Privacy policy
How we collect, use and protect your personal data when you use this website.
Brutally Honest Oy
A limited company registered in the Finnish Trade Register.
Operating as The Brutally Honest.
Business ID 3574434-1 · VAT FI35744341
Koroistentie 4 F 1, 00280 Helsinki, Finland
1. Who we are
This website is run by Brutally Honest Oy, a limited company registered in Finland (Business ID 3574434-1, VAT FI35744341), which operates as The Brutally Honest. Brutally Honest Oy is the controller of the personal data described in this policy. Address: Koroistentie 4 F 1, 00280 Helsinki, Finland. E-mail: team@thebrutallyhonest.co.
2. What this policy covers
This policy applies to thebrutallyhonest.co, its pages, and the e-mails we send from it. The site is a hub that serves four audiences: startup founders, angel investors, corporate innovators, and accelerators and ecosystem builders.
Each audience's own site has its own privacy policy.
3. What we collect
Website visits
- Usage data: pages visited, clicks, referral source, browser and device type, and approximate location, collected via cookies and analytics tools.
- Cookie data: identifiers stored on your device to measure site performance and advertising effectiveness.
- Behavioural data: session replays, heatmaps and interaction metrics collected by Microsoft Clarity to understand how visitors use our website.
- Your cookie choice: a record of what you chose in the cookie banner.
E-mail sign-up
If you sign up for our e-mail notes, we collect your e-mail address, the seat you chose, the time you signed up, the version of the consent text you agreed to, and a salted hash of your IP address. We use them to send you the notes you asked for, offers on our services when the box you ticked included them, and to prove what you agreed to. You confirm your address before anything is sent, and every e-mail has a link that stops them at once. We send the e-mails through Resend and keep the contact record in HubSpot.
Events (the prize wheel)
Brutally Honest Oy runs the prize wheel at thebrutallyhonest.co/slush from 16 to 20 November 2026. To spin, you pick a seat and give us your e-mail address. For each spin we keep your address, the seat, the prize you won and its single-use code, whether you ticked the notes box, the time, when your prize e-mail went out, and a salted hash of your IP address that we use only to stop scripted spins. We use them to run the draw fairly, to allow one spin per address and to send you what you won. The lawful basis is the contract you enter by spinning: running the draw under its rules and sending what you won.
Under the address there is a separate, optional box for our e-mail notes. If you tick it, we send you one e-mail asking you to confirm your address, and nothing else unless you confirm. Once you confirm, the e-mail sign-up terms above apply, and as the record of your consent we keep the page, the wording of the box and the time you spun, in place of an IP address. One click in any of those e-mails stops them.
We keep the spin record for 13 months and then delete it. The prize's code works until the date on the prize.
Apart from the e-mail sign-up and the prize wheel, we do not collect names, e-mail addresses or payment details on this site.
Business contacts
If you work at an organisation we think could use our services, we may contact you by e-mail. We collect your name, role, organisation, work e-mail address and public professional profile from public sources, such as organisation websites and professional networks, and from the business data provider Apollo. Every message we send tells you where we found your details and lets you object; if you do, we stop and keep your address only on a list that makes sure we never contact you again.
4. How we use it and why
Keeping the website working, including remembering your cookie choice
Lawful basis: Legitimate interest: running a working, secure website
Measuring how the website is used (analytics, Microsoft Clarity)
Lawful basis: Consent, given in the cookie banner
Measuring advertising and building ad audiences (marketing)
Lawful basis: Consent, given in the cookie banner
Reporting a sent form to Meta, TikTok and OpenAI from our server
Lawful basis: Consent to marketing cookies
Running the prize wheel: one spin per address, the draw and sending what you won
Lawful basis: Contract: the draw's rules, which you accept by spinning
Sending the e-mail notes and offers you signed up for
Lawful basis: Consent, which you can withdraw at any time
Keeping proof that you consented to e-mails and cookies
Lawful basis: Legal obligation: showing that consent was given (GDPR Art. 7(1))
Contacting business contacts about our services
Lawful basis: Legitimate interest: offering our services to organisations. You can object at any time.
| Purpose | Lawful basis |
|---|---|
| Keeping the website working, including remembering your cookie choice | Legitimate interest: running a working, secure website |
| Measuring how the website is used (analytics, Microsoft Clarity) | Consent, given in the cookie banner |
| Measuring advertising and building ad audiences (marketing) | Consent, given in the cookie banner |
| Reporting a sent form to Meta, TikTok and OpenAI from our server | Consent to marketing cookies |
| Running the prize wheel: one spin per address, the draw and sending what you won | Contract: the draw's rules, which you accept by spinning |
| Sending the e-mail notes and offers you signed up for | Consent, which you can withdraw at any time |
| Keeping proof that you consented to e-mails and cookies | Legal obligation: showing that consent was given (GDPR Art. 7(1)) |
| Contacting business contacts about our services | Legitimate interest: offering our services to organisations. You can object at any time. |
Giving us your data is voluntary. Where a form marks a field as required, we need it to provide what you asked for; without it we cannot, for example, create your account or deliver a purchase.
Our forms use Cloudflare Turnstile to check that a person, not a bot, is using them. While a form is on the screen, Turnstile reads your IP address and technical details of your browser and connection, such as the browser type. Cloudflare does this for us as our processor, and also uses these details as its own controller to improve Turnstile. The lawful basis is our legitimate interest in keeping our forms free of bots.
6. Who processes data for us
Google Analytics 4
Purpose: Web analytics and event tracking (analytics, with consent)
Location: EU and USA
Google Tag Manager
Purpose: Tag management
Location: EU and USA
Google Ads
Purpose: Conversion tracking and remarketing (marketing, with consent)
Location: EU and USA
Microsoft Clarity
Purpose: Behavioural analytics, heatmaps and session replay (analytics, with consent)
Location: EU and USA
Meta (Facebook) Pixel
Purpose: Ad conversion and audience building (marketing, with consent)
Location: EU and USA
LinkedIn Insight Tag
Purpose: Ad conversion and audience insights (marketing, with consent)
Location: EU and USA
TikTok Pixel
Purpose: Ad conversion and optimisation (marketing, with consent)
Location: EU and USA
OpenAI
Purpose: ChatGPT Ads Conversions API: our server reports notes sign-ups to measure our ads (marketing, with consent). OpenAI uses this data as an independent controller
Location: EU and USA
Resend
Purpose: E-mail delivery
Location: USA
HubSpot
Purpose: Contact records
Location: EU and USA
Supabase (via Lovable Cloud)
Purpose: Database and server functions for e-mail sign-ups, inquiry forms and our record of your cookie choice
Location: EU (Sweden)
Lovable
Purpose: Website hosting
Location: EU and USA
Cloudflare (through Lovable)
Purpose: Protects and delivers the website and the platforms, and tells people from bots (the __cf_bm cookie)
Location: USA
Cloudflare Turnstile
Purpose: Checks that a person, not a bot, is using our forms
Location: USA
Composio
Purpose: Connects our tools: reads bookings into our contact records and runs our e-mail automations
Location: USA
Instantly
Purpose: Sends our business development e-mails
Location: USA
Apify
Purpose: Collects public business contact information
Location: EU and USA
| Service | Purpose | Location |
|---|---|---|
| Google Analytics 4 | Web analytics and event tracking (analytics, with consent) | EU and USA |
| Google Tag Manager | Tag management | EU and USA |
| Google Ads | Conversion tracking and remarketing (marketing, with consent) | EU and USA |
| Microsoft Clarity | Behavioural analytics, heatmaps and session replay (analytics, with consent) | EU and USA |
| Meta (Facebook) Pixel | Ad conversion and audience building (marketing, with consent) | EU and USA |
| LinkedIn Insight Tag | Ad conversion and audience insights (marketing, with consent) | EU and USA |
| TikTok Pixel | Ad conversion and optimisation (marketing, with consent) | EU and USA |
| OpenAI | ChatGPT Ads Conversions API: our server reports notes sign-ups to measure our ads (marketing, with consent). OpenAI uses this data as an independent controller | EU and USA |
| Resend | E-mail delivery | USA |
| HubSpot | Contact records | EU and USA |
| Supabase (via Lovable Cloud) | Database and server functions for e-mail sign-ups, inquiry forms and our record of your cookie choice | EU (Sweden) |
| Lovable | Website hosting | EU and USA |
| Cloudflare (through Lovable) | Protects and delivers the website and the platforms, and tells people from bots (the __cf_bm cookie) | USA |
| Cloudflare Turnstile | Checks that a person, not a bot, is using our forms | USA |
| Composio | Connects our tools: reads bookings into our contact records and runs our e-mail automations | USA |
| Instantly | Sends our business development e-mails | USA |
| Apify | Collects public business contact information | EU and USA |
Marketing services are only activated after explicit consent.
7. Services that run under their own privacy policies
Some things we offer run on other companies' services. When you use them, that company handles your data under its own privacy policy, and we receive only what is described here.
Events (Luma). If you register for one of our events on Luma, Luma passes your name, e-mail address and registration answers to us as the host. We keep them in our contact records (HubSpot) to run that event. The lawful basis is our legitimate interest in running an event you registered for. The registration form also has an optional box for our e-mail notes. If you tick it, we send you one e-mail asking you to confirm your address, and nothing else unless you confirm. Once you confirm, the e-mail sign-up terms above apply, and we record your name, the event and the time you registered as where you agreed, in place of an IP address. So that we do not ask you twice about the same event, we keep the event and a hash of your address for 13 months.
Events (Freebee at Slush). At Slush 2026 we offer a product at the Freebee kiosk (slush.freebee.fi). Freebee runs the sign-up there under its own privacy policy. If you tick the box to share your contact with The Brutally Honest, Freebee passes us your name, e-mail address, the role you chose and the event. The lawful basis is your consent, given by ticking the box. We send you one e-mail asking you to confirm your address, and nothing else unless you confirm. Once you confirm, the e-mail sign-up terms above apply, and as the record of your consent we keep your name, the event and the time you ticked the box, in place of an IP address. We add only people who chose the startup, investor, corporate or ecosystem role; anyone who chose another role is not added. So that we do not add the same sign-up twice, we keep the event, Freebee's reference for your sign-up and a hash of your address for 13 months.
Newsletters (Substack). If you subscribe to one of our newsletters on Substack, Substack runs the subscription and passes your name and e-mail address to us. We keep them in our contact records (HubSpot) to run that newsletter. The lawful basis is your subscription.
The store (Gumroad). Our e-books and tools are sold on Gumroad (thebrutallyhonest.gumroad.com), which runs the store and the checkout. We do not place our own analytics or advertising tags on the Gumroad store. When you buy or download something, Gumroad's servers send ours the details of the sale, including your e-mail address. We keep your name and e-mail address in our contact records only if you agreed to be contacted at checkout; otherwise we keep only the product and the price. The sale reaches our analytics without your name or e-mail address.
We send you our own marketing e-mails only if you agreed to receive them, and every one of them has a link that stops them. To have your record deleted, write to team@thebrutallyhonest.co.
8. Transfers outside the EU
Some of the services in section 6 are based in the USA. For each transfer outside the EU and the EEA we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework while the recipient remains certified under it, or on another lawful safeguard such as the Commission's Standard Contractual Clauses. Write to team@thebrutallyhonest.co for a copy of the safeguard that applies.
9. How long we keep it
Google Analytics data
How long: 14 months
Microsoft Clarity session data
How long: Up to 30 days
Your cookie choice in your browser
How long: 182 days (cc_cookie); after that the banner asks again.
Records of your cookie choices
How long: 42 months, then deleted: the time a choice applies, plus the three years Finnish law gives for claims. Each record holds a random consent ID, what you allowed, the date and time, the site and page, your browser type and a salted hash of your IP address.
E-mail sign-up
How long: Until you unsubscribe or ask us to delete it. After an unsubscribe we keep only the record that you consented and later withdrew.
Unconfirmed e‑mail sign-up
How long: Deleted after 30 days if you never confirm it.
Luma notes box record
How long: 13 months. Only the event and a hash of your address, so we do not ask twice about the same event.
Freebee box record
How long: 13 months. Only the event, Freebee's reference for the sign-up and a hash of your address, so we do not add the same sign-up twice.
Prize wheel spin record
How long: 13 months, then deleted with the log of its prize e-mails. Your address, the seat, the prize and its code, the notes box, the time and a salted hash of your IP address. The prize's code works only until the date on the prize.
Business contact records
How long: Up to 24 months after our last contact, or until you object. After an objection we keep only your address on our do-not-contact list.
| Data | How long |
|---|---|
| Google Analytics data | 14 months |
| Microsoft Clarity session data | Up to 30 days |
| Your cookie choice in your browser | 182 days (cc_cookie); after that the banner asks again. |
| Records of your cookie choices | 42 months, then deleted: the time a choice applies, plus the three years Finnish law gives for claims. Each record holds a random consent ID, what you allowed, the date and time, the site and page, your browser type and a salted hash of your IP address. |
| E-mail sign-up | Until you unsubscribe or ask us to delete it. After an unsubscribe we keep only the record that you consented and later withdrew. |
| Unconfirmed e‑mail sign-up | Deleted after 30 days if you never confirm it. |
| Luma notes box record | 13 months. Only the event and a hash of your address, so we do not ask twice about the same event. |
| Freebee box record | 13 months. Only the event, Freebee's reference for the sign-up and a hash of your address, so we do not add the same sign-up twice. |
| Prize wheel spin record | 13 months, then deleted with the log of its prize e-mails. Your address, the seat, the prize and its code, the notes box, the time and a salted hash of your IP address. The prize's code works only until the date on the prize. |
| Business contact records | Up to 24 months after our last contact, or until you object. After an objection we keep only your address on our do-not-contact list. |
10. Your rights
Under the conditions the GDPR sets, you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and not to be subject to a decision based solely on automated processing. We do not make such decisions about you. Where we rely on your consent, you can withdraw it at any time; that does not affect what we did before. Write to team@thebrutallyhonest.co. We answer within one month; where the GDPR allows it we may extend this by two months, and if so we tell you within the first month. We have not appointed a data protection officer; the same address reaches the people responsible. You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the data protection authority in the country where you live.
11. Children
Our websites and services are meant for people aged 18 or over, and we do not offer them to children. If you believe a child has given us their data, write to team@thebrutallyhonest.co and we will delete it.
12. Changes to this policy
When we change this policy, we update the date at the top of this page. If a change affects how we use the data of people who have an account with us, we tell them by e-mail before it takes effect.
13. Contact
Questions about this policy or your data: team@thebrutallyhonest.co. Post: Brutally Honest Oy, Koroistentie 4 F 1, 00280 Helsinki, Finland.