Privacy Policy

Effective date: February 25, 2026
Last updated: May 1, 2026

This Privacy Policy explains how GreenRoot Analytics B.V. (“GreenRoot”, “we”, “us”) processes personal data when providing the GreenRoot Analytics platform (the “Service”).

Our commitment. We aim to operate the Service with maximal transparency and a privacy-first mindset. We therefore describe, in plain language, what data we process, why we process it, and the limited circumstances in which we share it with service providers (sub-processors). If you think something is unclear or could be improved, please contact us.

1) About us

GreenRoot Analytics B.V.
Hoofdweg 136, 9619PH Froombosch, The Netherlands
KVK 99442337
BTW-id NL868993153B01
Contact: contact@greenrootanalytics.com

2) Roles: controller vs processor

2.1. When a customer uses the Service to run surveys:

• the customer is typically the data controller for survey response data; and
• GreenRoot is typically the data processor for survey response data.

2.2. For GreenRoot’s own website/account administration, workspace-access and support workflows, billing and invoicing activities, anonymous public-site traffic measurement, and consent-based product analytics, GreenRoot acts as a controller.

3) What we collect

3.1. Account and workspace data may include:

• name, email address, and job title; and
• workspace/company details (e.g. company name, plan tier/status, workspace credits, and configuration); and
• preferred language, workspace role, invitation records, workspace-access request/approval records, and account verification / password-reset records; and
• billing/contact details and billing records (for example billing contact name/email, VAT or tax information, subscription or purchase history, invoice metadata, and payment status).

3.2. Survey/journey data (customer-controlled) may include:

• journey configuration (titles, questions, answer options); and
• survey responses and associated metadata; and
• participant/audience list data, participant email addresses, invite/reminder delivery metadata, respondent segmentation attributes, and generated exports or report artifacts requested by the customer.

3.3. Anonymous basic traffic measurement (always on for public pages). We collect limited, first-party pageview data for public pages so we can quantify overall traffic without visitor/session IDs, attribution cookies, or account/workspace linkage.

3.4. Product analytics (consent-based). If you opt in to analytics cookies, we collect limited, pseudonymous usage data to understand traffic and improve onboarding and product quality across the public Journey Studio surfaces and, when you are logged in, inside the Journey Studio app. This may include our own first-party analytics identifiers/cookies and Google measurement in consent mode on the public website. We do not use this for third-party advertising, cross-site tracking for advertising purposes, or selling personal data.

3.5. In practice, anonymous basic traffic measurement may include:

• page path and full URL;
• timestamps (when an event occurred/was received);
• language; and
• country and region/province derived from the request IP at collection time. We do not store the IP itself.

3.6. In practice, consented analytics data may include:

• event category (e.g. page views, onboarding milestones, key feature interactions);
• timestamps (when an event occurred/was received);
• page path and full URL;
• referrer (where you came from);
• language; and
• campaign attribution parameters (UTM source/medium/campaign/term/content), if present.

3.7. If you consent to analytics, we may set pseudonymous identifiers in first-party cookies (for example: a visitor identifier, a session identifier, and attribution metadata) and allow Google Analytics / Google tag to measure public-site usage. Typical retention for our first-party identifiers is:

• visitor identifier: up to ~13 months;
• session identifier: ~30 minutes of inactivity; and
• attribution metadata: up to ~30 days.

3.8. When you are logged in, analytics events may also be linked to your account and workspace to understand product usage and improve the Service. This can include pageviews, onboarding milestones, pricing/billing navigation, and key workspace interactions. We do not use this for advertising.

3.9. Operational and security logs may include:

• audit events for privileged admin actions; and
• error events and diagnostic records needed for reliability and abuse prevention; and
• records related to email delivery, rate limiting, deletion confirmations, workspace-access approvals, export jobs, and report generation.

3.10. Cookies and similar technologies. We use first-party cookies for:

• necessary: session/security and abuse prevention;
• functional: language preference and cookie consent choice; and
• basic traffic measurement: anonymous public-page pageviews without visitor/session IDs or attribution cookies; and
• analytics (optional): only after opt-in; used to improve the product funnel and onboarding, including consent-gated first-party analytics identifiers, attribution cookies, and Google measurement in consent mode on the public website.

3.11. You can change your cookie settings at any time from the public-site cookie banner/footer, from Journey Studio Settings, or by clearing cookies.

4) How we use personal data

4.1. We use personal data to:

• provide, operate, and maintain the Service;
• authenticate users and secure access;
• send transactional emails (verification, password reset, invitations, export-ready notifications, etc.);
• process payments, issue invoices/receipts, and manage billing changes;
• process workspace-access requests, approvals, invitations, and deletion confirmations;
• provide support and communicate operational notices;
• improve the product (including consented analytics); and
• prevent fraud and abuse and enforce rate limits.

4.2. AI-assisted features. The Service may include AI-assisted features (for example website-context extraction, guided journey/question/phase/KPI generation, and executive summary generation). These features may require sending limited Customer Content, business context, survey/report context, or user-supplied URLs/content to our AI sub-processor. See the Data Processing Addendum (DPA) and its Sub-processors section.

5) What we do not do

5.1. We do not sell personal data.

5.2. We do not use third-party advertising trackers.

5.3. We do not perform “people-level” marketing profiling (i.e., building marketing profiles tied to identifiable individuals for ad targeting).

6) Legal bases (GDPR/EEA)

6.1. Depending on context, our processing may rely on:

• contract performance (providing the Service);
• legitimate interests (security, abuse prevention, and service improvement);
• consent (optional analytics cookies); and
• legal obligations (where applicable).

7) Data retention

7.1. We retain personal data only as long as necessary for:

• providing the Service;
• meeting contractual requirements;
• security/abuse prevention; and
• legal obligations.

7.2. We apply retention and cleanup practices designed to minimize stored personal data over time. Current default targets include:

• consented marketing/product analytics event retention of up to approximately 14 months; and
• anonymous public-page traffic retention of up to approximately 180 days.

7.3. When we act as a processor, retention of Customer Content is primarily governed by the customer’s instructions and the applicable DPA. Workspace owners may also initiate deletion of certain workspace resources inside the Service, and some destructive actions require confirmation by email before removal is completed.

8) Data sharing / sub-processors

8.1. We may share data with service providers and sub-processors to operate the Service (for example hosting, email delivery, AI providers, payment/billing providers, analytics/measurement providers, and storage providers used for exports or report artifacts where configured).

8.2. For billing and invoice administration, we currently use Stripe as our payment provider. Stripe may process billing/contact details, VAT or tax information, invoice metadata, payment status, and related support context for GreenRoot’s own controller-side billing activities. We do not store full payment card details on our own systems when Stripe Checkout or the Stripe customer portal is used.

8.3. If optional analytics is enabled, Google may receive limited measurement data from public-site interactions through Google tag / Google Analytics in consent mode. We do not use Google for advertising personalization.

8.4. See: Sub-processors (listed in our Data Processing Addendum (DPA)) for processor-side services used to deliver the Service on behalf of customers.

9) International transfers

9.1. If personal data is transferred outside the EEA/UK, appropriate safeguards will be used (for example Standard Contractual Clauses (SCCs), as applicable).

10) Special category (sensitive) data

10.1. The Service is not designed for the collection of special category personal data (as defined in Article 9 GDPR) or highly sensitive information. Customers should avoid collecting such data in surveys.

10.2. Because surveys can include free-text fields, respondents may choose to enter sensitive information. If we become aware of such data, we will take reasonable steps to support deletion or anonymization where feasible.

11) Automated decision-making

11.1. We do not use personal data for automated decision-making (including profiling) that produces legal effects or similarly significantly affects individuals.

12) Your rights

12.1. Depending on the jurisdiction, individuals may have rights to access, correction, deletion, restriction, portability, and objection.

12.2. If you are a customer user (workspace user), you can contact us at contact@greenrootanalytics.com.

12.3. If you are a survey respondent, your request should usually be directed to the customer running the survey (as controller). We support our customers with tooling to export, delete, and anonymize data where appropriate.

12.4. You also have the right to lodge a complaint with the relevant supervisory authority. In The Netherlands, this is the Autoriteit Persoonsgegevens.

13) Contact

13.1. For privacy questions, contact contact@greenrootanalytics.com.