Privacy policy

• Businesses who sign up to Greenlit to send quotes (“you”).
• Their customers, the people who receive a quote link or fill in a request form.

For your own account details, Amethyst Apps is the controller. For the customer details you put into Greenlit, you are the controller and we act as your processor: we only use that data to run Greenlit for you.

From businesses:

• Your name, email address and password (stored as a secure hash), or your Google profile if you sign in with Google.
• Business details you add: name, contact details, logo, brand colour, terms, country, currency, language, tax setting and bank details for display on quotes.
• Your quotes, requests, and progress updates with any photos you add.
• Your Stripe account ID and status, and your Greenlit plan. We never see or store full card numbers.

From customers:

• Name, and email address if given. Greenlit doesn't ask for customers' phone numbers or home addresses.
• What they asked for on a request form, and any budget or timing they mention.
• Whether they opened, accepted or declined a quote, the name they typed when accepting, and when.
• Payment confirmations from Stripe (amount, date and reference, not card details).

We also keep basic technical logs (such as IP address and browser type) to run the service securely.

• To run Greenlit: show quotes, take payments, send the emails the service needs (quotes, reminders, receipts, alerts and account emails).
• To bill you for Greenlit Pro.
• To keep the service secure, fix problems and improve it.
• To meet legal duties, such as keeping financial records.

Our lawful bases are performing our contract with you, our legitimate interest in running a secure and reliable service, and legal obligation. We don't sell personal data, and we don't use it for advertising.

Only the service providers we need to run Greenlit:

• Gadget: hosting and database.
• Stripe: card payments for businesses' customers, and Greenlit Pro subscriptions. Stripe's own privacy policy also applies to payments.
• Resend: sending emails.
• Google: only if you choose “Sign in with Google”.
• Sentry: error reports, so we can fix problems quickly.

Some of these providers process data outside the UK, including in the United States. Where they do, transfers are protected by the UK's approved safeguards, such as the UK International Data Transfer Addendum or the UK–US data bridge.

Greenlit only uses cookies that are needed for it to work, such as keeping you signed in, protecting forms and remembering the language you picked. We don't use advertising or tracking cookies, so there's no cookie banner. Stripe sets its own cookies on its payment pages to prevent fraud.

Greenlit deletes what it no longer needs automatically:

• Draft quotes nobody has touched: deleted after 6 months.
• Declined, expired or cancelled quotes with nothing paid: deleted after 12 months.
• Finished quotes: after 2 years the customer's name and email are removed and progress photos deleted. The amounts stay so the business has a record.
• Requests from the public form: deleted 6 months after they're dealt with, or after 12 months if never answered.
• Your account: until you delete it, which you can do yourself in Settings at any time. Everything is deleted straight away.
• Technical logs: up to 30 days.

Payment records held by Stripe, and in a business's own Stripe account, are kept by Stripe under its own policy. Businesses can also delete requests and unpaid quotes themselves at any time.

You can ask to see, correct, delete or move your personal data, or object to how we use it. Email support@amethystapps.com. We'll reply within a month.

If you're a customer of a business using Greenlit, contact that business first, because they decide what happens to your details. We'll help them respond.

You can also complain to the Information Commissioner's Office at ico.org.uk.

Everything is sent over encrypted connections. Each business can only see its own data. Quote links use long random codes that can't be guessed, and quotes aren't shown in search engines.

If we change this policy in a way that matters, we'll email account holders before it takes effect.