Privacy Policy

1. Introduction

Gray Reserve, a division of Hellhorse Performance, LLC, a Texas limited liability company ("Gray Reserve," "we," "us," or "our"), operates grayreserve.com (the "Site") and the Gray Reserve platform (the "Platform"). This Privacy Policy describes how we collect, use, disclose, and protect personal information of visitors, users, and clients. It is a notice, not a data-processing addendum. Contracted clients who need processor terms get them only in a signed Master Services Agreement or addendum, and that document controls if it conflicts with this notice.

This Privacy Policy applies to information we collect through the Site, the Platform, via email, SMS, or other electronic communications, and through any of our online services. By using the Site or Platform, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

(a) Information You Provide

We collect information that you voluntarily provide to us, including:

• Contact form submissions (name, email address, company, phone number, message)
• Audit and consultation requests
• Account registration information through our authentication provider, Clerk (name, email, profile data, organization membership)
• Platform usage data: campaign configurations, uploaded assets, analytics settings, and client collaboration data
• Billing information processed through our payment provider, Stripe (we do not store full payment card numbers)
• Contract and engagement data processed through our document signing provider, DocuSeal
• Newsletter or mailing list sign-ups
• Responses to surveys or feedback requests
• SMS opt-in consent (see our SMS Terms)
• Any other information you choose to provide through the Site or Platform

(b) Automatically Collected Information

When you visit the Site, we automatically collect certain information, including:

• Usage data via Google Analytics 4 (GA4), including pages visited, time on page, bounce rate, and user flow
• Device information (browser type, operating system, screen resolution, device type)
• IP address and approximate geographic location
• Referring URL and search terms that led you to the Site
• Cookies and similar tracking technologies (see Section 6)
• Google Ads conversion tracking data for visitors who arrive through our advertising

3. How We Use Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve the Site and our services
• To communicate with you, including responding to inquiries and providing requested information
• To send marketing communications about our services (with your consent where required)
• To analyze Site usage patterns and optimize the user experience
• To measure the effectiveness of our marketing campaigns and advertising
• To detect, prevent, and address technical issues and security vulnerabilities
• To comply with legal obligations and enforce our Terms of Use
• To create aggregated or de-identified statistics, including marketing figures published on the Site

Marketing figures on the Site, including "$45M+" client revenue influenced, are estimates. Revenue influenced is an approximation of revenue we believe our work touched while a client was engaged with us. It is not a dollar-accurate total of client revenue, it is not taken from a complete set of client books, and it is not claimed as a factual accounting. See the Terms of Service.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose, such as subscribing to our newsletter or submitting a contact form
• Contract: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract
• Legitimate interest: Where processing is necessary for our legitimate business interests, such as improving our Site, marketing our services, and ensuring security, provided these interests are not overridden by your rights
• Legal obligation: Where processing is necessary to comply with a legal obligation to which we are subject

5. Information Sharing & Subprocessors

We do not sell personal information for money. We do use advertising and analytics tools, including Google Ads and Google Analytics, that may be treated as "sharing" for cross-context behavioral advertising under the California Privacy Rights Act. You can opt out of that sharing by emailing access@grayreserve.com with the subject "Do not share," or by sending a browser Global Privacy Control signal where the browser supports it. We may also disclose information in these cases:

• Service providers (subprocessors): We share data with trusted third-party service providers who assist us in operating the Site, Platform, and delivering services. See the subprocessor list below.
• Professional advisors: We may share information with our attorneys, accountants, and other professional advisors as necessary for business operations
• Legal requirements: We may disclose your information if required to do so by law, regulation, or legal process, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request
• Business transfers: In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information

Subprocessor List

The following third-party service providers process personal data on our behalf:

Subprocessors are bound by written terms that limit their use of personal information to the job we give them. A subprocessor's failure does not increase Gray Reserve's liability beyond the cap in the Terms of Service or, for a contracted client, the Master Services Agreement. We update this list when we add or remove a subprocessor. This list is notice. It is not a right to veto a vendor.

6. Cookies & Tracking

The Site uses the following tracking technologies:

• Google Analytics 4 (G-7BMTRR1QVF): Collects anonymized usage data to help us understand how visitors interact with the Site and improve its performance
• Google Ads (AW-17970584223): Tracks conversions from our advertising campaigns to measure their effectiveness
• Essential cookies: Strictly necessary for the Site to function, including session management, authentication state, and security tokens
• Optional cookies: Performance and analytics cookies that help us understand site usage patterns. You may opt out of these through your browser settings

Most web browsers allow you to control cookies through their settings. You can typically set your browser to refuse cookies or to alert you when a cookie is being placed. Please note that disabling cookies may affect the functionality of certain features on the Site.

7. Your Privacy Rights

CCPA Rights (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know: You can request that we disclose what personal information we collect, use, share, and sell about you
• Right to delete: You can request that we delete any personal information we have collected about you, subject to certain exceptions
• Right to correct: You can request correction of inaccurate personal information
• Right to opt out of sale or sharing: You can opt out of sale or of sharing for cross-context advertising, as described in Section 5
• Right to limit sensitive personal information: You can ask us to limit use of sensitive personal information to what is necessary to provide the services you requested
• Right to non-discrimination: We will not discriminate against you for exercising these rights

If a California request is verifiable, we acknowledge it within 10 business days and respond within 45 calendar days, with one 45-day extension if we tell you why. We will not provide data in a way that discloses someone else's information, and we may decline a request where the law allows, including when we must keep a record to complete a transaction, detect fraud, or meet a legal duty.

GDPR Rights (EEA and UK Residents)

If you are located in the EEA or UK, you have the following rights under the General Data Protection Regulation:

• Right of access: You can request a copy of the personal data we hold about you
• Right to rectification: You can request that we correct any inaccurate or incomplete personal data
• Right to erasure: You can request that we delete your personal data under certain circumstances
• Right to restrict processing: You can request that we restrict the processing of your personal data under certain circumstances
• Right to data portability: You can request a copy of your personal data in a structured, machine-readable format
• Right to object: You can object to our processing of your personal data based on legitimate interests or for direct marketing purposes

Exercising Your Rights

To exercise a right, email access@grayreserve.com. We verify identity before we act. For EEA and UK requests we respond within 30 days, and we may extend by up to 60 days for a complex request if we tell you. Rights are subject to the exceptions in the law that applies. A privacy request does not erase fees, contracts, or records we must keep.

8. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the data, and applicable legal requirements.

Specific retention periods:

• Platform data (client accounts): Kept for the life of the account. After termination you may request an export within 30 days. We then delete production copies on a reasonable cycle. Backups and logs roll off on their own schedule and are not a promise of instant erasure.
• Contact form submissions: Retained for up to 24 months from date of submission, unless you become a client (in which case MSA retention terms apply).
• Analytics data: Anonymized usage data collected via GA4 is retained per Google's default retention settings (14 months).
• Email communications: Marketing email engagement data is retained for 36 months. Transactional emails are retained as part of your account record.
• Legal and compliance records: Retained as required by applicable law, typically 7 years for financial records.

We delete or de-identify personal information on a verified request unless the law, a contract, or a dispute requires us to keep it. We aim to complete deletion requests within 30 days. Residual copies in backups are not a separate data store we search by hand.

9. Security

We implement commercially reasonable technical and organizational security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit via TLS/SSL, secure authentication through Clerk, access controls, and regular security assessments. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

10. Children's Privacy

The Site is not directed at individuals under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 13, please contact us at access@grayreserve.com.

11. International Data Transfers

Gray Reserve is in the United States. Information is processed on servers in the United States, including by the subprocessors in Section 5, some of which operate globally. If you access the Site from outside the United States, your information will be transferred to the United States, where the law may differ from yours. Where a transfer of EEA or UK personal data requires a safeguard, we use the European Commission's standard contractual clauses or the UK addendum, as applicable. Those clauses do not expand our liability past the Terms of Service or a signed MSA.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. If we make material changes, we will notify you by posting the updated policy on the Site with a new effective date. We encourage you to review this Privacy Policy periodically. Your continued use of the Site after any changes indicates your acceptance of the updated policy.

13. Contact

If you have questions or concerns about this Privacy Policy or our data practices, or if you wish to exercise any of your privacy rights, please contact us:

14. Effective Date

This Privacy Policy is effective as of October 16, 2026.