Greenlight Privacy Policy
Version 1.4 · 21 October 2026
1. The point of this policy, and the two different things it covers#
This policy explains how Greenlight Compliance Ltd. ("Greenlight", "we", "us") handles personal information.
There are two quite different situations, and it matters which one you are in.
Situation one: personal information we handle for our own purposes. This covers people who visit our website, people who sign up for an account or a trial, people at a customer firm who use the service, and people who contact us. Here we decide why and how the information is used. In data protection language, we are the controller. Sections 3 to 11 of this policy apply.
Situation two: client records inside a customer's account. Our customers are regulated firms. They upload records about their own clients, including identity documents, addresses and details of directors, shareholders and beneficial owners. We hold that material only because the customer firm asked us to, and we only do what they instruct. In data protection language, the customer firm is the controller and we are the processor.
For situation two, this policy is not the governing document. Our handling of those records is governed by our Data Processing Addendum, available at https://app.greenlightamlcompliance.com/data-processing, and by the customer firm's own privacy notice. If you are a client of a firm that uses Greenlight and you want to know what is held about you, or you want it corrected or deleted, contact that firm. We cannot act on your request directly, because the records are not ours to decide about. We will pass your request on to the firm if you contact us, and section 12 explains how.
2. Who to contact#
Greenlight Compliance Ltd. Providenciales, Turks and Caicos Islands Privacy and general enquiries: hello@greenlightamlcompliance.com
Greenlight Compliance Ltd. is in the course of incorporation in the Turks and Caicos Islands. Its company number and registered office will be added here on incorporation.
Representatives in the United Kingdom and the European Union. We are established in the Turks and Caicos Islands. Where we offer the Service to a customer established in the United Kingdom or the European Union, we will appoint a representative in that territory as required by Article 27 of the UK GDPR or the EU GDPR respectively, and will publish the representative's name and contact details in this policy before accepting that customer. We have not yet appointed one because we have no customer in either territory. Whether we also appoint a data protection officer depends on the scale and nature of our processing, and we will keep that under review.
3. What we collect, and why#
3.1 When you visit our website#
| What | Why | How long |
|---|---|---|
| IP address, browser and device type, pages viewed, referring page, approximate location derived from IP | To serve the site, keep it secure, and understand which pages are useful | 12 months |
| Information you type into a contact or enquiry form, including name, email, firm name and your message | To answer you, and to follow up about Greenlight | 24 months after our last contact |
| Cookie and similar identifiers | See section 9 | See section 9 |
3.2 When you create an account or start a trial#
| What | Why | How long |
|---|---|---|
| Your name, work email address, firm name | To create and administer the account, authenticate you, and contact you about the service | For the life of the account, then 12 months |
| A hashed form of your password, and two factor authentication secrets if you enable it | To authenticate you securely. We never store your password itself | For the life of the account |
| Records of your sign ins, actions within the service, and the IP address and browser used | To maintain the audit trail that the service exists to provide, to investigate security incidents, and to support you | For the life of the account. See the note below |
| Your communications with our support team | To help you and to improve the service | 24 months |
A note on the audit record. The audit trail is append only by design. The system can add entries but cannot edit or delete one, and that immutability is a large part of what the Service is for: it is the evidence a firm produces to show what was done and when. It follows that we cannot delete individual entries on request, including yours. We can tell you what the record holds about you, and when an account is closed the whole record is deleted with the rest of that firm's data under the timetable in the Data Processing Addendum. If you believe an entry is inaccurate we will record a correction alongside it rather than alter it.
3.3 When you pay us#
| What | Why | How long |
|---|---|---|
| Billing contact, billing address, invoice and payment records | To invoice you, collect payment, keep accounts and meet tax and accounting obligations | As required by law, expected to be 7 years |
We do not take card payments and we use no payment processor. Invoices are settled by bank transfer or cheque, so we hold a billing contact, a billing address and a record of payments received, and no card details of any kind.
3.4 Emails we send you#
We send service emails, such as the weekly digest of outstanding items, verification and password reset messages, and notices about the service. These are part of the service and are not marketing.
The weekly digest carries counts and a link into the service. It does not name clients, so no client identity passes through our email provider. This replaced earlier behaviour in which the digest named clients. You cannot opt out of essential service messages while you hold an account.
If we send you marketing about Greenlight, we will do so only where we are permitted to, and every marketing email will carry an unsubscribe link that works.
4. Why we are allowed to use this information#
Where the law of your country requires us to identify a legal basis, we rely on the following.
| Purpose | Basis |
|---|---|
| Providing the service to a firm that has an account | Performance of our contract with that firm |
| Creating and securing your user account | Performance of a contract, and our legitimate interest in keeping the service secure |
| Maintaining the audit record | Performance of our contract, and the legitimate interests of the customer firm and of us in having a reliable record |
| Invoicing, accounting, tax | Compliance with a legal obligation, and performance of a contract |
| Answering enquiries and following up about Greenlight | Our legitimate interest in responding to people who contact us |
| Marketing emails | Consent, where consent is required, otherwise our legitimate interest in promoting our service to business contacts |
| Responding to a lawful request from a court, regulator or authority | Compliance with a legal obligation |
Where we rely on legitimate interests, we have considered the effect on you and we will stop if you object and we have no overriding reason to continue.
5. Who we share it with#
We do not sell personal information, and we do not share it for advertising.
We share it with the following categories of recipient.
Our service providers. The companies that host and run the platform for us. The current list, with what each one handles and where it is located, is in Schedule 3 of the Data Processing Addendum. At the date of this version it is:
| Provider | What they handle | Where |
|---|---|---|
| Railway Corporation | Application hosting, database, file storage | United States (Virginia) |
| Amazon Web Services | Underlying email delivery infrastructure used by Resend | United States |
| Resend | Sending transactional and notification email | United States |
| Backblaze | Storage of encrypted off site backups. Backups are encrypted before they are sent, so Backblaze cannot read their contents | United States |
Professional advisers. Our lawyers, accountants and auditors, where they need the information to advise us, and subject to professional duties of confidence.
Authorities. Courts, regulators, law enforcement and tax authorities, where we are legally required to disclose, or where we need to establish or defend legal claims. Where we are permitted to tell you about such a request, we will.
A buyer. If we sell or reorganise our business, the buyer, under confidentiality obligations, and with notice to affected customers.
6. Where your information is held#
The platform is hosted in the United States, in the Virginia region of our hosting provider's infrastructure. Our email provider also operates from the United States. We are based in the Turks and Caicos Islands. So if you are outside the United States, your information will be transferred to and stored in the United States, and may be accessed by us from the Turks and Caicos Islands.
Where the law of your country restricts such transfers, we rely on:
a. the UK International Data Transfer Agreement or Addendum, or the European Commission's Standard Contractual Clauses, as applicable, which we incorporate into our Data Processing Addendum; and#
b. for customers in jurisdictions with their own transfer rules, the mechanism specified in the Data Processing Addendum.#
You can ask us for a copy of the relevant transfer terms at hello@greenlightamlcompliance.com.
7. How we protect it#
We take security seriously, and we would rather tell you precisely what we do than make a general claim.
- Each customer firm's data is separated from every other firm's at the database level, not merely in application code, using row level security policies that the application cannot bypass.
- The audit record is append only, enforced by the database itself. Entries cannot be edited or deleted, including by us through the application.
- All traffic between you and the service is encrypted in transit using TLS.
- Passwords are stored only as salted hashes using a memory hard algorithm. We cannot read your password.
- Two factor authentication is available and we recommend it for all users.
- Support access to a customer's account through the application is restricted to named individuals, requires a recorded reason, is read only, expires automatically, and is recorded in full, including every page and document opened.
- Direct administrative access to the underlying servers is restricted to one named individual. We do not maintain our own log of that access and we do not claim that our hosting provider's records of it are available to us.
- Downloads of stored documents are checked against the requesting user's firm on every request, so a document cannot be retrieved by a user outside the firm that owns it.
- Backups of the database are taken hourly and of stored documents as they change. Each is encrypted before it leaves our infrastructure and held off site under a credential that can write but cannot read, and every backup written from 21 October 2026 is locked against deletion or alteration for 35 days. A full restore was tested on 15 October 2026.
- Every change to the service's code must pass two automated test suites, including tests that one firm cannot read another's data, before it can reach production. A failure in either blocks the release.
What we do not currently claim. We are a new and small provider, and we would rather list the gaps than imply they are closed. We do not hold SOC 2, ISO 27001 or any equivalent certification, and we will not display a badge we have not earned. We do not encrypt uploaded documents at rest on the application volume ourselves. Every copy that leaves our infrastructure is encrypted before it goes. Our hosting provider may encrypt the underlying disk, but we do not rely on that and we do not claim it. We do not offer point in time database recovery, so an incident could cost up to one hour of data. We have not commissioned an independent penetration test. Each of these is on our roadmap and this section will be updated when the position changes, not before.
No system is perfectly secure. If a breach affects your personal information and the law requires us to tell you, we will, without undue delay.
8. How long we keep it#
The tables in section 3 give our intended retention periods. In general we keep information for as long as we need it for the purpose we collected it for, and then for any period the law requires.
For client records inside a customer's account, the retention period is set by the customer firm, because the records are theirs. On termination of a customer's account we delete those records in accordance with the Data Processing Addendum.
9. Cookies and similar technologies#
The application sets one cookie for ordinary users, which is strictly necessary to keep you signed in. A second, equally necessary cookie exists on a Greenlight operator's browser while a support session is open on an account. It expires within an hour and carries no access once the session has ended. Without it the service cannot work, so it is not subject to consent. Protection against cross site request forgery is handled by the application framework's origin checks rather than by a separate cookie.
We do not currently use advertising cookies or cross site tracking.
10. Your rights#
Depending on where you are, you may have the right to:
- ask what personal information we hold about you and get a copy;
- have inaccurate information corrected;
- have information deleted, where we have no continuing need or legal obligation to keep it;
- restrict or object to our use of it, including objecting to marketing at any time;
- receive certain information in a portable form; and
- withdraw consent, where we relied on consent.
To exercise any of these, email hello@greenlightamlcompliance.com. We will respond within 30 days, or sooner if the law requires. We may need to verify your identity first.
If you are unhappy with how we have handled your information, tell us and we will try to put it right. You may also have the right to complain to a data protection authority in your country. The Turks and Caicos Islands does not currently have a data protection authority, so if you are in the Turks and Caicos Islands your remedies are through the courts.
11. Children#
The service is for use by regulated firms and is not directed at children. We do not knowingly collect personal information from anyone under 16 for our own purposes. Client records uploaded by a customer firm may relate to minors, for example a minor beneficiary, and those records are governed by the Data Processing Addendum and by the firm's own policies.
12. If you are a client of a firm that uses Greenlight#
If a firm holds your identity documents or other records in Greenlight, those records belong to that firm, not to us. We cannot give you access to them, change them or delete them on your own request, because doing so would override the instructions of the firm that is responsible for them, and may conflict with that firm's own legal record keeping duties.
Contact the firm directly. If you contact us instead, we will tell the firm that you have been in touch within 5 business days and, where we can identify the firm, tell you who to contact. We will not disclose the contents of any record to you.
13. Changes to this policy#
We may update this policy. The version number and date at the top will change. If a change materially affects how we use personal information for our own purposes, we will give account holders at least 30 days' notice by email.
Greenlight Compliance Ltd. Providenciales, Turks and Caicos Islands hello@greenlightamlcompliance.com · greenlightamlcompliance.com