Legal / Privacy Policy

Privacy Policy

Green Story website, platform & API services

This Privacy Policy explains how Green Story Europe B.V., Lange Viestraat 2b, 3511 BK Utrecht, the Netherlands (“Green Story”, “we”, “us”), collects and uses personal data when you visit our websites (greenstory.io and related pages), use the Green Story platform and API services, or otherwise interact with us. It replaces all previous versions of our privacy policy, including the version previously hosted with iubenda and earlier policies published under the SimpliZero name.

1. Our two roles: controller and processor

Green Story as controller. We act as a data controller for personal data we collect for our own purposes — for example when you visit our website, contact us, sign up for an account, attend a demo, or receive our marketing. This policy describes that processing.

Green Story as processor. When our customers use the Green Story platform and API services, they submit data — such as supplier contact details, order references, or names in uploaded supply chain documents — that we process on their behalf and on their instructions. For that data, our customer is the controller and our Data Processing Agreement applies. If your data appears on the platform because an organisation you work with uses Green Story, please direct privacy requests to that organisation; we will assist them in responding.

2. Personal data we collect

• Account and contact data — name, business email address, phone number, job title, employer, business address, and login credentials when you create an account, request a demo, or contact us.
• Usage and device data — IP address, browser and device information, pages visited, and actions taken on our website and platform, collected through cookies and similar technologies and through product analytics.
• Authentication and security data — login identifiers, authentication metadata, and activity logs used to secure accounts and detect misuse.
• Support communications — messages, attachments, and metadata when you contact our support helpdesk.
• Billing data — billing contact details and subscription information (payment card details are handled by our payment processors and are not stored by Green Story).
• Marketing data — email address, name, and engagement metadata (e.g. opens and clicks) where you have subscribed to our communications or we are otherwise permitted to contact you.

Our services are intended for business use. We do not intend to process special categories of personal data (Article 9 GDPR), and our services are not directed at children.

3. Why we process personal data and on what legal basis

Where we rely on consent, you can withdraw it at any time (for example via the unsubscribe link in our emails) without affecting processing before withdrawal.

4. Who we share personal data with

We share personal data with service providers who process it on our behalf, under contracts that restrict their use of the data. Our current providers include our affiliate SimpliZero Sustainable Solutions Private Limited (India; support, operations, and engineering), Hetzner (EU hosting), Redis (EU-hosted caching and session store), Cloudflare (CDN and security), Webflow (marketing website hosting), Google (Google Analytics, Tag Manager, Ads and Fonts — website analytics, tag management, advertising measurement and fonts), Amazon Web Services (storage, email delivery, queuing, key management in EU regions; user authentication via Amazon Cognito in a US region), OpenAI (AI-assisted features; API data is not used for model training), Zoho (support helpdesk), Mixpanel (product analytics), Chargebee (subscription billing), Stripe and PayPal (payment processing), Xero (accounting and invoicing), and WhatsApp/Meta (a messaging channel through which customers may send us product and supply chain information).

The full, current list of subprocessors that process personal data on our behalf — including locations and transfer safeguards — is maintained on our Subprocessors page. Cookies and website analytics providers used on our marketing site are listed in our Cookie Policy.

We may also disclose personal data where required by law, to protect our rights or the security of our services, or in connection with a corporate transaction (merger, acquisition, or asset sale), subject to appropriate safeguards. We do not sell personal data.

5. International transfers

Our production platform and customer content are hosted in EU data centres (Hetzner, Germany/Finland). Where personal data is transferred outside the EEA — for example to our affiliate in India or to US-based providers — we use appropriate safeguards under Chapter V GDPR: an adequacy decision, the EU standard contractual clauses (Decision (EU) 2021/914), or the EU–US Data Privacy Framework where the recipient is certified.

6. How long we keep personal data

We keep personal data only as long as needed for the purposes above: account data for the life of the account and a limited period afterwards; platform data per our DPA (deletion from live systems within 90 days of termination, backups purged within 12 months); invoicing and fiscal records up to 7 years as required by Dutch law; and marketing data until you unsubscribe or we no longer have a basis to contact you. We may retain anonymised data that no longer identifies any individual.

7. How we protect personal data

Green Story maintains an ISO/IEC 27001 certified information security management system. Our measures include EU hosting in ISO 27001 certified data centres, encryption in transit (TLS 1.2+) and at rest, role-based least-privilege access with multi-factor authentication, centralised logging and monitoring, tested backups, and a documented incident response process. A fuller description is in Annex II of our DPA.

8. Cookies and analytics

Our websites and platform use cookies and similar technologies for authentication, security, preferences, and analytics. Where required by law, non-essential cookies are set only with your consent, which you can manage through your browser settings or the cookie controls on our website. Our marketing website (hosted on Webflow) uses Google Analytics to measure and understand website traffic; these analytics cookies are set only with your consent where required. Product analytics on the platform is provided by Mixpanel. A full list of the cookies and trackers we use, and controls to accept or reject them, is available in our Cookie Policy and through the cookie settings on our website. We honour Global Privacy Control (GPC) browser signals where applicable law requires.

9. Your rights

Depending on your location, you may have the right to access, rectify, or erase your personal data, restrict or object to its processing, receive it in a portable format, and withdraw consent. To exercise these rights, contact us at [email protected]. We will respond within the timeframes required by applicable law. Additional rights and disclosures that apply to specific regions — including the United States (California and other state laws) and other regions — are set out in Section 12 (Region-specific disclosures).

If you are in the EEA, you may also lodge a complaint with your local supervisory authority. For the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

If we process your data on behalf of a customer (Section 1), we will forward your request to that customer and assist them in responding.

10. Changes to this policy

We may update this policy from time to time. The current version is always available at this page, and material changes are recorded in the version history below. For significant changes we will provide reasonable notice, for example by email or a notice on the platform.

11. Contact

Green Story Europe B.V.
Lange Viestraat 2b, 3511 BK Utrecht, the Netherlands
[email protected]

12. Region-specific disclosures

This Section provides additional information for individuals in specific jurisdictions. It supplements, and should be read together with, the rest of this policy. Where a region-specific rule conflicts with the general policy, the region-specific rule applies for individuals in that region. In this Section, references to your rights concern personal data for which Green Story is the controller; where Green Story processes your data on behalf of a business customer (Section 1), please direct requests to that customer, whom we will assist.

12.1. United States (California and other state privacy laws)

This part applies to residents of U.S. states with comprehensive privacy laws, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Nebraska and Utah. It uses the terms Personal Information and Sensitive Personal Information. Where this part conflicts with the rest of the policy, it prevails for residents of these states.

Categories of personal information. In the preceding 12 months we have collected the following statutory categories, for the business and commercial purposes described in Section 3, from the sources described in Section 2 (directly from you, your device, and your organisation):

Disclosure, “sale”, “sharing” and targeted advertising. We disclose these categories to service providers and contractors (Section 4) for business purposes only. We do not sell your personal information for monetary consideration. However, the analytics and advertising cookies on our marketing website (for example Google Analytics) may constitute a “sale” or a “share” for cross-context behavioural advertising / “targeted advertising” under U.S. state privacy laws. Where they do, you can opt out at any time through the cookie controls on our website, and we honour Global Privacy Control (GPC) browser signals. We do not knowingly sell or share the personal information of consumers under 16 without opt-in consent. In this part, “sale” means disclosing personal information to a third party for monetary or other valuable consideration, and “sharing” means disclosing it for cross-context behavioural advertising, in each case as defined by the applicable state law; disclosures to a service provider under a compliant written contract are neither.

Rights common to these states. Subject to your state’s law, you have the right to: access / know what we process; correct inaccurate personal information; delete your personal information; obtain a portable copy; opt out of the sale of your personal information and, where your state grants it, of processing for targeted advertising or profiling that produces legal or similarly significant effects; and not be discriminated against for exercising these rights.

Additional California rights. California residents also have the right to opt out of the “sharing” of personal information for cross-context behavioural advertising, and the right to limit the use and disclosure of Sensitive Personal Information to what is necessary to provide the service. Under California’s “Shine the Light” law (Civ. Code §1798.83) you may request information about disclosures to third parties for their direct marketing; we do not make such disclosures. Registered California residents under 18 may request removal of content they posted (Bus. & Prof. Code §22581); we may render it invisible rather than fully erase it where permitted.

Sensitive-information rights in other states. Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey and Nebraska may give, deny or withdraw consent for the processing of Sensitive Personal Information; residents of Utah may opt out of such processing. Statutory exceptions may apply (e.g. where processing is necessary to provide a service you requested).

Nevada. Under Nevada law (NRS 603A), Nevada residents have the right to submit a verified request to opt out of the sale of certain covered personal information. Submit such requests to [email protected].

How to exercise. Submit requests to [email protected] or through the privacy-choices link on our website. We must verify your identity before responding and will use verification data only for that purpose; you need not create an account to submit a request, and an authorised agent (or a parent on behalf of a child) may act for you. Requests are free unless manifestly unfounded or excessive. We respond within the timeframe required by applicable law and, if we deny a request, explain why. Our retention approach is described in Section 6.

12.2. Other regions — your local rights

Green Story is a business-to-business service. For most individuals outside the EU and the United States, the personal data we hold is limited to business contact details of our customers’ personnel and of prospects, and website usage data. The GDPR standard described in this policy is applied as our global baseline.

United Kingdom / EEA. The UK GDPR / GDPR apply as described above; you may complain to your local supervisory authority (in the UK, the Information Commissioner’s Office, ico.org.uk). UK transfers rely on the UK’s adequacy regulations or the UK Addendum to the EU SCCs.

Australia, New Zealand, China, India, Singapore and other jurisdictions. If you are in a country with an applicable data protection law, you may have rights under that law — typically to access, correct or delete your personal data, to withdraw consent, and to complain to your national data protection authority (for example the OAIC in Australia, or the Office of the Privacy Commissioner in New Zealand). Where we transfer personal data abroad we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses. To exercise any right available to you under your local law, contact [email protected] and we will honour it to the extent the law requires.

India. Under the Digital Personal Data Protection Act 2023, our designated Grievance Officer is Navodit Babel, contactable at [email protected].

Where we act as processor. Where Green Story processes personal data on behalf of a business customer (Section 1) — including data about that customer’s own staff, suppliers or end-consumers anywhere in the world — the customer is the controller and any rights under local law are exercised through that customer; we assist them in responding, and our obligations are set out in our Data Processing Agreement.