Privacy Policy

Last updated: September 30, 2026

This Privacy Policy explains what personal data Paper Tiger LLC, doing business as Grassroot.gg (“we”, “us”, “our”), collects through grassroot.gg (the “Service”), how we use and share it, who can see it, and the choices you have. It applies together with our Terms of Service. Questions are welcome at [email protected].

1. Who is responsible for your data

Paper Tiger LLC is the controller of the personal data described here. Grassroot.gg shares its sign-in and account system with FGCombo (fgcombo.com), which we also operate; the data FGCombo collects is described in FGCombo’s own privacy policy. A profile first created on Grassroot.gg is kept private on FGCombo.

2. Age

The Service is only for people aged 18 and over. We do not knowingly collect personal data from anyone younger. If you believe someone under 18 has given us personal data, contact [email protected] and we will delete it.

3. Personal data we collect

Data you give us:

• Account. Your email address, or the account details your sign-in provider shares when you sign in with it (for Discord: your Discord user ID, username, avatar and email address), your profile handle and avatar, and whether you intend to organize, sponsor or both.
• Organizer listings. Your headline and description, the kinds of events you run, event details and venues, the locations you serve, audience figures such as attendance and viewer counts, photos, and your sponsorship packages.
• Payout details. The payout details you add to your listing. When you set up payouts, our payment facilitator collects the identity, business and bank details it needs directly from you; we receive only what we need to pay you, such as the status and reference of your payout account. Payout details are used only to pay you and are never shown to other members.
• Sponsor profiles. Your business category, the kinds of sponsorship you offer, locations of interest, website, pitch, logos and photos.
• Deals. Offers and their terms, revisions, notes when passing on or withdrawing an offer, messages between you and the other side, proof of delivery (descriptions, links, figures and screenshots), and the payment and payout records for the deal, including the payment account and reference used.
• Invites and blocks. Invite codes you create, their optional notes, and who redeemed them; the members you block.
• Notification requests. The email address you enter to be told when an organizer publishes sponsorship packages.
• Correspondence. Anything you send us, such as support requests or reports.

Data collected automatically:

• Technical data. Our hosting and database providers record technical information about requests, such as IP address, browser and device type, pages requested and timestamps, to run and secure the Service.
• Cookies. We use strictly necessary cookies to keep you signed in and to secure sign-in. We do not use advertising or analytics cookies.
• Browser storage. Your browser stores the organizers and sponsors you recently viewed (their handle, avatar and link) so your account page can show them. This list stays on your device, is kept separately for each account, and is erased when you sign out.
• Location search. When you type a place into a location field, the text you type is sent to our mapping provider to suggest matching places.

4. Who can see your data

• Organizer listings appear in the public store once approved and set up. Visitors who are not signed in, and members without access, see a limited version without your identity. Listings that are not yet approved or finished appear only as anonymous “Upcoming” cards.
• Sponsor profiles are shown to organizers without your identity until you send that organizer an offer. From then on, that organizer can see your profile, including after the deal ends.
• The other side of a deal sees your handle, avatar, the deal’s terms, your messages and your proof, and receives emails about the deal that include your handle.
• Members of an organization who manage it can see and act on its listing, profile and deals.
• Someone who invited you can see that you redeemed their invite.
• Our administrators can see all of the above, including payout details and payment records, to review listings, settle disputes and tell our payment facilitator when to release, return or hold a payment.

We never show your email address or payout details to other members, and we do not sell your personal data.

5. How we use personal data

• to create and run your account and sign you in;
• to show your listing or profile, match organizers and sponsors, and operate offers, deals, messages and proof;
• to have sponsors’ payments taken, held and released to organizers through our payment facilitator, and to keep the records the law requires;
• to review and approve listings, handle invites, and settle disputes;
• to send emails about your account, approvals and deals — these are part of the Service and are not marketing;
• to keep the Service and its members safe, prevent fraud and abuse, and enforce our Terms;
• to fix problems and improve the Service; and
• to comply with the law and respond to lawful requests.

6. Legal bases

Where the law requires a legal basis for using personal data, we rely on:

• Contract — to provide the Service you signed up for, including deals and payments;
• Legitimate interests — to keep the Service secure, prevent fraud, review listings and improve the Service, balanced against your rights;
• Legal obligation — to keep payment and tax records and respond to lawful requests; and
• Consent — where we ask for it, such as for a notification request. You can withdraw consent at any time.

7. Service providers

We share personal data only as needed with providers that help us run the Service:

• Supabase — database, sign-in and file storage (including photos, logos and proof screenshots);
• Vercel — website hosting;
• Cloudflare — domain name and network services;
• Amazon Web Services (Amazon SES) — sending email;
• Mapbox — location search suggestions;
• Discord — sign-in, if you choose to sign in with Discord; and
• Our payment facilitator — a licensed third-party provider of payments between the members of online marketplaces, which takes sponsor payments, holds them and pays organizers. It collects and verifies payment, identity and bank information under its own privacy policy and shares with us only what we need to run deals, such as payment status and references; we do not receive or store your card or bank details. We will name the payment facilitator here once it is chosen. While the Service is in early access, payments and payouts may instead be made manually through PayPal or another payment method we indicate, which processes payment information under its own privacy policy.

We may also disclose personal data when the law requires it or when needed to protect the rights, property or safety of our members, the public or us; to enforce our Terms; with your consent; and to a successor in a merger, acquisition, financing or sale of assets, which would remain bound by this policy.

8. Where and how long we keep data

We and our providers store data in the United States. When your data is transferred there from another country, we rely on appropriate safeguards where the law requires them.

We keep personal data for as long as your account is active and as needed to provide the Service. Records of deals and payments are kept for as long as tax, accounting and legal obligations require, and as long as needed to resolve disputes, even after you delete your account. Notification requests are kept, so that we never notify you twice, until you ask us to delete them.

9. Security

We use access controls, encrypted connections and reputable providers to protect personal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Your rights and choices

You can view and update most of your information in your account at any time. Wherever you live, you can ask us to access, correct, delete, restrict or object to the use of your personal data, or to give you a copy in a portable format, by emailing [email protected]. We respond within one month, and may need to verify your identity first. Some data cannot be deleted while it is needed for an open deal, or where we must keep it by law, as described above. If you are in the European Economic Area or the United Kingdom, you may also complain to your local data protection authority.

California residents have the right to know, delete and correct personal information and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.

11. Links to other sites

Listings, profiles, messages and proof may link to other websites. Their owners’ privacy practices apply once you leave the Service, and we are not responsible for them.

12. Changes to this policy

We may update this policy by posting a new version on this page with a new “Last updated” date. We will give reasonable notice of material changes, for example by email or on the Service.

13. Contact

Paper Tiger LLC, doing business as Grassroot.gg
[email protected]