Privacy Policy
Effective 13 July 2026 · Last updated 13 July 2026
Who we are
Grenlit is operated by MadThinkMarketing OÜ, a private limited company registered in Estonia. You can reach us at madeleine@madeleineschulze.com.
What data we collect and why
We collect and process the following categories of personal data:
Account data. When you sign up, we collect your first name, last name, and work email address. We use this to create and manage your account and to send you service-related communications.
Company data. During onboarding, we collect your company name, website, industry, company size, country, and VAT number. We use this to personalise your reports and display your company details on PDF exports.
Event data. When you create a report, we collect the event data you enter manually - including budget figures, lead counts, pipeline values, and channel performance data. This data is stored to generate your reports and power the event comparison and annual planning features.
Usage data. We collect basic usage information such as pages visited, features used, and session duration to improve the product. We do not sell this data or use it for advertising purposes.
Integration voting. If you submit your email to vote for an integration, we store your email address and integration preference to notify you when that integration launches.
Contact form submissions. If you contact us via the contact form, we store your name, email address, subject, and message content to respond to your enquiry.
Legal basis for processing (GDPR)
We process your personal data on the following legal bases under the EU General Data Protection Regulation (GDPR):
- Contract performance (Article 6(1)(b)) - to provide the Grenlit service you signed up for.
- Legitimate interests (Article 6(1)(f)) - to improve the product, ensure security, and communicate relevant product updates.
- Consent (Article 6(1)(a)) - for any optional marketing communications, which you can withdraw at any time by contacting us at madeleine@madeleineschulze.com.
- Legal obligation (Article 6(1)(c)) - where processing is required to comply with applicable law.
How long we keep your data
We retain your personal data for the following periods:
- Account and event data: retained for as long as your account is active.
- Contact form submissions: retained for 12 months.
- Integration voting data: retained until the relevant integration launches or for 24 months, whichever is sooner.
- Usage data: retained for 12 months on a rolling basis.
If you delete your account, all associated personal data is permanently deleted within 30 days, except where retention is required by law.
Who we share your data with
We use the following third-party data processors. All processors are bound by data processing agreements and required to process data only on our instructions:
- Supabase Inc. (database and authentication infrastructure) - EU data residency selected. Privacy policy: supabase.com/privacy.
- Anthropic PBC (AI report generation) - your event data is transmitted to the Anthropic API solely to generate report narratives and recommendations. Anthropic does not use this data to train AI models. Privacy policy: anthropic.com/privacy.
We do not sell your personal data to third parties under any circumstances. We do not share your data with advertisers.
International data transfers
Anthropic PBC is based in the United States. When your event data is sent to the Anthropic API for report generation, it is transferred outside the European Economic Area. This transfer is carried out under appropriate safeguards in accordance with GDPR Article 46, including Standard Contractual Clauses where applicable.
Supabase data is stored within the EU and does not involve international transfers.
Your rights under GDPR
As a data subject under GDPR, you have the following rights:
- Right of access - to request a copy of the personal data we hold about you.
- Right to rectification - to correct inaccurate or incomplete personal data.
- Right to erasure - to request deletion of your personal data where there is no legitimate reason for us to continue processing it.
- Right to restriction - to request that we restrict processing of your personal data.
- Right to data portability - to receive your personal data in a structured, machine-readable format.
- Right to object - to object to processing based on legitimate interests.
- Right to withdraw consent - where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at madeleine@madeleineschulze.com. We will respond within 30 days. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at www.aki.ee.
Cookie Policy
What are cookies? Cookies are small text files stored on your device when you visit a website. They help websites function correctly and remember your preferences.
Cookies we use.
| Cookie name | Purpose | Type | Duration |
|---|---|---|---|
| sb-access-token | Supabase authentication session | Strictly necessary | Session |
| sb-refresh-token | Keeps you logged in between sessions | Strictly necessary | 30 days |
| sb-provider-token | Supabase OAuth provider session | Strictly necessary | Session |
What we do not use. We do not use:
- Advertising or tracking cookies.
- Third-party analytics cookies (such as Google Analytics).
- Social media tracking cookies.
Managing cookies. You can control and delete cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to Grenlit.
Changes to this policy
We may update this Privacy Policy as the product evolves. We will notify registered users of material changes by email at least 14 days before they take effect. The effective date at the top of this page will always reflect the date of the most recent update.