1. Scope and who is responsible
This Privacy Policy explains how GreenLightOS handles personal data when you use GreenLight, WritersRoom, VitaeMe, Development Intelligence Reports, Professional Script Coverage, membership, billing, support, and related services.
GreenLightOS.ai operates in the United Kingdom, including when serving US customers. Privacy questions and rights requests can be sent to hello@greenlightos.ai. Our operating country does not mean your data is stored only in the UK; international processing is explained below.
2. Data we collect
Account and identity data: name, email address, authentication records, account role, profile information, and security settings.
Creator and project data: scripts, treatments, pitch materials, writing samples, project files, extracted text, prompts, conversations, notes, preferences, credits, report inputs, and generated reports.
Commerce data: selected products and plans, order and subscription status, prices, promotions, complimentary or VIP access, entitlements, usage, invoices, refunds, payment status, Stripe customer and transaction references, policy versions accepted, and the time and source of acceptance. GreenLightOS does not receive full payment-card numbers from Stripe.
Technical and usage data: device and browser information, approximate location inferred from an IP address, session and security events, feature usage, error logs, request metadata, and support communications.
Public verification data: where you choose or authorise blockchain features, public wallet addresses, transaction identifiers, timestamps, schemas, and cryptographic hashes.
3. How we use data
We use data to create and secure accounts; provide projects, AI-assisted tools, reports, coverage, membership, and verification features; process orders and entitlements; personalise your experience; operate customer support; detect abuse and security incidents; troubleshoot and improve reliability; maintain records; enforce terms; and comply with law.
We use Creator Content to provide the feature or report you request. Product improvement should rely on technical usage data, feedback, and appropriately de-identified or aggregated information—not private creative text used to train models without consent.
4. Our reasons for processing
Depending on where you live and the activity involved, we process personal data because it is necessary to perform our contract with you, to take steps you request before a contract, to meet legal obligations, for legitimate interests such as security and service improvement, or with your consent.
Marketing consent is optional, separate from purchase acceptance, and can be withdrawn. Withdrawing consent does not affect processing already carried out lawfully or processing supported by another valid reason.
5. Creative content and AI
Creator Content is private by default. It is not made available to other GreenLightOS users unless you deliberately use a sharing feature. Authorised GreenLightOS personnel and contracted providers may access the minimum necessary content for support, security, legal compliance, storage, extraction, and AI inference.
GreenLightOS.ai does not itself use scripts, treatments, writing samples, project conversations or other Creator Content to train or fine-tune AI models without your explicit, specific consent. AI inference means using a model to answer a request; it is not the same as training model weights. Voice calibration and project memory are context used for responses, not a statement that we fine-tune a model on your writing.
Provider handling depends on the selected commercial/API service, applicable agreement, endpoint/model and account controls. OpenAI states that API data is not used for training by default unless the customer opts in. This is not certification of every intermediary's settings or every provider/model's terms. See the named provider register below for the implemented routes and verification limits. Training restrictions do not imply zero retention, no abuse monitoring or no authorised human review. Safety, legal or security requirements may lead to provider retention or review. We do not represent consumer chatbot policies as the terms governing our commercial APIs.
AI systems may generate analyses, summaries, suggestions, scores, and reports. These outputs are assistive and may be incomplete or inaccurate. They are not intended to make decisions that produce legal or similarly significant effects about you.
6. Payments, subscriptions, and promotions
Stripe processes payment methods, checkout, subscription billing, invoices, refunds, disputes, and fraud checks. Stripe’s own privacy terms apply to data it controls. GreenLightOS receives the information needed to reconcile payment and access, such as customer and transaction references, amount, currency, status, billing period, and limited billing details.
We record promotion eligibility and redemption, complimentary access, VIP grants, entitlements, report usage, and policy acceptance so we can provide access, prevent abuse, answer billing questions, and preserve an auditable commercial record. Complimentary and VIP access are recorded separately from paid revenue.
7. Service providers and disclosures
We may share the minimum necessary data with providers that support hosting, object storage, databases, AI inference, payments, email, authentication, analytics, security, error monitoring, customer support, and professional advice. Providers must handle data under contractual and confidentiality obligations appropriate to their role.
The named provider register on this page explains implemented services, roles, data categories and links to their published information. It distinguishes an implemented alternative from a provider confirmed active for a particular request, and infrastructure subcontractors from direct contracts. Not every provider is a processor for every purpose: payment and other providers may independently determine some legally required processing.
We may also disclose data when reasonably necessary to comply with law, protect users or the Service, investigate fraud or security incidents, establish or defend legal claims, or complete a business transaction subject to appropriate safeguards.
We do not sell Creator Content. We do not sell personal data for money. If applicable law treats certain advertising or analytics disclosures as a “sale” or “sharing,” we will provide the choices that law requires before using those practices.
8. International processing
UK operation does not mean UK-only hosting. GreenLightOS.ai and its providers may process data outside your country, including in the United States. Public provider documentation does not certify the location of every GreenLightOS.ai database, storage bucket, log or backup.
Restricted international transfers are subject to applicable data-protection requirements. Depending on the transfer, the relevant safeguards may include an adequacy basis or approved contractual arrangements, such as a UK IDTA or UK Addendum. Contact hello@greenlightos.ai for details about processing locations or the safeguards applicable to your data.
9. Retention and deletion
We keep personal data only as long as reasonably needed for the purposes described here. Account and project data is generally kept while your account or project remains active. Creative uploads and generated reports may be retained so you can access the purchased service, unless you delete them or ask us to do so and no overriding legal or security need applies.
User-requested account deletion ordinarily provides 30 days to recover the account before permanent-deletion processing becomes eligible. A protected administrator hard-delete override may bypass that period for an authorised reason. The account-deletion notice explains its scope. Export important files and reports first; cancelling a subscription is not account deletion. Individual project/file deletion is not a promise of a 30-day recovery period.
Deletion processing removes eligible application data and associated files, but retries, safety checks, outstanding work, legal holds and provider records can require separate handling. The recovery period is not a guarantee that all copies, logs or backups vanish on day 30.
Order, payment, tax, policy-acceptance, entitlement, refund and dispute records may be retained while required for accounting, tax, fraud prevention, open claims or other legal obligations, with access restricted to those purposes. Provider-controlled financial records and public blockchain records may persist independently. Security logs and backups have separate retention needs and should not be used to restore deleted accounts into ordinary service after erasure.
Retention depends on the record's purpose, applicable legal requirements, unresolved billing or disputes, security needs and provider handling. Contact hello@greenlightos.ai for information about a particular record or a deletion request.
10. Your choices and rights
Depending on applicable law, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data, and to complain to a data-protection authority. You may also withdraw consent where consent is the basis for processing.
You may object to processing based on legitimate interests and may object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. We do not make all processing conditional on a blanket privacy consent.
Send requests to hello@greenlightos.ai. We may need to verify your identity and may retain information where law, fraud prevention, security, billing, disputes, or the rights of others require it. We will respond within the period required by applicable law. You can complain to the UK Information Commissioner's Office at ico.org.uk or another competent authority where applicable. US state rights depend on the law, its applicability and your circumstances; this Policy does not claim every state privacy statute applies to us.
11. Cookies and account sessions
We use cookies and similar browser storage that are necessary for sign-in, authentication, security, preferences, checkout continuity, and core operation. Any optional analytics or marketing technologies should be disclosed and, where required, enabled only after consent. Browser restrictions may affect some features.
12. Blockchain records
Blockchain records can be public and difficult or impossible to erase. GreenLightOS aims to place only permitted public wallet information, transaction metadata, and cryptographic hashes on-chain—not source files, private creative text, or full reports. A hash can verify integrity without revealing the underlying content, but public metadata may still be personal data in some circumstances.
13. Security, children, and changes
We use technical and organisational safeguards designed to protect data, including access controls, encrypted transport, security logging, and provider controls. No internet-based system can guarantee absolute security. Unauthorised access, disclosure, loss or corruption remains possible. This warning does not waive our legal duties or your rights to complain or seek a remedy. If an incident affects your data, we will investigate and notify affected people and authorities where and when applicable law requires it.
The Service is intended for people aged 18 or over and is not directed to children. If you believe a child has provided personal data, contact us.
We may update this Policy as the Service and legal requirements change. The last-update date appears at the top. Material changes will be communicated or presented for renewed acknowledgement where required.