1. Who is responsible for your data
[LEGAL ENTITY NAME], of [REGISTERED ADDRESS], is the controller of the personal data described here.
For anything concerning your personal data — a copy of it, a correction, deletion, or a complaint — write to privacy@greenlightadvs.com. That address reaches a person, not a queue, and we answer within 30 days.
2. What we collect
Account details
Your name, email address, role (creator or company), region, plan, and the date the account was created. Passwords are stored only as cryptographic hashes by our authentication provider; we never see or store the password itself. If an account is closed for a breach of the terms, we record that fact and the reason.
Creator profile
A biography, profile picture link, country, primary language, starting rate, social media handles, and a URL slug for your public profile. All of it is optional and all of it is entered by you.
Audience figures
For each platform a creator connects: the platform, the channel handle, average views, average concurrent viewers, engagement rate, content category and language, content tags, and audience geography. Audience geography is stored in two separate fields — one for figures you entered yourself, one for figures retrieved from a platform's own analytics API — and the product always shows which of the two it is displaying.
Deals and messages
The sponsor's email address, the deal's status, the amount offered, our recommended price and risk rating, the deliverable type, the countries the sponsor wants to reach, and every message exchanged in the deal room.
Messages are filtered before they are stored. Email addresses, phone numbers and links to external messaging services are replaced with a placeholder server-side, before the message reaches our database. The unfiltered text is never written to storage.
Records of attempts to exchange contact details
When that filter is triggered we record which rule matched, a redacted extract of the message, and the account and deal it relates to, so that an administrator can review it. The extract stores the already-filtered text, not the original.
Forwarded email
Creators are given an inbound Green Light address and may set up forwarding from their ordinary business address to it. When a message arrives we record the provider's message identifier, the address it was sent to, the sender's address and whether processing succeeded, and we turn the message into a deal.
This means we process personal data belonging to the sender — a person at a sponsoring company who is not a Green Light user. We process it to deliver the service the creator asked for, we apply the same contact filter to it, and a sender may write to privacy@greenlightadvs.com to ask what we hold about them. Green Light does not connect to your mailbox, does not ask for access to your email account, and can only ever see messages that were forwarded to the address we issued.
Sponsor domain checks
To help creators judge an unfamiliar sponsor, we look up public registration information for the sender's email domain and check links in the message against a malicious-URL database. The result — the domain, its registration record, whether anything was flagged, and a trust score — is stored with the deal.
Notifications
If you opt in, a WhatsApp phone number, used only to tell you a new deal has arrived. Turning the option off stops the messages; deleting the number removes it.
Technical records
Counters recording how many times an account has used the automated analysis features, to enforce the limits in our terms. Standard server logs held by our hosting provider. Green Light sets no advertising cookies and runs no third-party analytics or tracking scripts. The only data stored in your browser is your session, your theme and your language preference.
3. Why we use it, and on what legal basis
- To provide the service — running your account, delivering offers, hosting negotiations, producing recommendations, tracking deals and charging commission. Basis: performance of our contract with you.
- To protect the platform and its commission — filtering contact details from messages, recording attempts to bypass that filter, checking sponsor domains, and limiting automated use. Basis: our legitimate interests in preventing fraud and abuse and in operating a viable service.
- To retrieve verified audience figures from YouTube or Instagram. Basis: your consent, given when you connect the account and withdrawable at any time.
- To send WhatsApp notifications. Basis: your consent, withdrawable in settings.
- To meet legal and accounting obligations. Basis: legal obligation.
4. Automated analysis of offer text
The text of an offer, and the most recent message in a deal room when you ask for a suggested reply, are sent to a third-party AI service to produce a price recommendation, a risk rating, or a draft reply.
We instruct that this content is used for that evaluation only. We do not sell it, do not use it to train models, and do not send it anywhere else. One limitation we state plainly rather than bury: our current AI provider's terms allow it to retain submitted content for a limited period — up to 30 days on the tier we use — for its own security monitoring. That is the provider's retention, not ours, and we are reviewing it.
These recommendations do not produce a legal or similarly significant decision about you. Nothing is automatically accepted, rejected or priced on your behalf: a recommendation is shown to a person, who decides.
5. Google user data
If you connect a YouTube account, we request read-only access to your YouTube analytics in order to retrieve the geographic breakdown of your audience, and we read public channel statistics to populate your media kit.
Green Light's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- we use Google user data only to provide and improve the audience-verification feature you connected it for;
- we do not transfer it to others except as needed to provide that feature, for security purposes, or to comply with applicable law;
- we do not use it for advertising;
- we do not allow humans to read it, except with your explicit consent for a specific support request, where it is necessary for security, or where the law requires it;
- we do not sell it.
Disconnecting the account in your media kit settings immediately deletes the stored access tokens, clears the verified figures, and returns your audience geography to self-reported. You can also revoke access from your Google account permissions page.
6. Meta and Instagram data
If you connect an Instagram professional account, we request access to its insights to retrieve your audience's country breakdown, and to recent post captions if you ask us to detect your content niche.
We use it only for those two features, we do not use it for advertising, and we do not sell or transfer it. Disconnecting in your media kit settings deletes the tokens and clears the derived figures immediately. You can also remove Green Light from your Instagram or Facebook apps settings.
Separately, if you opt into WhatsApp notifications we send your number and the notification text to Meta's WhatsApp Business API to deliver the message.
7. Who else processes your data
We do not sell personal data and we do not share it for advertising. We use these providers to run the service, each processing only what their function requires:
- Supabase — database, authentication and storage. Our database is hosted in Frankfurt, Germany.
- Vercel — application hosting and server logs.
- Resend — receiving forwarded email and sending platform email on a creator's behalf.
- NVIDIA — the AI service that produces price recommendations, risk ratings and draft replies (see section 4).
- Google — YouTube statistics and analytics you have connected, and the malicious-URL check applied to links in offers.
- Meta — Instagram insights you have connected, and WhatsApp notification delivery if you opted in.
- IP2WHOIS — public domain registration lookups for sponsor domains.
We may also disclose data where the law requires it, to establish or defend a legal claim, or to a buyer if the business is sold — in which case we would tell you first.
Our support runs on Discord, which is a separate service with its own privacy policy. Anything you choose to tell us there is handled under Discord's terms as well as ours.
8. Where your data goes
Your account and deal data is stored in Frankfurt, Germany. Several of the providers above are based in the United States, so some data is transferred outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses or an equivalent approved mechanism.
9. How long we keep it
- While your account is open — account, profile and audience data is kept for as long as you use Green Light.
- Deals and messages — kept for 24 months after an account closes, so that a commission dispute or a question about a past deal can still be resolved, then deleted.
- Records of contact-exchange attempts — kept for 24 months after closure, so a closure can be reviewed or appealed, then deleted.
- Platform access tokens — deleted immediately when you disconnect the account, and when your account closes.
- Rate-limit counters — overwritten continuously; they hold only a count and a timestamp, never message content.
10. Your rights
Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Where we rely on your consent — connected analytics accounts, WhatsApp notifications — you can withdraw it at any time without affecting what we did before you withdrew it.
To delete your data: write to privacy@greenlightadvs.com from the address on your account, or ask in the support channel. We will confirm, close the account, and delete your personal data within 30 days, apart from the records in section 9 that we are keeping for a stated period and anything we must retain by law. You can delete connected platform data yourself at any time by disconnecting the account in your media kit.
If you are in the European Economic Area or the United Kingdom and you think we have handled your data badly, you can complain to your national data protection authority. We would rather you told us first so we can put it right.
11. Keeping it safe
Data is encrypted in transit and at rest. Access between accounts is enforced at the database level, not only in the application, so one account cannot read another's deals or messages even if the application were to misbehave. Contact details are filtered out of messages before storage. Access to production data is restricted to administrators who need it.
No system is perfectly secure. If a breach affects your personal data and is likely to put you at risk, we will tell you and the relevant authority without undue delay.
12. Children
Green Light is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will remove it.
13. Changes
We will update this policy as the product changes. The date at the top shows the current revision, and we will notify account holders before a material change takes effect.
14. Contact
privacy@greenlightadvs.com for anything in this policy. See also our Terms of Service.