Privacy Policy

Effective Date: October 9, 2026  ·  Last Updated: October 9, 2026

This Privacy Policy (this “Policy”) describes how The Graceful Company, LLC, a Florida limited liability company, including when doing business as CommonsWay (collectively, the “Company,” “graceful,” “we,” “us,” or “our”), collects, uses, discloses, retains, and otherwise processes Personal Information in connection with the website located at thegracefulcompany.com, including all subdomains, pages, and browser-based tools made available on it (collectively, the “Site”), our marketing, content, advertising, and growth services (the “Services”), and any other interaction you have with us, including by email, telephone, text message, social media, or in person.

Please read this Policy carefully. By accessing or using the Site or Services, or by otherwise providing Personal Information to us, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you should not access or use the Site or Services. This Policy is incorporated into and forms part of our Terms & Conditions.

1. Scope of This Policy

This Policy applies to Personal Information that the Company collects through the Site, through our business communications, and in the course of marketing, negotiating, and administering the Services. It applies to visitors of the Site, prospective and current clients and their representatives, vendors, creators, affiliates, and other individuals who interact with us.

This Policy does not apply to:

• Information we process on behalf of our clients in our capacity as a service provider or processor, which is governed by our agreements with those clients and by their own privacy notices (see Section 9);
• Information collected by third-party websites, platforms, or services that may link to or be linked from the Site, which are governed by their own privacy policies;
• Information relating to the Company’s own employees and job applicants, which is addressed in separate notices provided to those individuals.

Your use of the CommonsWay platform is additionally governed by the CommonsWay Privacy Policy as described in Section 3.

2. Definitions

For purposes of this Policy:

• “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. It includes “personal data” and “personal information” as those terms are defined under applicable data protection laws. It does not include de-identified or aggregated information.
• “Processing” means any operation performed on Personal Information, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure, or destruction.
• “Client” means a business or organization that has engaged the Company to provide Services under a written agreement, proposal, or statement of work.
• “Service Provider” means a third party that processes Personal Information on our behalf and subject to contractual restrictions on its use.

3. CommonsWay

The Graceful Company, doing business as CommonsWay, operates the CommonsWay platform. When you use CommonsWay, The Graceful Company collects and processes your information as described in the CommonsWay Privacy Policy at commonsway.com/privacy, which is part of this policy.

CommonsWay text messages (SMS)

We collect your mobile number and your consent to receive texts when you tick the SMS consent box on a CommonsWay form. We use them only to send the CommonsWay messages you agreed to: sign-in and verification codes, invitations, the opt-in confirmation and account notices.

You can opt out at any time by replying STOP, or get help by replying HELP or emailing support@commonsway.com.

4. Information We Collect

The categories of Personal Information we collect depend on how you interact with us. We collect Personal Information in the following ways.

4.1 Information You Provide Directly

• Contact and inquiry information: your name, email address, telephone number, company name, job title, and the content of any message, request, or attachment you send to us.
• Business and engagement information: information you provide when discussing, contracting for, or receiving Services, such as project requirements, brand materials, account credentials or access permissions you elect to grant us for the purpose of performing Services, and correspondence relating to the engagement.
• Billing and transaction information: billing contact details, billing address, tax identification information, and payment records. Payment card details, where applicable, are processed by our third-party payment processors and are not stored by us.
• Creator, affiliate, and vendor information: if you work with us as a content creator, affiliate, contractor, or vendor, your name, contact details, social media handles, portfolio materials, payment and tax information, and the terms of our relationship.
• Mobile number and SMS consent: as described in Section 3, when you provide a mobile number and consent on a CommonsWay form.
• Feedback and testimonials: any feedback, reviews, or testimonials you choose to provide, which we will publish only with your permission.

4.2 Information Collected Automatically

When you visit the Site, our hosting provider and the content delivery networks it uses automatically receive certain technical information transmitted by your browser or device, which may include:

• Internet Protocol (IP) address and approximate location derived from it (such as city or region);
• Browser type and version, operating system, and device type;
• Referring and exit pages and the URLs requested;
• Date, time, and duration of requests; and
• Error logs and other diagnostic information.

This information is used to deliver, secure, and maintain the Site. We do not use it to identify you individually, except where necessary to investigate security incidents or misuse.

4.3 Information from Third Parties

We may receive Personal Information about you from third-party sources, including:

• Our Clients, when they introduce us to you or engage us to work with you;
• Business partners, agencies, and referral sources;
• Social media platforms, when you interact with our accounts or content, subject to your settings on those platforms; and
• Publicly available sources, such as professional networking sites and company websites.

4.4 Sensitive Personal Information

We do not intentionally collect sensitive Personal Information (such as government identification numbers, precise geolocation, health information, biometric data, or information about racial or ethnic origin, religious beliefs, or sexual orientation) through the Site. Please do not send us such information. Where tax identification numbers are required to pay creators, affiliates, or vendors, we collect and use them solely for tax and compliance purposes.

5. Cookies and Similar Technologies

As of the Effective Date, the Site does not use advertising cookies, third-party analytics, tracking pixels, session replay, or similar tracking technologies. The Site may use technologies that are strictly necessary for its operation and security.

If we introduce analytics or advertising technologies in the future, we will update this Policy before doing so and, where required by applicable law, obtain your consent and provide an appropriate means to opt out.

Do Not Track and Global Privacy Control. Because the Site does not engage in cross-context behavioral advertising or the sale of Personal Information, there is no tracking for a Do Not Track signal to disable. Where applicable law requires, we will treat a Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of Personal Information associated with that browser.

6. How We Use Information

We use Personal Information for the following business and commercial purposes:

1. Responding to you: to answer inquiries, provide information you request, and communicate with you about potential engagements.
2. Providing the Services: to negotiate, enter into, perform, and administer agreements with Clients, creators, affiliates, and vendors, including project management, reporting, invoicing, and payment.
3. Operating CommonsWay: as described in Section 3 and in the CommonsWay Privacy Policy.
4. Operating and securing the Site: to deliver, maintain, troubleshoot, and protect the Site and our systems, and to detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activity.
5. Improving our business: to understand how our Services are received and to develop and improve our offerings, using aggregated or de-identified information where practicable.
6. Business communications: to send you transactional and relationship communications by email. Where permitted by law, we may also send you occasional emails about our Services, from which you may unsubscribe at any time.
7. Legal and compliance: to comply with applicable laws, regulations, legal process, and governmental requests; to maintain business, accounting, and tax records; and to establish, exercise, or defend legal claims.
8. Corporate transactions: in connection with an actual or proposed merger, acquisition, financing, reorganization, or sale of all or part of our business or assets.
9. With your consent: for any other purpose disclosed to you at the time of collection or to which you consent.

We will not use Personal Information for purposes materially different from those described in this Policy without providing you notice and, where required by law, obtaining your consent.

7. Legal Bases for Processing

If you are located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, we process your Personal Information only where we have a lawful basis to do so, including:

• Performance of a contract: where processing is necessary to enter into or perform a contract with you or the organization you represent;
• Legitimate interests: where processing is necessary for our legitimate interests, such as operating and securing the Site, responding to inquiries, and developing our business, provided those interests are not overridden by your rights and interests;
• Legal obligation: where processing is necessary to comply with a legal obligation to which we are subject; and
• Consent: where you have given consent, such as consent to receive text messages. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

8. How We Disclose Information

We do not sell Personal Information, and we do not share Personal Information for cross-context behavioral advertising. We disclose Personal Information only as described below:

• Service Providers. We disclose Personal Information to Service Providers that perform services on our behalf, such as website hosting and content delivery, web font delivery, email and communications providers, SMS delivery providers (solely to transmit CommonsWay messages), cloud storage, payment processing, accounting, and professional advisors. Service Providers are contractually restricted from using Personal Information for any purpose other than providing services to us.
• Clients. Where you are a creator, affiliate, or vendor engaged in connection with a Client project, we may disclose relevant information to that Client as necessary to perform the engagement.
• Professional advisors. We may disclose information to our lawyers, accountants, auditors, insurers, and bankers in the course of the professional services they provide to us.
• Legal requirements and protection. We may disclose information where we believe in good faith that disclosure is necessary to comply with applicable law, regulation, subpoena, court order, or other legal process; to respond to lawful requests from public authorities; to enforce our agreements; or to protect the rights, property, or safety of the Company, our Clients, users, or others.
• Business transfers. We may disclose or transfer information in connection with, or during negotiations of, any merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our business or assets. Any successor will be bound by the commitments in this Policy with respect to previously collected information.
• With your consent or at your direction. We may disclose information to other parties when you consent to or direct the disclosure.

Notwithstanding anything in this Section, mobile information and SMS opt-in data are subject to the restrictions stated in Section 3 and are never shared with third parties or affiliates for marketing or promotional purposes.

9. Client Data

In performing Services, we may process Personal Information on behalf of our Clients, such as information contained in a Client’s email or SMS subscriber lists, customer records, advertising accounts, or social media accounts (“Client Data”). With respect to Client Data, we act as a service provider, contractor, or processor, and the Client is the business or controller responsible for that information.

We process Client Data only on the Client’s documented instructions and in accordance with our agreement with that Client. If you are a customer or subscriber of one of our Clients and wish to exercise your privacy rights with respect to Client Data, please contact that Client directly. If you contact us, we will refer your request to the relevant Client and assist the Client as required by our agreement and applicable law.

10. Browser-Based Tools

The Site may make available tools, such as video editing utilities, that operate entirely within your web browser. Files you select for use with these tools are processed locally on your device and are not uploaded to, transmitted to, or stored by the Company. Because we do not receive these files, we cannot recover them for you. You are responsible for retaining copies of your original files.

11. Third-Party Services and Links

The Site relies on certain third-party services that may receive limited technical information directly from your browser:

• Hosting. The Site is hosted on GitHub Pages, operated by GitHub, Inc. See the GitHub General Privacy Statement.
• Web fonts. The Site loads fonts from Google Fonts, operated by Google LLC, which receives your IP address and browser information when fonts are requested. See the Google Privacy Policy.

The Site may contain links to third-party websites, platforms, and services, including social media platforms and Client websites. We do not control and are not responsible for the privacy practices of any third party. The inclusion of a link does not imply our endorsement. We encourage you to review the privacy policy of every website you visit.

12. Data Retention

We retain Personal Information for as long as reasonably necessary to fulfill the purposes for which it was collected, as described in this Policy, unless a longer retention period is required or permitted by law. In determining appropriate retention periods, we consider the amount, nature, and sensitivity of the information; the potential risk of harm from unauthorized use or disclosure; the purposes for which we process it and whether those purposes can be achieved by other means; and applicable legal, tax, accounting, and contractual requirements.

By way of example:

• General inquiry correspondence is typically retained for up to three (3) years after our last interaction;
• Contract, invoicing, and payment records are retained for the duration of the relationship and for up to seven (7) years thereafter to satisfy tax and accounting obligations;
• Server and security logs maintained by our hosting provider are retained in accordance with its policies; and
• SMS consent records are retained for as long as required to demonstrate consent under applicable law.

When Personal Information is no longer needed, we delete, de-identify, or aggregate it, or, where that is not possible (for example, because it is stored in backup archives), we securely store it and isolate it from further processing until deletion is possible.

13. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect Personal Information against accidental, unlawful, or unauthorized access, use, alteration, disclosure, or destruction. These safeguards include encryption of data in transit (HTTPS), access controls that limit Personal Information to personnel and Service Providers with a business need to know, and the use of reputable Service Providers that maintain their own security programs.

No method of transmission over the internet or method of electronic storage is completely secure. Accordingly, while we strive to protect Personal Information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of any credentials you use to access our Services. If you believe your interaction with us is no longer secure, please contact us immediately. In the event of a data breach affecting your Personal Information, we will notify you and applicable authorities as required by law.

14. International Data Transfers

The Company is based in the United States, and the Site is hosted in the United States. If you access the Site or communicate with us from outside the United States, your Personal Information will be transferred to, stored, and processed in the United States and other countries where our Service Providers operate. Data protection laws in these countries may differ from, and may be less protective than, the laws of your country of residence.

Where we transfer Personal Information from the EEA, the United Kingdom, or Switzerland to a country that has not been found to provide an adequate level of protection, we rely on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission (and their UK and Swiss equivalents), or on applicable derogations, such as the necessity of the transfer for the performance of a contract.

15. Your Choices

• Email. You may opt out of non-transactional emails at any time by following the unsubscribe instructions in the email or by contacting us. We may still send you transactional or relationship messages, such as those relating to an active engagement.
• Text messages. You may opt out of CommonsWay text messages at any time by replying STOP, as described in Section 3.
• Browser settings. You may configure your browser to block or alert you to cookies and to send a Global Privacy Control signal.
• Declining to provide information. You may choose not to provide Personal Information to us. However, we may then be unable to respond to your request or provide the Services.

16. U.S. State Privacy Rights

Residents of certain U.S. states, including California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia, and other states with comprehensive privacy laws, may have the rights described in this Section, subject to applicable exceptions and to the extent those laws apply to the Company.

16.1 Your Rights

• Right to know and access: to confirm whether we process your Personal Information and to request the categories and specific pieces of Personal Information we have collected, the categories of sources, the business or commercial purposes for collection, and the categories of third parties to whom we disclose it;
• Right to correct: to request correction of inaccurate Personal Information;
• Right to delete: to request deletion of Personal Information we have collected from you;
• Right to data portability: to obtain a copy of your Personal Information in a portable and, to the extent technically feasible, readily usable format;
• Right to opt out: of the sale of Personal Information, the sharing of Personal Information for cross-context behavioral advertising, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in these activities;
• Right to limit: the use of sensitive Personal Information. We do not use sensitive Personal Information for purposes requiring an opt-out right;
• Right to appeal: if we decline to take action on your request, to appeal our decision as described in Section 18; and
• Right to non-discrimination: not to receive discriminatory treatment for exercising any of these rights.

16.2 California Notice at Collection and Disclosures

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), requires us to disclose the following information regarding the preceding twelve (12) months.

Sources. We collect these categories from you directly, automatically from your device, and from the third-party sources described in Section 4.3. Purposes. We collect and use these categories for the purposes described in Section 6. Retention. We retain each category for the periods described in Section 12.

No sale or sharing. We have not sold or shared (as those terms are defined in the CCPA) Personal Information in the preceding twelve (12) months, and we have no actual knowledge of selling or sharing the Personal Information of consumers under sixteen (16) years of age.

Shine the Light. California Civil Code § 1798.83 permits California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. We do not disclose Personal Information to third parties for their direct marketing purposes.

16.3 Nevada Residents

Nevada residents may submit a request directing us not to sell certain covered information. We do not sell covered information as defined under Nevada law, but you may submit a request using the contact information in Section 21.

17. EEA, UK, and Swiss Privacy Rights

If you are located in the EEA, the United Kingdom, or Switzerland, you have the following rights with respect to your Personal Information, subject to applicable conditions and exceptions:

• The right of access to your Personal Information;
• The right to rectification of inaccurate or incomplete Personal Information;
• The right to erasure (“right to be forgotten”);
• The right to restriction of processing;
• The right to data portability;
• The right to object to processing based on legitimate interests, and the absolute right to object to processing for direct marketing;
• The right to withdraw consent at any time, where processing is based on consent; and
• The right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or place of an alleged infringement.

We do not engage in automated decision-making that produces legal or similarly significant effects on you.

18. Exercising Your Rights

To exercise any of the rights described in this Policy, please email us at hi@thegracefulcompany.com with the subject line “Privacy Request,” and describe the nature of your request. For requests relating to the CommonsWay platform, you may also contact support@commonsway.com.

• Verification. To protect your Personal Information, we will take reasonable steps to verify your identity before fulfilling your request, which may include asking you to confirm information we already hold. The verification required will depend on the nature and sensitivity of the request.
• Authorized agents. Where permitted by law, you may designate an authorized agent to submit a request on your behalf. We may require written proof of the agent’s authority and may require you to verify your identity directly with us.
• Response timing. We will respond within the time required by applicable law, which is generally forty-five (45) days for U.S. state privacy requests and one (1) month for requests under EEA and UK law. Where permitted, we may extend this period once by an additional period and will notify you of the extension and the reason for it.
• Appeals. If we decline to take action on your request, you may appeal our decision by replying to our response with the subject line “Privacy Request Appeal.” We will respond to your appeal within the time required by applicable law. If your appeal is denied, you may contact the Attorney General or data protection authority of your jurisdiction.
• Fees. We do not charge a fee to process your request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or decline the request, as permitted by law.

19. Children’s Privacy

The Site and Services are intended for businesses and adults. They are not directed to children under the age of thirteen (13), or under the age of sixteen (16) in jurisdictions where a higher age applies, and we do not knowingly collect Personal Information from such children. If we learn that we have collected Personal Information from a child without verifiable parental consent where such consent is required, we will delete that information promptly. If you believe a child has provided us with Personal Information, please contact us using the information below.

20. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we do, we will revise the “Last Updated” date at the top of this Policy. If we make material changes, we will provide additional notice as appropriate, such as by posting a prominent notice on the Site or by notifying you by email. Your continued use of the Site or Services after an updated Policy becomes effective constitutes your acknowledgment of the updated Policy. We encourage you to review this Policy periodically.

21. Contact Us

If you have any questions, concerns, or complaints regarding this Policy or our privacy practices, or if you wish to exercise your rights, please contact us: