Privacy Policy

This policy explains what personal information Greyspace (“Greyspace”, “we”, “us”, “our”) collects when you take part in the Greyspace Index, why we collect it, and the choices you have. Greyspace is an independent benchmark operated from New York, United States, by its founder rather than a company; you can reach us at any time at harry@greyspaceindex.com.

The short version: your individual figures are never shown to anyone. They exist only to compute the anonymised medians and quartiles we publish, and to produce the confidential report we send back to you. We do not sell your data, and we do not share it except as described below.

Who we are

Greyspace runs a quarterly benchmark of AI spend and return for venture- and growth-stage software companies. It is an independent project based in New York, United States, run by its founder rather than a company. For the purposes of data-protection law, Greyspace is the data controller for the information described here.

Information we collect

• Identity and contact details you provide to register: your name, work email address, job title and company.
• Survey responsesyou submit: business and operating figures (for example AI spend, R&D and COGS, gross margin, headcount, CARR and growth), your self-assessment across the four pillars, and any optional free-text remarks or investor names you choose to add.
• Verification and technical data needed to operate the service: a one-time email verification code (we store only a salted hash of it, never the code itself), a session token that lets you save and resume, and basic request information such as your browser type.

How and why we use it

• To verify that you are a real operator at the company you name (the email-code step).
• To compute the benchmark: your figures feed the anonymised cohort medians and quartiles, and your own percentile standing.
• To produce and deliver your confidential report after each cycle closes.
• To contact you about your submission, your report, and future cycles.
• To vet submissions by hand for legitimacy and data quality before they enter the benchmark.

Our legal bases for this processing are your consent (which you give by submitting, and can withdraw at any time) and our legitimate interests in operating and improving the benchmark. Providing your data is voluntary, but we cannot produce your report or place you in a cohort without it.

How your data appears in our outputs

Published results are aggregate only: medians and quartiles within a peer group, never figures attributed to you. Cohorts are sized so that individual companies cannot be reverse-identified. If you provide free-text remarks and indicate they may be quoted, any quote is anonymised— shown by title and company type only, never your name — and only with your indicated permission.

When we share information

We do not sell your personal information or your figures. We share data only in these limited ways:

• Service providers who process data on our behalf under contract, solely to run the service: our hosting and database providers (Vercel, Supabase) and our email provider (Resend). They may not use your data for their own purposes.
• Named investors — only if you opt in. The survey lets you choose to let investors you name see you by name on their portfolio view. This is off by default; you stay anonymous everywhere else regardless.
• Legal requirements. We may disclose information if required by law or to protect our rights, but we will resist over-broad requests.

International transfers

Our service providers may process data in countries other than yours. Where they do, we rely on their contractual safeguards (such as standard contractual clauses) to protect your information.

How long we keep it

We keep your registration and submission data for as long as you participate in the benchmark and for a reasonable period afterwards to maintain quarter-over-quarter trends. You can ask us to delete your data at any time (see your rights below). Verification codes are short-lived and expire automatically.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email harry@greyspaceindex.com. If you are in the UK, EU or a similar jurisdiction, you also have the right to complain to your data-protection regulator.

Cookies

We use a single functional cookie: a session token that remembers your verified session so you can save your progress and resume. We do not use advertising or third-party tracking cookies, so no cookie banner is required.

Security

We protect your data with measures appropriate to its sensitivity, including encrypted transport, access controls, and storing verification codes only as salted hashes. No system is perfectly secure, but we treat your figures as confidential by design.

Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above and, for material changes, take reasonable steps to let participants know.

Contact

Questions about this policy or your data? Email harry@greyspaceindex.com.