Privacy policy
How we collect, use and protect your personal data, and how you use your rights.
Brutally Honest Oy
A limited company registered in the Finnish Trade Register.
Operating as The Brutally Honest. The Brutally Honest Innovator is one of its brands.
Business ID 3574434-1 · VAT FI35744341
Koroistentie 4 F 1, 00280 Helsinki, Finland
1. Who we are
This website is run by Brutally Honest Oy, a limited company registered in Finland (Business ID 3574434-1, VAT FI35744341), which operates as The Brutally Honest. The Brutally Honest Innovator is one of its brands. Brutally Honest Oy is the controller of the personal data described in this policy. Address: Koroistentie 4 F 1, 00280 Helsinki, Finland. E-mail: team@thebrutallyhonest.co.
2. What this policy covers
This policy applies to brutallyhonestinnovator.com and its pages, including the e-mail sign-up, the inquiry form, the Innovation Model Finder and the venture evaluation tool described on it. We use the site for corporate innovation consulting, intrapreneurship program design, venture diagnostics and educational resources.
3. What we collect
Website visits
Usage data. Pages visited, clicks, referral source, browser and device type, and approximate location, collected through cookies and analytics tools.
Cookie data. Identifiers stored on your device to measure site performance and advertising effectiveness.
Behavioural data. Session replays, heatmaps and interaction metrics collected by Microsoft Clarity to understand how visitors use our website.
E-mail sign-up
If you sign up for our e-mail notes, we collect your e-mail address, the time you signed up, the version of the consent text you agreed to, and a salted hash of your IP address. We use them to send you the notes you asked for, offers on our services when the box you ticked included them, and to prove what you agreed to. You confirm your address before anything is sent, and every e-mail has a link that stops them at once. We send the e-mails through Resend and keep the contact record in HubSpot.
Inquiry form
If you write to us through the inquiry form, we collect your organisation, your name, your role, your e-mail address and your message, with a salted hash of your IP address. Your message goes to the two people who run The Brutally Honest Innovator and is kept in our contact records in HubSpot, so that we can reply and follow up.
Innovation Model Finder
When you answer the Innovation Model Finder, we store how you split the 10 points, your two answers on timing and on who would run it, the role you picked if you picked one, the language, the date and time, the event the link came from if it came from one, and the model or models your answers point to. Answers given to the first version of the finder (five ratings and a tie-break) stay stored as they were. The record holds nothing that identifies you: no name, no e-mail address, no IP address and no cookie identifier, so it cannot be linked to you. The answers make up the totals the finder shows everyone, and the totals of an event in its own room; a group's totals show only once it has five answers.
If you ask us to send you your result, we use your e-mail address to send that one e-mail through Resend and do not keep it in our records. Resend keeps its copy of sent e-mails for 30 days. So that the form cannot be used to send e-mail to other people, we count requests per network and per receiving address under salted hashes that cannot be turned back into either; the counts are deleted within two days. If the e-mail bounces or is marked as spam, we keep only a hash of the address, so that we never write to it again. If you also tick the box for our notes, the e-mail sign-up above applies. If you have allowed marketing cookies, our server also reports that you asked for your result, as described under Reporting our forms from our server; that report carries neither your answers nor your e-mail address.
Business contacts
If you work at an organisation we think could use our services, we may contact you by e-mail. We collect your name, role, organisation, work e-mail address and public professional profile from public sources, such as organisation websites and professional networks, and from the business data provider Apollo. Every message we send tells you where we found your details and lets you object; if you do, we stop and keep your address only on a list that makes sure we never contact you again.
4. How we use it and why
Sending the e-mail notes and offers you signed up for, and proving you asked
Lawful basis: Consent, which you can withdraw at any time
Replying to and following up on your inquiry
Lawful basis: Legitimate interest: answering a request you started
Sending you the Innovation Model Finder result you asked for
Lawful basis: Legitimate interest: answering a request you started
Analytics and marketing cookies and tags
Lawful basis: Consent, given through the cookie banner
Reporting a sent form to Meta, TikTok and OpenAI from our server
Lawful basis: Consent to marketing cookies
Strictly necessary cookies, including remembering your cookie choice
Lawful basis: Legitimate interest: making the website work
Contacting business contacts about our services
Lawful basis: Legitimate interest: offering our services to organisations. You can object at any time.
| Purpose | Lawful basis |
|---|---|
| Sending the e-mail notes and offers you signed up for, and proving you asked | Consent, which you can withdraw at any time |
| Replying to and following up on your inquiry | Legitimate interest: answering a request you started |
| Sending you the Innovation Model Finder result you asked for | Legitimate interest: answering a request you started |
| Analytics and marketing cookies and tags | Consent, given through the cookie banner |
| Reporting a sent form to Meta, TikTok and OpenAI from our server | Consent to marketing cookies |
| Strictly necessary cookies, including remembering your cookie choice | Legitimate interest: making the website work |
| Contacting business contacts about our services | Legitimate interest: offering our services to organisations. You can object at any time. |
Giving us your data is voluntary. Where a form marks a field as required, we need it to provide what you asked for; without it we cannot, for example, create your account or deliver a purchase.
Our forms use Cloudflare Turnstile to check that a person, not a bot, is using them. While a form is on the screen, Turnstile reads your IP address and technical details of your browser and connection, such as the browser type. Cloudflare does this for us as our processor, and also uses these details as its own controller to improve Turnstile. The lawful basis is our legitimate interest in keeping our forms free of bots.
6. Who processes data for us
These companies process personal data on our behalf. The same list is on our Sub-processors page. Marketing services run only after your consent.
Supabase (via Lovable Cloud)
Purpose: Database and server functions for e-mail sign-ups, inquiry forms, the Innovation Model Finder's anonymous answers and our record of your cookie choice, and the public MCP server that answers AI assistants' questions about our services
Location: EU (Sweden and Germany)
Lovable
Purpose: Website hosting
Location: EU and USA
Cloudflare Turnstile
Purpose: Checks that a person, not a bot, is using our forms
Location: USA
Google Tag Manager
Purpose: Tag management
Location: EU and USA
Google Analytics 4
Purpose: Web analytics and event tracking (with consent)
Location: EU and USA
Google Ads
Purpose: Conversion tracking and remarketing (with consent)
Location: EU and USA
Microsoft Clarity
Purpose: Behavioural analytics, heatmaps and session replay (with consent)
Location: EU and USA
Meta (Facebook) Pixel
Purpose: Ad conversion and audience building (with consent)
Location: EU and USA
LinkedIn Insight Tag
Purpose: Ad conversion and audience insights (with consent)
Location: EU and USA
TikTok Pixel
Purpose: Ad conversion and optimisation (with consent)
Location: EU and USA
OpenAI
Purpose: ChatGPT Ads Conversions API: our server reports notes sign-ups, inquiries and requests for an Innovation Model Finder result to measure our ads (marketing, with consent). OpenAI uses this data as an independent controller
Location: EU and USA
Resend
Purpose: E-mail delivery
Location: USA
HubSpot
Purpose: Contact records
Location: EU and USA
Composio
Purpose: Connects our tools: reads bookings into our contact records and runs our e-mail automations
Location: USA
Instantly
Purpose: Sends our business development e-mails
Location: USA
Apify
Purpose: Collects public business contact information
Location: EU and USA
| Service | Purpose | Location |
|---|---|---|
| Supabase (via Lovable Cloud) | Database and server functions for e-mail sign-ups, inquiry forms, the Innovation Model Finder's anonymous answers and our record of your cookie choice, and the public MCP server that answers AI assistants' questions about our services | EU (Sweden and Germany) |
| Lovable | Website hosting | EU and USA |
| Cloudflare Turnstile | Checks that a person, not a bot, is using our forms | USA |
| Google Tag Manager | Tag management | EU and USA |
| Google Analytics 4 | Web analytics and event tracking (with consent) | EU and USA |
| Google Ads | Conversion tracking and remarketing (with consent) | EU and USA |
| Microsoft Clarity | Behavioural analytics, heatmaps and session replay (with consent) | EU and USA |
| Meta (Facebook) Pixel | Ad conversion and audience building (with consent) | EU and USA |
| LinkedIn Insight Tag | Ad conversion and audience insights (with consent) | EU and USA |
| TikTok Pixel | Ad conversion and optimisation (with consent) | EU and USA |
| OpenAI | ChatGPT Ads Conversions API: our server reports notes sign-ups, inquiries and requests for an Innovation Model Finder result to measure our ads (marketing, with consent). OpenAI uses this data as an independent controller | EU and USA |
| Resend | E-mail delivery | USA |
| HubSpot | Contact records | EU and USA |
| Composio | Connects our tools: reads bookings into our contact records and runs our e-mail automations | USA |
| Instantly | Sends our business development e-mails | USA |
| Apify | Collects public business contact information | EU and USA |
7. Services that run under their own privacy policies
Some things we offer run on other companies' services. When you use them, that company handles your data under its own privacy policy, and we receive only what is described here.
Booking a call (Google). Our booking links open a Google Calendar booking page. Google receives the details you enter there and passes your name, e-mail address and the booked time to us, so that we can hold the call. We keep them in our contact records (HubSpot). The lawful basis is the steps you asked us to take before a possible agreement.
Events (Luma). If you register for one of our events on Luma, Luma passes your name, e-mail address and registration answers to us as the host. We keep them in our contact records (HubSpot) to run that event. The lawful basis is our legitimate interest in running an event you registered for.
Newsletters (Substack). If you subscribe to one of our newsletters on Substack, Substack runs the subscription and passes your name and e-mail address to us. We keep them in our contact records (HubSpot) to run that newsletter. The lawful basis is your subscription.
The store (Gumroad). Our e-books and tools are sold on Gumroad (thebrutallyhonest.gumroad.com), which runs the store and the checkout. We do not place our own analytics or advertising tags on the Gumroad store. When you buy or download something, Gumroad's servers send ours the details of the sale, including your e-mail address. We keep your name and e-mail address in our contact records only if you agreed to be contacted at checkout; otherwise we keep only the product and the price. The sale reaches our analytics without your name or e-mail address.
We send you our own marketing e-mails only if you agreed to receive them, and every one of them has a link that stops them. To have your record deleted, write to team@thebrutallyhonest.co.
8. Transfers outside the EU
Some of the services in section 6 are based in the USA. For each transfer outside the EU and the EEA we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework while the recipient remains certified under it, or on another lawful safeguard such as the Commission's Standard Contractual Clauses. Write to team@thebrutallyhonest.co for a copy of the safeguard that applies.
9. How long we keep it
Google Analytics data
How long: 14 months
Microsoft Clarity session data
How long: Up to 30 days
Your cookie choice in your browser
How long: 182 days (cc_cookie); after that the banner asks again.
Records of your cookie choices
How long: 42 months, then deleted: the time a choice applies, plus the three years Finnish law gives for claims. Each record holds a random consent ID, what you allowed, the date and time, the site and page, your browser type and a salted hash of your IP address.
Inquiry form messages
How long: While we are in conversation with you or your organisation; deleted when you ask
Innovation Model Finder answers
How long: Kept for the totals the finder shows. They hold nothing that identifies you.
The e-mail address you send a finder result to
How long: Not kept by us. Resend's copy of the sent e-mail: 30 days. The salted request counts: deleted within two days. After a bounce or a spam report: a hash of the address only, kept so we never write to it again.
E-mail sign-up
How long: Until you unsubscribe or ask us to delete it. After an unsubscribe we keep only the record that you consented and later withdrew.
Unconfirmed e‑mail sign-up
How long: Deleted after 30 days if you never confirm it.
Business contact records
How long: Up to 24 months after our last contact, or until you object. After an objection we keep only your address on our do-not-contact list.
| Data | How long |
|---|---|
| Google Analytics data | 14 months |
| Microsoft Clarity session data | Up to 30 days |
| Your cookie choice in your browser | 182 days (cc_cookie); after that the banner asks again. |
| Records of your cookie choices | 42 months, then deleted: the time a choice applies, plus the three years Finnish law gives for claims. Each record holds a random consent ID, what you allowed, the date and time, the site and page, your browser type and a salted hash of your IP address. |
| Inquiry form messages | While we are in conversation with you or your organisation; deleted when you ask |
| Innovation Model Finder answers | Kept for the totals the finder shows. They hold nothing that identifies you. |
| The e-mail address you send a finder result to | Not kept by us. Resend's copy of the sent e-mail: 30 days. The salted request counts: deleted within two days. After a bounce or a spam report: a hash of the address only, kept so we never write to it again. |
| E-mail sign-up | Until you unsubscribe or ask us to delete it. After an unsubscribe we keep only the record that you consented and later withdrew. |
| Unconfirmed e‑mail sign-up | Deleted after 30 days if you never confirm it. |
| Business contact records | Up to 24 months after our last contact, or until you object. After an objection we keep only your address on our do-not-contact list. |
10. Your rights
Under the conditions the GDPR sets, you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and not to be subject to a decision based solely on automated processing. We do not make such decisions about you. Where we rely on your consent, you can withdraw it at any time; that does not affect what we did before. Write to team@thebrutallyhonest.co. We answer within one month; where the GDPR allows it we may extend this by two months, and if so we tell you within the first month. We have not appointed a data protection officer; the same address reaches the people responsible. You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the data protection authority in the country where you live.
11. Children
Our websites and services are meant for people aged 18 or over, and we do not offer them to children. If you believe a child has given us their data, write to team@thebrutallyhonest.co and we will delete it.
12. Changes to this policy
When we change this policy, we update the date at the top of this page. If a change affects how we use the data of people who have an account with us, we tell them by e-mail before it takes effect.
13. Contact
Questions about this policy or your data: team@thebrutallyhonest.co. Post: Brutally Honest Oy, Koroistentie 4 F 1, 00280 Helsinki, Finland.