Privacy Policy
Last Updated: November 1, 2026
GreenLine Systems, Inc., a Nevada corporation (“Provider,” “we,” “us,” or “our”), provides the GreenLine software-as-a-service offering (the “Service”) to businesses and professional practices. This Privacy Policy explains how we collect, use, disclose, and protect Personal Data in connection with the Service, our website at https://greenline.legal, and our related communications. It also describes the choices available to you.
Capitalized terms not defined in this Privacy Policy have the meanings given in our Terms of Service at https://greenline.legal/terms-of-service/ (the “Terms”) or our Data Processing Addendum at https://greenline.legal/data-processing-addendum/ (the “DPA”).
1. Scope and Our Roles
1.1 Data We Control. We decide how and why we process Account Data, Usage Data, and Personal Data we collect through our website, marketing, and support channels. For this data, we act as a “controller” or “business” under Data Protection Laws, and this Privacy Policy describes our practices.
1.2 Data We Process for Customers. Customers use the Service to store and manage their own files and information, which may include Customer Personal Data about their clients and others. We process Customer Personal Data on the Customer’s behalf and only on the Customer’s instructions, as a “processor” or “service provider.” The Customer’s Agreement with us, including the DPA, governs that processing. Each Customer is responsible for its own privacy notices to, and legal bases for processing the Personal Data of, the individuals whose information it stores in the Service.
1.3 If a Customer Holds Your Information. If a Customer, such as a law firm or other professional firm you work with, stores your information in the Service, please contact that Customer about your information and any related request. See Section 11.3.
1.4 Relationship to Our Agreements. This Privacy Policy describes our practices. It is provided for informational purposes and is not part of any contract with you or with any Customer. A Customer’s contractual rights regarding Customer Data are set out in its Agreement with us, including the DPA, which controls over any inconsistent description in this Privacy Policy.
2. Definitions
2.1 “Account Data” means contact, billing, and account credential information about Customers and Authorized Users that we use to create, administer, secure, and bill Customer accounts. Account Data does not include Customer Data.
2.2 “Usage Data” means technical and interaction information generated by access to and use of the Service and our website. It includes device and browser information, IP addresses, log files, feature usage, and records of activity through API Keys and MCP Access. Usage Data does not include the content of Customer Data.
2.3 Incorporated Terms. “Personal Data,” “Customer Personal Data,” “Data Subject,” “Data Protection Laws,” “Security Incident,” “Security Measures,” “Subprocessor,” and “Subprocessor List” have the meanings given in the DPA. “Agreement,” “AI Feature,” “API Key,” “Authorized Users,” “Customer,” “Customer Data,” “MCP Access,” “Order Form,” and “Subscription Term” have the meanings given in the Terms.
3. Personal Data We Collect
We collect the Personal Data we need to provide, secure, and support the Service and to operate our business.
3.1 Account Data. When a Customer purchases the Service, we collect names, business contact details, and billing contact information from Order Forms and account setup. When Authorized Users are added, we collect their names, business email addresses, roles, and login credentials. We store passwords only in hashed form.
3.2 Payment Information. A third-party, PCI-compliant payment processor handles payments. We do not store payment card information. We receive limited transaction records from the processor, such as payment status and amount.
3.3 Inquiries, Support, and Communications. When you request information, sign up for communications, register for an event, or contact us for support, we collect your contact information, the content of your communications, and information you provide to help us respond.
3.4 Usage Data. When you use the Service or visit our website, we automatically collect Usage Data through server logs, cookies, and similar technologies. See Section 8.
3.5 Information from Third Parties. We receive Authorized User contact information from Customers and from other Authorized Users who invite them to the Service.
3.6 Customer Personal Data. Customers and their Authorized Users decide what files and information to submit to the Service. Depending on the Customer’s use, Customer Personal Data may include contact, professional, financial, and other information about the Customer’s clients, personnel, and business contacts, including sensitive information. We process Customer Personal Data as described in Section 5.
4. How We Use Personal Data
This Section applies to Account Data, Usage Data, and other Personal Data we control. Section 5 governs Customer Personal Data.
| Purpose | Personal Data used |
|---|---|
| Provide, operate, and administer the Service and Customer accounts | Account Data; Usage Data |
| Process payments and manage billing | Account Data; payment transaction records |
| Provide support and respond to inquiries | Account Data; communications; Usage Data |
| Secure the Service, prevent fraud, and investigate misuse | Account Data; Usage Data |
| Send service, security, and administrative notices | Account Data |
| Send marketing communications, which you can opt out of at any time | Business contact information |
| Analyze and improve the performance and usability of the Service and our website | Usage Data |
| Comply with legal obligations and enforce the Agreement | All categories, as needed |
4.1 Testimonials. We publish an individual’s testimonial or endorsement only with that individual’s consent. Use of a Customer’s name and logo as a customer reference is governed by the Agreement.
4.2 No Targeted Advertising. We do not use Personal Data for targeted advertising.
4.3 De-Identified Data. We may create de-identified or aggregated data from Usage Data and use it for any lawful purpose. We maintain that data in de-identified form and will not attempt to reidentify it, except as permitted by law.
5. How We Handle Customer Personal Data
5.1 Customer Instructions. We process Customer Personal Data only (a) to provide the Service and perform our obligations under the Agreement, (b) in accordance with the Customer’s other documented instructions, and (c) to comply with applicable law, subject to any notice requirements under Data Protection Laws.
5.2 Service Improvement. We may also use Customer Personal Data to maintain and improve the Service and to create de-identified or aggregated data, in each case only to the extent Data Protection Laws permit a processor or service provider to do so. We will not attempt to reidentify de-identified data.
5.3 No Sale, Sharing, or Combining. We do not sell Customer Personal Data or share it for cross-context behavioral advertising. We do not combine Customer Personal Data with other Personal Data, except as Data Protection Laws permit for service providers.
5.4 No Monitoring; Limited Access. We do not monitor or review Customer Data. Our personnel access Customer Data only as necessary to provide support or maintain security, or as the Customer instructs. Personnel who process Customer Personal Data are bound by written or statutory confidentiality obligations.
6. AI Features and Connected AI Tools
6.1 AI Features. AI Features are available only if a Customer affirmatively opts in, either via Order Form or in-app acceptance. When an Authorized User uses an AI Feature, we process the relevant Customer Data, including any Customer Personal Data, to generate the requested output. We use third-party AI model providers to operate AI Features. These providers are Subprocessors and appear on our Subprocessor List.
6.2 No Training on Customer Data. We do not use Customer Data, including Customer Personal Data, to train artificial intelligence or machine learning models except as the Customer expressly permits under the Agreement. Our AI model providers are contractually prohibited from using Customer Data to train their models and from retaining it longer than needed to generate the requested output.
6.3 Connected AI Tools. Customers and their Authorized Users may connect third-party AI agents, tools, or applications to the Service through API Keys or MCP Access. When they do, Customer Data moves to that third party at the Customer’s direction. The third party’s own terms and privacy practices govern its handling of that data. These third parties are not our Subprocessors, and we are not responsible for their processing.
7. How We Disclose Personal Data
7.1 Subprocessors and Service Providers. We use Subprocessors and other service providers to host, operate, and support the Service and our business, such as cloud hosting, payment processing, customer support, email delivery, and analytics. We require them by written agreement to protect Personal Data and to process it only to perform services for us. For Customer Personal Data, those obligations are substantially the same as the obligations in the DPA. Our current Subprocessor List is available at https://greenline.legal/subprocessors/.
7.2 Within a Customer’s Account. Customer Data and Authorized User profile information are visible to other Authorized Users of the same Customer account, according to the settings the Customer configures.
7.3 At a Customer’s Direction. We disclose Customer Data to integrations and connected tools that a Customer or its Authorized Users choose to enable. See Section 6.3.
7.4 Legal Requirements and Protection. We disclose Personal Data where required by law, subpoena, court order, or other legal process. Where legally permitted, we will notify the affected Customer before disclosing Customer Data in response to legal process. We may also disclose Personal Data we control where reasonably necessary to protect the security of the Service, prevent fraud, or protect the rights, property, or safety of Provider, our Customers, or others.
7.5 Business Transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of all or part of our business, Personal Data may be disclosed in due diligence and transferred as part of the transaction. Customer Personal Data remains subject to the Agreement and the DPA, which transfer to a permitted successor as the Agreement provides.
7.6 With Consent or Instruction. We disclose Personal Data for other purposes with the consent of the individual or, for Customer Personal Data, on the Customer’s instruction.
7.7 No Sale or Sharing. We do not sell Personal Data or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months.
8. Cookies, Tracking, and Opt-Out Signals
8.1 Cookies and Similar Technologies. We use cookies and similar technologies on our website and in the Service for the purposes below.
| Category | Purpose | Your control |
|---|---|---|
| Strictly necessary | Log-in, session management, security, and load balancing | Cannot be disabled; the Service will not work without them |
| Preferences | Remember settings such as display choices | Browser settings |
| Analytics | Measure website and Service use to improve performance | Browser settings or in-app privacy settings |
8.2 Global Privacy Control. We honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of Personal Data and of targeted advertising for the browser or device sending the signal. Because we do not sell or share Personal Data or engage in targeted advertising, a GPC signal does not change how we process your data.
8.3 Do Not Track. There is no common industry standard for browser Do Not Track signals, so we do not respond to them. We honor GPC signals as described in Section 8.2.
9. Security
9.1 Our Safeguards. We maintain reasonable and appropriate technical and organizational measures designed to protect Personal Data against unauthorized access, loss, alteration, and disclosure. These measures include encryption of data in transit and at rest, access controls, and hosting on Amazon Web Services across multiple availability zones. No method of transmitting or storing data is completely secure. Although we work to protect Personal Data, we cannot guarantee that unauthorized access, loss, or disclosure will never occur.
9.2 Security Measures. Our Security Measures are described in Exhibit A to the Terms.
9.3 Security Incidents. If we become aware of a Security Incident, we will notify the affected Customer as provided in the Agreement and the DPA. For Personal Data we control, we will notify affected individuals and regulators as applicable law requires.
9.4 Protecting Your Account. Please keep your login credentials confidential. If you suspect unauthorized access to your account, notify your administrator and contact us promptly at security@greenline.legal
10. Retention and Deletion
10.1 Personal Data We Control. We keep Personal Data we control only as long as needed for the purposes in Section 4, including legal, tax, accounting, and dispute-resolution needs.
10.2 Customer Personal Data During the Subscription Term. Customers can access, export, and delete Customer Data through the Service during the Subscription Term.
10.3 After Termination. After the Agreement ends, the Customer may export Customer Data for 30 days. We then delete Customer Data, including Customer Personal Data, from our active systems using industry-standard secure deletion practices. Customers may request a certificate of deletion.
10.4 Backups and Legal Requirements. Deleted Customer Data may remain in our backups for up to 90 days until overwritten in the normal backup cycle, or longer where applicable law requires. We keep retained data confidential and do not otherwise use it.
11. Your Rights and Choices
11.1 Account and Communication Choices. Authorized Users can review and update their profile information in the Service. You can opt out of marketing emails at any time through the unsubscribe link in any marketing email or by contacting us. We will still send service, security, and administrative messages.
11.2 Authorized Users. Your Customer’s administrator controls your account and the Customer Data you access. Please direct requests about Customer Data to your administrator. For Account Data or Usage Data about you, you may contact us directly.
11.3 Individuals Whose Information a Customer Stores. We process Customer Personal Data on behalf of our Customers. If you ask us to access, correct, delete, or otherwise act on Customer Personal Data about you, we will refer your request to the relevant Customer and ask you to contact that Customer directly. We will assist the Customer in responding as the DPA requires.
11.4 U.S. State Privacy Rights. Depending on where you live, you may have rights under state privacy law regarding Personal Data we control. These may include the right to:
- confirm whether we process your Personal Data and access it;
- correct inaccurate Personal Data;
- delete Personal Data;
- obtain a portable copy of your Personal Data;
- opt out of the sale or sharing of Personal Data, targeted advertising, and certain profiling; and
- limit the use of sensitive Personal Data.
These rights are subject to exceptions under applicable law. Some state laws do not apply to Personal Data collected in a business-to-business or employment context.
- How to Submit a Request. Email privacy@greenline.legal. We will verify your identity by matching information you provide with information we hold. You may use an authorized agent. We may require proof of the agent’s authority and ask you to verify your identity directly.
- Response and Appeal. We will respond within the time applicable law requires. If we deny your request, you may appeal by emailing privacy@greenline.legal with the subject line “Privacy Request Appeal.” We will respond to your appeal within the time applicable law requires and, if we deny it, explain how to contact your state attorney general.
- Non-Discrimination. We will not discriminate against you for exercising your privacy rights.
- Sensitive Personal Data. We use sensitive Personal Data we control, such as account login credentials, only to provide and secure the Service and for other purposes permitted without a right to limit under applicable law.
11.5 Nevada Residents. Nevada residents may submit a request to opt out of the sale of covered information to privacy@greenline.legal. We do not sell covered information as Nevada law defines that term.
11.6 Individuals in the European Economic Area and the United Kingdom. This Section applies if you are in the European Economic Area (“EEA”) or the United Kingdom (“UK”) and we process your Personal Data as a controller, as described in Section 1.1. It does not apply to Customer Personal Data, which we process on behalf of Customers (see Section 11.3). In this Section, “GDPR” means the EU General Data Protection Regulation and, where applicable, the UK GDPR and the UK Data Protection Act 2018. (References to the EEA include Switzerland, and references to the GDPR include the Swiss Federal Act on Data Protection, where applicable.)
(a) Controller. Provider is the controller of the Personal Data described in this Section. You can contact us as described in Section 17.
(b) Legal Bases. We rely on the following legal bases for the purposes described in Section 4:
| Purpose | Legal basis |
|---|---|
| Provide, operate, and administer the Service and Customer accounts | Performance of a contract with you, where you are the Customer. Otherwise, our legitimate interests in providing the Service to our Customers and their Authorized Users. |
| Process payments and manage billing | Performance of a contract; compliance with legal obligations |
| Provide support and respond to inquiries | Performance of a contract; our legitimate interests in responding to you |
| Secure the Service, prevent fraud, and investigate misuse | Our legitimate interests in protecting the Service, our Customers, and users |
| Send service, security, and administrative notices | Performance of a contract; our legitimate interests in operating the Service |
| Send marketing communications | Your consent, where the law requires it. Otherwise, our legitimate interests in promoting the Service to business contacts. |
| Analyze and improve the Service and our website | Our legitimate interests in improving the Service; your consent for non-essential cookies where the law requires it |
| Comply with legal obligations and enforce the Agreement | Compliance with legal obligations under EEA or UK law; our legitimate interests in complying with other applicable laws and in establishing, exercising, or defending legal claims |
You may contact us for more information about the legitimate interests we rely on and how we have balanced them against your rights.
(c) Special Categories of Data. We do not intentionally collect special categories of Personal Data as a controller.
(d) Your Rights. Subject to the conditions and exceptions in the GDPR, you have the right to:
(i) access your Personal Data;
(ii) correct inaccurate Personal Data;
(iii) erase your Personal Data;
(iv) restrict our processing of your Personal Data;
(v) receive your Personal Data in a portable format;
(vi) object to processing based on our legitimate interests;
(vii) object at any time to processing for direct marketing; and
(viii)withdraw your consent at any time, where we rely on consent. Withdrawal does not affect the lawfulness of processing before you withdrew.
To exercise these rights, contact us as described in Section 17. We will respond within one month, which we may extend by up to two further months where the GDPR permits. We may need to verify your identity before responding.
(e) Providing Personal Data. Some Personal Data, such as account and billing contact information, is needed for us to enter into or perform the Agreement. If it is not provided, we may be unable to provide the Service. Providing other Personal Data is voluntary.
(f) Automated Decision-Making. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
(g) International Transfers. We are based in the United States and process Personal Data there. Where the GDPR requires a transfer mechanism, we rely on the Standard Contractual Clauses approved by the European Commission and, for the UK, the UK International Data Transfer Addendum. You may request a copy of the relevant safeguards by contacting us. We may redact commercial terms.
(h) Sources and Retention. We describe the sources of Personal Data in Section 3 and our retention periods in Section 10.1.
(i) Complaints. You have the right to lodge a complaint with the data protection supervisory authority in the EEA member state where you live or work or where the alleged infringement occurred. In the UK, that authority is the Information Commissioner’s Office. We encourage you to contact us first so we can try to resolve your concern.
11.7 Individuals in Canada. This Section applies if you are in Canada and we process your Personal Data (called “personal information” under Canadian law) for our own purposes, as described in Section 1.1. It does not apply to Customer Personal Data, which we process on behalf of Customers as a service provider (see Section 11.3). In this Section, “Canadian Privacy Laws” means the Personal Information Protection and Electronic Documents Act and applicable provincial private-sector privacy laws, including the Québec Act Respecting the Protection of Personal Information in the Private Sector.
(a) Privacy Officer. We have designated a Privacy Officer who is accountable for our compliance with Canadian Privacy Laws and who is the person in charge of the protection of personal information under Québec law. You can contact our Privacy Officer at:
GreenLine Systems, Inc.
80 S. Lake Ave. Suite 830, Pasadena, CA 91101, United States
privacy@greenline.legal
(b) Consent. We collect, use, and disclose your Personal Data with your consent, or as otherwise permitted or required by law, for the purposes described in Section 4. Depending on the sensitivity of the information and the circumstances, your consent may be express or implied. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. If you withdraw consent, we may be unable to provide some or all of the Service.
(c) Your Rights. Subject to the exceptions in Canadian Privacy Laws, you have the right to:
(i) access your Personal Data and information about how we use and disclose it;
(ii) request correction of Personal Data that is inaccurate or incomplete; and
(iii) withdraw your consent, as described in clause (b).
To exercise these rights, contact our Privacy Officer. We will respond within 30 days, unless the law permits an extension. We may need to verify your identity before responding.
(d) Automated Decision-Making. We do not make decisions about you based exclusively on automated processing of your Personal Data.
(e) Processing Outside Canada. We are based in the United States. We and our service providers store and process Personal Data in the United States. As a result, your Personal Data may be communicated outside your province. While it is outside Canada, your Personal Data is subject to the laws of those countries and may be accessible to their courts, law enforcement, and national security authorities. Our Privacy Officer can answer questions about our service providers outside Canada.
(f) Retention. We keep Personal Data as described in Section 10.1. When we no longer need it, we destroy it or anonymize it in accordance with applicable law.
(g) Commercial Electronic Messages. We send commercial electronic messages to recipients in Canada only with their express or implied consent, as Canada’s Anti-Spam Legislation permits. Each message identifies us and includes a way to unsubscribe.
(h) Additional Terms for Québec. If you are in Québec, the following also apply:
- Additional rights. You may request that we provide computerized Personal Data you gave us in a structured, commonly used technological format, or transfer it to a person you designate. You may also request that we cease disseminating your Personal Data or de-index any hyperlink attached to your name, where the conditions in Québec law are met.
- Tracking technologies. Technologies we use that can identify, locate, or profile you are turned off by default. You can choose to activate them through our privacy settings. See Section 8.
- Anonymized data. We use Personal Data for the purposes described in Section 4.3 only after anonymizing it as Québec law requires, and only for serious and legitimate purposes.
- French version. Cette politique de confidentialité est disponible en français.
(i) Complaints. If you have a concern about our privacy practices, please contact our Privacy Officer first so we can try to resolve it. You may also file a complaint with the Office of the Privacy Commissioner of Canada or, where applicable, the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner of Alberta, or the Office of the Information and Privacy Commissioner for British Columbia.
(j) Governance of Personal Information. We have adopted internal policies and practices that govern how we handle Personal Data from collection to destruction. In summary:
- Accountability. Our Privacy Officer (clause (a)) approves these policies and oversees compliance with them.
- Collection and use. We collect and use Personal Data only for the purposes described in Sections 3 and 4.
- Access and training. Our personnel may access Personal Data only as their role requires. They are bound by confidentiality obligations and receive privacy and security training at onboarding and annually.
- Service providers. We bind our service providers by written agreement, as described in Section 7.1.
- Security and incidents. We protect Personal Data as described in Section 9. We keep a register of confidentiality incidents and notify the Commission d’accès à l’information and affected individuals when an incident presents a risk of serious injury.
- Privacy impact assessments. We assess privacy impacts before acquiring or developing information systems that involve Personal Data, and before communicating Personal Data outside Québec.
- Retention and destruction. We keep and destroy Personal Data as described in Section 10 and clause (f).
- Requests and complaints. We handle requests as described in clause (c). We acknowledge complaints sent to our Privacy Officer and respond within 30 days. If you are not satisfied with our response, you may contact the authorities listed in clause (i).
12. California Disclosures
This Section supplements this Privacy Policy for California residents and applies to Personal Data we control. For Customer Personal Data, we act as a service provider to our Customers. In the preceding 12 months, we collected and disclosed the following categories of Personal Data:
| Category | Examples | Sources | Business purposes | Disclosed to | Retention |
|---|---|---|---|---|---|
| Identifiers | Name, business email, IP address, account ID | You; Customers; Authorized Users; automatic collection | Service operation, billing, support, security | Subprocessors and service providers | See Section 10.1 |
| Commercial information | Subscription and transaction records | You; payment processor | Billing and accounting | Payment processor; professional advisors | See Section 10.1 |
| Internet or other network activity | Usage Data | Automatic collection | Security, analytics, service operation | Hosting and analytics providers | See Section 10.1 |
| Professional information | Job title, employer | You; Customers | Account administration | Service providers | See Section 10.1 |
| Sensitive Personal Data | Account login credentials | You | Authentication and security | Hosting provider | Life of the account |
We have not sold or shared Personal Data in the preceding 12 months. We have no actual knowledge of selling or sharing Personal Data of consumers under 16.
Shine the Light. We do not disclose Personal Data to third parties for their own direct marketing purposes.
13. International Processing
We are based in the United States, and our website and the Service are directed to businesses in the United States. We host the Service on Amazon Web Services across multiple redundant availability zones. Our Subprocessors may process Personal Data in the locations shown on our Subprocessor List.
Where the data protection laws of the European Economic Area, the United Kingdom, or Switzerland apply to Customer Personal Data transferred to us, we protect those transfers with the Standard Contractual Clauses and related transfer terms in the DPA.
14. Third-Party Platforms and Links
Our website and the Service may link to third-party websites. The Service may also connect to third-party platforms and integrations that a Customer enables. We do not control, and are not responsible for, the privacy practices of third parties; their own policies govern. See Section 6.3 for connected AI tools.
15. Children’s Privacy
The Service is designed for businesses and is not directed to children. We do not knowingly collect Personal Data from children under 16 for our own purposes. If you believe a child has provided Personal Data to us, contact us and we will delete it. Customers may store information about minors in Customer Data, for example in client matters. We process that information as Customer Personal Data under Section 5.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last Updated” date. We will notify Customers by email to their account contact of material changes, in our sole discretion as to materiality. Non-material changes take effect when posted, and Customer’s continued use of the Service after the posted revision date constitutes acceptance.
17. Contact Us
For questions or requests about this Privacy Policy or our privacy practices, contact us at:
- Email: privacy@greenline.legal
- Mail: GreenLine Systems, Inc. Attn: Privacy, 80 S. Lake Ave. Suite 830, Pasadena, CA 91101, United States.
Customers may direct questions about the DPA to the data protection contact identified in the DPA Details.
