Legal
Privacy Policy
Last updated
How we collect, use and protect your personal data when you use this website.
Applies to thebrutallyhonest.co.
Brutally Honest Oy
A limited company registered in the Finnish Trade Register.
Operating as The Brutally Honest.
Business ID 3574434-1 · VAT FI35744341
Koroistentie 4 F 1, 00280 Helsinki, Finland
1. Who we are
This website is run by Brutally Honest Oy, a limited company registered in Finland (Business ID 3574434-1, VAT FI35744341), which operates as The Brutally Honest. Brutally Honest Oy is the controller of the personal data described in this policy. Address: Koroistentie 4 F 1, 00280 Helsinki, Finland. E-mail: team@thebrutallyhonest.co.
2. What this policy covers
This policy applies to thebrutallyhonest.co, its pages, and the e-mails we send from it. The site is a hub that serves four audiences: startup founders, angel investors, corporate innovators, and accelerators and ecosystem builders.
Each audience's own site has its own privacy policy.
3. What we collect
Website visits
- Usage data: pages visited, clicks, referral source, browser and device type, and approximate location, collected via cookies and analytics tools.
- Cookie data: identifiers stored on your device to measure site performance and advertising effectiveness.
- Behavioural data: session replays, heatmaps and interaction metrics collected by Microsoft Clarity to understand how visitors use our website.
- Your cookie choice: a record of what you chose in the cookie banner.
E-mail sign-up
If you sign up for our e-mail notes, we collect your e-mail address, the seat you chose, the time you signed up, the version of the consent text you agreed to, and a salted hash of your IP address. We use them only to send you the notes you asked for and to prove that you asked. You confirm your address before anything is sent, and every e-mail has a link that stops them at once. We send the e-mails through Resend and keep the contact record in HubSpot.
Apart from the e-mail sign-up, we do not collect names, e-mail addresses or payment details on this site.
Business contacts
If you work at an organisation we think could use our services, we may contact you by e-mail. We collect your name, role, organisation, work e-mail address and public professional profile from public sources, such as organisation websites and professional networks, and from the business data provider Apollo. Every message we send tells you where we found your details and lets you object; if you do, we stop and keep your address only on a list that makes sure we never contact you again.
4. How we use it and why
Keeping the website working, including remembering your cookie choice
Lawful basis: Legitimate interest: running a working, secure website
Measuring how the website is used (analytics, Microsoft Clarity)
Lawful basis: Consent, given in the cookie banner
Measuring advertising and building ad audiences (marketing)
Lawful basis: Consent, given in the cookie banner
Sending the e-mail notes you signed up for
Lawful basis: Consent, which you can withdraw at any time
Keeping proof that you consented to e-mails and cookies
Lawful basis: Legal obligation: showing that consent was given (GDPR Art. 7(1))
Contacting business contacts about our services
Lawful basis: Legitimate interest: offering our services to organisations. You can object at any time.
Giving us your data is voluntary. Where a form marks a field as required, we need it to provide what you asked for; without it we cannot, for example, create your account or deliver a purchase.
6. Who processes data for us
Google Analytics 4
Purpose: Web analytics and event tracking (analytics, with consent)
Location: EU and USA
Google Tag Manager
Purpose: Tag management
Location: EU and USA
Google Ads
Purpose: Conversion tracking and remarketing (marketing, with consent)
Location: EU and USA
Microsoft Clarity
Purpose: Behavioural analytics, heatmaps and session replay (analytics, with consent)
Location: EU and USA
Meta (Facebook) Pixel
Purpose: Ad conversion and audience building (marketing, with consent)
Location: EU and USA
LinkedIn Insight Tag
Purpose: Ad conversion and audience insights (marketing, with consent)
Location: EU and USA
TikTok Pixel
Purpose: Ad conversion and optimisation (marketing, with consent)
Location: EU and USA
Resend
Purpose: E-mail delivery
Location: USA
HubSpot
Purpose: Contact records
Location: EU and USA
Supabase (via Lovable Cloud)
Purpose: Database and server functions for e-mail sign-ups, inquiry forms and our record of your cookie choice
Location: EU (Frankfurt)
Lovable
Purpose: Website hosting
Location: EU and USA
Cloudflare (through Lovable)
Purpose: Protects and delivers the website and the platforms, and tells people from bots (the __cf_bm cookie)
Location: USA
Composio
Purpose: Connects our tools: reads bookings into our contact records and runs our e-mail automations
Location: USA
Instantly
Purpose: Sends our business development e-mails
Location: USA
Apify
Purpose: Collects public business contact information
Location: EU and USA
Marketing services are only activated after explicit consent.
7. Services that run under their own privacy policies
Some things we offer run on other companies' services. When you use them, that company handles your data under its own privacy policy, and we receive only what is described here.
Events (Luma). If you register for one of our events on Luma, Luma passes your name, e-mail address and registration answers to us as the host. We keep them in our contact records (HubSpot) to run that event. The lawful basis is our legitimate interest in running an event you registered for.
Newsletters (Substack). If you subscribe to one of our newsletters on Substack, Substack runs the subscription and passes your name and e-mail address to us. We keep them in our contact records (HubSpot) to run that newsletter. The lawful basis is your subscription.
The store (Gumroad). Our e-books and tools are sold on Gumroad (thebrutallyhonest.gumroad.com), which runs the store and the checkout. We do not place our own analytics or advertising tags on the Gumroad store. When you buy or download something, Gumroad's servers send ours the details of the sale, including your e-mail address. We keep your name and e-mail address in our contact records only if you agreed to be contacted at checkout; otherwise we keep only the product and the price. The sale reaches our analytics without your name or e-mail address.
We send you our own marketing e-mails only if you agreed to receive them, and every one of them has a link that stops them. To have your record deleted, write to team@thebrutallyhonest.co.
8. Transfers outside the EU
Some of the services in section 6 are based in the USA. For each transfer outside the EU and the EEA we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework while the recipient remains certified under it, or on another lawful safeguard such as the Commission's Standard Contractual Clauses. Write to team@thebrutallyhonest.co for a copy of the safeguard that applies.
9. How long we keep it
Google Analytics data
How long: 14 months
Microsoft Clarity session data
How long: Up to 30 days
Your cookie choice in your browser
How long: 182 days in your browser (cc_cookie); after that the banner asks again. Our server also keeps a record of each choice (a random consent ID, what you allowed, the date and time, the site and page, your browser type and a salted hash of your IP address) as proof of your consent.
E-mail sign-up
How long: Until you unsubscribe or ask us to delete it. After an unsubscribe we keep only the record that you consented and later withdrew.
Unconfirmed e-mail sign-up
How long: Deleted after 30 days if you never confirm it.
Business contact records
How long: Up to 24 months after our last contact, or until you object. After an objection we keep only your address on our do-not-contact list.
10. Your rights
Under the conditions the GDPR sets, you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and not to be subject to a decision based solely on automated processing. We do not make such decisions about you. Where we rely on your consent, you can withdraw it at any time; that does not affect what we did before. Write to team@thebrutallyhonest.co. We answer within one month; where the GDPR allows it we may extend this by two months, and if so we tell you within the first month. We have not appointed a data protection officer; the same address reaches the people responsible. You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the data protection authority in the country where you live.
11. Children
Our websites and services are meant for people aged 18 or over, and we do not offer them to children. If you believe a child has given us their data, write to team@thebrutallyhonest.co and we will delete it.
12. Changes to this policy
When we change this policy, we update the date at the top of this page. If a change affects how we use the data of people who have an account with us, we tell them by e-mail before it takes effect.
13. Contact
Questions about this policy or your data: team@thebrutallyhonest.co. Post: Brutally Honest Oy, Koroistentie 4 F 1, 00280 Helsinki, Finland.