@grainbin.farm