Privacy Policy

Effective May 19, 2026

Greetform ("greetform," "we," "us") provides subscriber onboarding and offer routing software for newsletter operators. This policy explains what information we collect, how we use it, and the choices you have. It applies to greetform.com, app.greetform.com, and any onboarding flow we host on behalf of a newsletter operator (each, an "operator").

1. Who controls your data

When a newsletter operator uses greetform to capture or route subscriber information, that operator is the data controller for their subscribers. Greetform is the data processor: we store and process subscriber data on the operator's behalf, under their instructions and under this policy.

When you visit greetform.com directly, request a demo, or use the operator dashboard at app.greetform.com, greetform is the controller for that data.

2. What we collect

From subscribers going through an operator's onboarding flow:

• Email address and any other contact details the subscriber provides.
• Answers to the operator's survey questions (for example: do you own or rent, ZIP code, interests).
• Session metadata: timestamps, page paths, the brand and offer that was shown, whether the subscriber clicked through or claimed an offer.
• Device metadata: IP address, browser user agent, and referrer, used for fraud prevention and basic diagnostics.

From operators using the dashboard:

• Account email and authentication credentials (handled by Supabase Auth).
• Organization and team membership, including invited collaborators.
• Integration credentials you connect (Beehiiv, Resend, and similar) so we can sync subscribers and send transactional email on your behalf.

From visitors to greetform.com:

• Standard server logs (IP, user agent, page paths) used to operate the site and detect abuse.
• Anything you voluntarily submit through a Book a call request or other contact form.

3. How we use it

• To run the onboarding flow, route subscribers to the right offer, and deliver leads to the local business that purchased them.
• To send transactional email related to the service (account, password, lead notifications).
• To debug, secure, and improve the product.
• To meet legal obligations and respond to lawful requests.

We do not sell subscriber data. We do not use subscriber data to train third-party AI models. We do not run advertising on our own properties using subscriber data.

4. Who we share it with

We share data only with vendors required to operate the service:

• Supabase: primary database, authentication, and storage.
• Vercel: hosting, edge runtime, and request logs.
• Resend: transactional email delivery.
• Beehiiv: subscriber sync to operator newsletters, when an operator has connected their Beehiiv account.
• TidyCal: scheduling of demo calls requested from greetform.com.

When a subscriber claims an offer, the relevant contact details and the answers that qualified the offer are shared with the local business that purchased that lead. See the Lead Tracking page for the full description of what is shared.

5. Retention

Subscriber records are retained for as long as the operator keeps their account active, plus a short reconciliation window after deletion (typically 30 days). Aggregated, non-identifying analytics may be retained longer. Operators can request deletion of their account and all associated records at any time by emailing us.

6. Your rights

Depending on where you live (for example, under GDPR or the CCPA), you may have the right to access, correct, port, or delete your personal data, and to object to certain processing. To exercise any of these rights, contact the operator who collected your information, or email greetform directly and we will route the request.

7. Children

Greetform is not directed to children under 13. Operators are responsible for ensuring their newsletters and onboarding flows comply with applicable child-privacy laws.

8. Security

We use industry-standard transport encryption (HTTPS), encrypted storage at rest, and row-level security on subscriber tables. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify the affected operator without undue delay.

9. Changes

We may update this policy from time to time. The "Effective" date above always reflects the current version. Material changes will be announced in the operator dashboard.

10. Contact

Questions: tj@greetform.com. Greetform is operated from Georgetown, Texas.