Privacy Policy

Last updated October 12, 2026

greetform ("greetform," "we," "us") provides subscriber onboarding and offer routing software for newsletter operators. This policy explains what information we collect, how we use it, and the choices you have. It applies to greetform.com, app.greetform.com, and any onboarding flow we host on behalf of a newsletter operator (each, an "operator").

1. Who we are and who controls your data

greetform is operated by Luckiest Man Ventures LLC, doing business as 8th Replay. We are headquartered in Williamson County, Texas, in the greater Austin area.

When a newsletter operator uses greetform to capture or route subscriber information, that operator is the data controller for their subscribers. greetform is the data processor: we store and process subscriber data on the operator's behalf, under their instructions and under this policy.

When you visit greetform.com directly, request a demo, or use the operator dashboard at app.greetform.com, greetform is the controller for that data.

2. What we collect

From subscribers going through an operator's onboarding flow:

• Email address and any other contact details the subscriber provides.
• Answers to the operator's survey questions (for example: do you own or rent, ZIP code, interests).
• Session metadata: timestamps, page paths, the brand and offer that was shown, whether the subscriber clicked through or claimed an offer.
• Device metadata: IP address, browser user agent, and referrer, used for fraud prevention and basic diagnostics.

From operators using the dashboard:

• Account email and authentication credentials (handled by Supabase Auth).
• Organization and team membership, including invited collaborators.
• Integration credentials you connect (Beehiiv, Resend, and similar) so we can sync subscribers and send transactional email on your behalf.

From visitors to greetform.com:

• Standard server logs (IP, user agent, page paths) used to operate the site and detect abuse.
• Google Analytics visit, traffic and usage statistics from greetform.com and the account pages of app.greetform.com.
• Anything you voluntarily submit through a Book a call request or other contact form.

When you connect ChatGPT:

We receive the tool requests you ask ChatGPT to send, including your form brief, questions, answer choices and draft changes. The connection also records the workspace, publications and draft permissions you approve. Connecting does not give greetform automatic access to your full ChatGPT conversation history.

3. How we use it

• To run the onboarding flow, route subscribers to the right offer, and deliver leads to the local business that purchased them.
• To send transactional email related to the service (account, password, lead notifications).
• To debug, secure, and improve the product.
• To meet legal obligations and respond to lawful requests.

We do not sell subscriber data. We do not use subscriber data to train third-party AI models. We do not run advertising on our own properties using subscriber data.

4. Who we share it with

We share data only with vendors required to operate the service:

• Supabase: primary database, authentication, and storage.
• Vercel: hosting, edge runtime, and request logs.
• Resend: transactional email delivery.
• Beehiiv: subscriber sync to operator newsletters, when an operator has connected their Beehiiv account.
• TidyCal: scheduling of demo calls requested from greetform.com.
• Google Analytics: visit-count, traffic and site usage statistics on greetform.com and on the account pages of app.greetform.com (sign-in, dashboard, settings, help).

When a subscriber claims an offer, the relevant contact details and the answers that qualified the offer are shared with the local business that purchased that lead. See the Lead Tracking page for the full description of what is shared.

When you use the ChatGPT connection, OpenAI receives the form content and aggregate results you request. Configured questions and answer-choice labels are content you provide. This connection does not return individual reader contact details or free-text survey answers. Publishing requires your approval in greetform. OpenAI's own policies apply to information processed in ChatGPT.

5. Cookies and tracking

The marketing site at greetform.com uses Google Analytics 4, measurement ID G-S4GTMXB41S, to count visits and understand how the site is used. The account pages of app.greetform.com, where operators sign in and use greetform, use the same property, recording page paths without query strings. We may also use advertising and measurement tools from other companies, which set their own cookies.

Google Analytics may set analytics cookies. You can block those cookies in your browser settings or use Google's opt-out browser add-on.

The app uses essential sign-in cookies. A temporary connection cookie remembers the return step for 10 minutes in the browser where you started. Confirmation emails do not carry that return step. On another browser or after expiry, sign in and restart the connection from ChatGPT.

6. Retention

Subscriber records are retained for as long as the operator keeps their account active, plus a short reconciliation window after deletion (typically 30 days). Aggregated, non-identifying analytics may be retained longer. Operators can request deletion of their account and all associated records at any time by using our contact form.

Agent change history includes your form brief and saved form snapshots so you can review what changed. It remains until the owning workspace or publication records are deleted, or we fulfill a deletion request. Deleting a draft or disconnecting ChatGPT does not erase this history. Disconnecting revokes the connection's access. Request deletion through our contact form.

7. Your rights

Depending on where you live (for example, under GDPR or the CCPA), you may have the right to access, correct, port, or delete your personal data, and to object to certain processing. To exercise any of these rights, contact the operator who collected your information, or use our contact form and we will route the request. We respond within 30 days.

8. Children

greetform is not directed to children under 13. Operators are responsible for ensuring their newsletters and onboarding flows comply with applicable child-privacy laws.

9. Security

We use industry-standard transport encryption (HTTPS), encrypted storage at rest, and row-level security on subscriber tables. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify the affected operator without undue delay.

10. Changes

We may update this policy from time to time. The "Last updated" date above always reflects the current version. Material changes will be announced in the operator dashboard.

11. Contact

Questions: use our contact form.