Privacy Policy
Who we are
Greenlight AI operates the website at yourgreenlight.com. We run one-week market validation sprints for startup founders. References to "we," "us," or "Greenlight AI" in this policy refer to the Greenlight AI team.
For data-related questions or requests, contact us at: hello@yourgreenlight.com.
What data we collect and why
We collect personal data in two ways: directly from you when you submit a form, and automatically via analytics tools when you use the site.
Data you submit directly
| Data | Where collected | Why |
|---|---|---|
| First name, last name | Waitlist form | To address you personally when we follow up about your spot. |
| Email address | Waitlist form, contact form | To contact you about your waitlist position or to reply to your inquiry. |
| Phone number | Waitlist form (optional) | To reach you when your spot comes up, if you prefer a call. Not required. |
| Organization or program name | Contact form (optional) | To understand who you represent when responding to partnership or program inquiries. |
| Founder archetype, stage, timing, customer type | Waitlist form (dropdowns and multi-select) | To tailor our response, estimate your sprint scope, and confirm whether your idea is a fit for the kind of validation we do. |
| Message content | Contact form | To understand and respond to your inquiry. |
| Payment and billing data | Stripe (payments for Reality Check and Market Validation) | To take payment for the product you buy. Payment is processed directly by Stripe - we do not see or store your card number. See the Stripe section below. |
Data collected automatically
| Data | How collected | Why |
|---|---|---|
| Page views and site behavior | Google Analytics 4 (GA4) and PostHog | To understand which pages are visited, where traffic comes from, and how visitors interact with the site. Both use cookies and may collect IP address (anonymized by default in GA4). PostHog additionally records which elements you click and a replay of your visit (mouse movement, clicks, scrolling, and the pages you move through). Text you type into form fields is masked and does not appear in replays. |
| UTM / campaign attribution | URL parameters, stored in your browser's sessionStorage | To understand which outreach campaign led you to the site (e.g., a LinkedIn post). This data is attached to form submissions so we can measure which outreach efforts produce real interest. |
| Event log | Stored in your browser's localStorage under the key gl_signals |
A local record of actions you take on the site (e.g., starting a Reality Check, completing a form). This data stays in your browser and is not transmitted to us unless it is included in a form submission. You can inspect or delete it via your browser's developer tools. |
The legal basis for processing (GDPR)
If you are located in the EU or UK, we rely on the following legal bases under GDPR:
- Consent - for all data you submit via forms. You tick a consent checkbox before submitting. You can withdraw consent at any time by emailing us.
- Legitimate interests - for analytics data we collect to understand site performance, to the extent that interest is not overridden by your interests or rights. If you believe it is, you can object (see "Your rights" below).
- Contractual necessity - for payment data processed when you buy a Reality Check or Market Validation, which is a transaction you initiate.
Who we share your data with
We do not sell your data. We share it only with the third-party services that operate parts of this site. Each has its own privacy policy.
Brevo
Waitlist and contact form submissions are processed and stored by Brevo (Sendinblue SAS), which we use to manage our contact list and send us notification of your submission. When you submit a form, the details you provide (such as your name, email, and message) are stored in our Brevo account. Brevo stores data on servers located in the European Union.
Google Analytics 4
Google Analytics 4 is used to measure site traffic and visitor behavior. GA4 collects data via cookies and sends it to Google's servers. Google may process this data in the United States or other countries. Google Analytics IP anonymization is enabled by default in GA4. You can opt out of GA4 tracking using the Google Analytics opt-out browser add-on.
PostHog
PostHog is a product analytics tool we use alongside GA4 to see how visitors move through the site - which pages they reach, which buttons they click, and where they drop off. PostHog sets cookies and sends this data to PostHog servers in the United States. PostHog also records session replays: a reconstruction of your visit showing mouse movement, clicks, scrolling, and the pages you moved through, so we can see where the site confuses people. Form inputs are masked, which means anything you type - your name, email address, or message - is replaced with placeholder characters and is never captured in a replay. We do not create a stored visitor profile for anonymous visits. You can opt out by enabling your browser's Do Not Track setting in combination with a tracker-blocking extension, or by blocking requests to posthog.com.
Stripe
Payments for Reality Check and Market Validation are processed by Stripe. Stripe collects your payment details (card number, billing name, email) directly and securely. We do not see or store your card number. Stripe may retain payment data in accordance with its own privacy policy and applicable financial regulations. Stripe operates servers in the United States and other countries.
Cookies
This site uses cookies set by Google Analytics 4 and by PostHog. These are analytics cookies used to measure visitor behavior. They are not used for advertising or tracking across third-party sites.
Your browser's session storage and local storage are also used to store campaign attribution data and a local event log. These are not cookies in the traditional sense - they are stored only in your browser and are not transmitted to external servers automatically.
How long we keep your data
- Form submissions (Brevo) - retained in Brevo until we delete them manually or until you request deletion. We aim to remove data from founders who did not proceed to a sprint within 12 months of submission, but this is not automated - please contact us to request deletion.
- Stripe payment records - retained by Stripe in accordance with their policies and applicable financial regulations. We retain records of completed transactions for accounting and legal compliance purposes.
- Google Analytics data - retained for 14 months by default (GA4 standard retention setting), after which it is automatically deleted by Google.
- PostHog analytics data and session replays - retained according to our PostHog project settings. Contact us if you want event data or replays associated with your visit deleted.
- Browser-local data (sessionStorage, localStorage) - stored only in your browser. You can delete it at any time by clearing your browser storage or site data.
Your rights
Depending on your location, you have the following rights regarding your personal data. To exercise any of them, email us at hello@yourgreenlight.com.
- Access - you can ask us what personal data we hold about you.
- Correction - you can ask us to correct inaccurate data.
- Deletion - you can ask us to delete your personal data. We will remove it from Brevo and our own records. Note that Stripe data may be subject to retention obligations we cannot override.
- Withdrawal of consent - you can withdraw your consent for us to contact you at any time. This does not affect the lawfulness of processing before your withdrawal.
- Objection - you can object to processing based on legitimate interests (including analytics).
- Portability - you can ask for a copy of the data you submitted to us in a structured, machine-readable format.
If you are in the EU/UK and believe your rights have not been respected, you have the right to lodge a complaint with your local data protection authority.
If you are in Canada (PIPEDA), you have similar rights to access and correction, and the right to challenge our compliance to the Office of the Privacy Commissioner of Canada.
Data security
We use third-party services (Brevo, Stripe, Google) that maintain their own security standards. Form submissions are transmitted over HTTPS. We do not store personal data on our own servers - data lives with Brevo, Stripe, and Google, each of which maintains security certifications appropriate to their services.
Children
This site is intended for adults. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has submitted data to us, please contact us and we will delete it promptly.
Changes to this policy
We may update this policy as our data practices change or as we add new features. The "last updated" date at the top of this page reflects the most recent revision. We will not retroactively reduce your rights without notice.
Contact us
For data requests, privacy questions, or consent withdrawal:
Email: hello@yourgreenlight.com
(Update this address to your confirmed contact email before publishing.)