Privacy Policy

Effective Date: October 28, 2026

Downgrain Labs LLC (“Downgrain,” “we,” “our,” or “us”) operates the website and platform located at downgrain.com and the Downgrain connectors for AI assistants, including the Downgrain connector for Claude and the Downgrain plugin for ChatGPT (together, the “Service”). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Service. By accessing or using our Service, you agree to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Information Provided to Us

We collect the following personal information in connection with providing our Service:

Name
Email address
Phone number
Company name
Job title or role

User accounts are provisioned by Downgrain on behalf of our customers. Users do not create accounts directly.

1.2 Information Collected Automatically

When you access our Service, we may automatically collect certain information, including:

Browser type and version
Device type and operating system
IP address
Pages visited and interactions within the Service
Date and time of access
Referring URL

1.3 Information Received Through AI Assistant Connectors

When you use Downgrain through an AI assistant such as Claude or ChatGPT, the assistant sends requests to our servers on your behalf. In connection with those requests we receive:

Authentication information. When you connect your Downgrain account to an AI assistant, you sign in through our identity provider (Auth0). We receive a token that identifies your Downgrain account and the permissions you have authorized. We never receive your password.
Tool inputs. The specific search terms, filters, or record identifiers the assistant sends to a Downgrain tool in order to answer your request (for example, a state, a facility type, or a job title). We receive only the parameters defined for each tool. We do not receive, request, or reconstruct your full conversation with the assistant, your chat history, your files, or the assistant’s memory about you.
Request metadata. The date and time of each request, the IP address, the tool called, the identity of the AI platform making the request.
Coarse location. Some assistants share an approximate location (such as a city or region) with connectors. We use it only to scope results when you ask for something “near me,” and we do not request precise location.

We do not use tool inputs or request metadata to build profiles of you or to track your behavior across conversations or platforms.

1.4 Cookies and Tracking Technologies

We use cookies and similar tracking technologies on the website and platform to analyze usage patterns and improve the Service. These may include:

Essential cookies: Required for the Service to function, such as authentication and session management.
Analytics cookies: Used to understand how users interact with the Service, helping us improve functionality and user experience.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service. Our AI assistant connectors do not set cookies.

2. How We Use Your Information

We use the information we collect for the following purposes:

To provide, maintain, and operate the Service
To authenticate users and manage account access, including authorizing AI assistants you have connected to act on your account
To respond to the specific requests you make through the website, platform, or an AI assistant connector
To communicate with you regarding the Service, including support and updates
To analyze usage and improve the functionality and performance of the Service
To detect, prevent, and respond to security incidents, abuse, and errors
To comply with legal obligations

We do not sell, rent, or trade your personal information to third parties. We do not use your personal information for advertising purposes. We do not use information received through AI assistant connectors to train AI models.

3. How We Share Your Information

We may share your information only in the following limited circumstances:

Service providers: We use third-party service providers to operate our platform, including our application hosting provider (Retool), database infrastructure provider (Supabase), identity and authentication provider (Auth0), payment processor (Stripe), and MCP server host (Render). These providers access your information only as necessary to perform services on our behalf and are contractually obligated to protect it.
AI assistant platforms: When you use Downgrain through Claude (operated by Anthropic) or ChatGPT (operated by OpenAI), the results we return in response to your request are delivered to that platform and displayed in your conversation. The platform’s handling of your conversation, including those results, is governed by its own privacy policy, not this one. We share with the platform only the data needed to answer the request you made. We do not share your account information with a platform except the confirmation that your connection is authorized.
Legal requirements: We may disclose your information if required to do so by law, regulation, legal process, or governmental request.
Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4. AI Assistant Connectors (Claude and ChatGPT)

This section applies when you use Downgrain through an AI assistant. It supplements the rest of this Policy. Where the two differ for connector use, this section controls.

4.1 How connectors work

Downgrain offers a connector built on the Model Context Protocol (MCP) that lets an AI assistant query the Downgrain database on your behalf. The assistant decides when to call a Downgrain tool based on your request, sends the tool’s inputs to our server, and shows you the results. Downgrain does not operate the assistant and does not see your conversation.

4.2 What we receive and what we do not

We receive only what is described in Section 1.3: an authorization token, the inputs to the specific tool called, request metadata, and, where the assistant provides it, a coarse location. We do not receive, request, store, or attempt to infer:

Your full conversation, chat history, or prior turns
Files you have uploaded to the assistant
The assistant’s memory or profile of you
Your precise location
Payment card data, health information, government identifiers, or passwords

Our tools are designed to request the minimum information needed to perform their stated function.

4.3 Logging and retention for connector requests

We log connector requests so that we can operate, secure, and debug the Service. Each log entry records the date and time, the IP address, the tool called, your Downgrain account identifier, and the tool inputs. Connector request logs are retained for 90 days and then deleted automatically. We do not use connector logs for advertising, profiling, or model training.

4.4 Disconnecting

You can disconnect Downgrain from an assistant at any time in the assistant’s settings (for Claude, under Connectors; for ChatGPT, under Apps or Plugins). Disconnecting revokes the assistant’s authorization to call our tools on your behalf. You may also ask us to revoke all active connector authorizations for your account by contacting us at the address in Section 14.

4.5 Changes to connector data practices

If we materially change what a connector collects, how we use it, or which third parties process it, we will update this Policy, notify the relevant AI platform as their directory policies require, and, where appropriate, notify you through the Service or by email.

5. Payment Information

Payment processing is handled entirely by Stripe, a PCI DSS Level 1 certified payment processor. We do not collect, store, or process credit card numbers, bank account details, or other payment credentials on our systems. For information on how Stripe handles your payment data, please refer to Stripe’s Privacy Policy at https://stripe.com/privacy. Our AI assistant connectors do not process payments and do not request payment information.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

Encryption of all data in transit using TLS 1.2 or higher, including all traffic between AI assistant platforms and our connector
Encryption of all data at rest using AES-256
Role-based access controls limiting data access to authorized personnel
Multi-factor authentication on all production systems
Comprehensive audit logging of all data access and administrative actions
OAuth 2.0 authorization for AI assistant connectors, so that an assistant can act on your account only with a token you have authorized and can revoke

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security. To report a security concern, contact us at the address in Section 14.

7. Data Retention

We retain personal information only as long as needed for the purposes in this Policy or as required by law:

Data	Retained for
Account information (Section 1.1)	The life of the customer relationship, then deleted within 30 days of termination or a verified deletion request
Website and platform usage data (Section 1.2)	12 months
Connector request logs (Section 4.3)	90 days, then deleted automatically
Connector authorization tokens	Until you disconnect the assistant or the token expires, whichever is first
Records required for legal, tax, or accounting purposes	The period required by applicable law

Upon termination of the service relationship or upon a verified deletion request, we will permanently delete your personal information from our production systems and provide written confirmation upon request.

8. Your Rights and Controls

Depending on your location, you may have the following rights regarding your personal information:

Access: You may request a copy of the personal information we hold about you.
Correction: You may request that we correct any inaccurate or incomplete information.
Deletion: You may request that we delete your personal information, subject to certain legal exceptions.
Portability: You may request a copy of your data in a structured, commonly used format.

Regardless of location, every user can also:

Disconnect any AI assistant from their Downgrain account at any time (Section 4.4)
Ask us to revoke all connector authorizations and delete connector request logs associated with their account

To exercise any of these rights, please contact us at the information provided below. We will respond to your request within 30 days.

9. California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To make a request under the CCPA, please contact us at the information provided below.

10. Information About Golf Facility Contacts

The Downgrain database contains business contact information about staff at U.S. golf facilities, such as names, titles, facility affiliations, and work contact details. This information is compiled from publicly available sources, including facility websites, professional associations, and industry publications. It is business contact information, not consumer data, and we make it available to our customers, including through AI assistant connectors, for business-to-business prospecting and research.

If you are a facility contact whose information appears in our database and you would like it corrected or removed, contact us at the address in Section 14. We will process your request within 30 days.

11. Children’s Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

12. Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you access through our platform, including the AI assistant platforms through which you may use Downgrain.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. If we make material changes, we will notify you by updating the effective date at the top of this policy and, where appropriate, providing additional notice through the Service or via email. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, if you wish to exercise your privacy rights, or if you need support with a Downgrain connector, please contact us at:

Downgrain Labs LLC
Website: https://downgrain.com
Email: Contact Form