Privacy notice

1. Controller and contact

Supplier and data controller: Dragon Raw, trading as Go Greater AI, KVK 97717169, Dorpsstraat 1062, 1566 JM Assendelft, The Netherlands. Email: hello@gogreaterai.com.

For privacy requests, use hello@gogreaterai.com with the subject ‘Privacy request’. We may verify identity before acting on a request.

2. Data we receive

We receive data directly from you and your authenticated account: account identifier, verified email and display name; the sign-in provider identifier when you choose Google or the legacy OpenAI sign-in; language preference and transactional email delivery records; assessment answers; business ideas and notes; tasks, progress and market evidence; growth reviews; Mentor messages, summaries and response ratings; plan, quota and billing identifiers; consent timestamps; and technical security records. If you join the Founding Member or marketing list, we also keep the submitted name and email, language, source, the exact consent wording and version, consent time, an abuse-prevention network hash, subscription status and unsubscribe record.

• Paddle handles full payment-card details; Go Greater AI does not store them.
• We store hashed session tokens and hashed one-time sign-in codes, not your Google password, email password or ChatGPT password.
• The service is not designed for special-category personal data, payment-card data, passwords or confidential data about people who have not agreed to its use.

3. Purposes and legal bases

We process account and workspace data to perform the service contract; billing data to provide purchased access and meet accounting obligations; security records for our legitimate interest in preventing abuse and protecting the service; support correspondence to answer requests; and optional processing based on consent where the interface asks for it. Launch news, Founding Member offers and other marketing emails are sent only while the separate marketing consent is active.

Providing account and workspace information is necessary for personalised saved functionality. Marketing consent is optional, is not a condition of using the service and can be withdrawn through the unsubscribe link or by contacting us.

4. AI processing and web research

Mentor messages and relevant saved business context are sent to OpenAI to generate a response. When web research is used, the system sends a search query derived from the request and may display source links. Do not include unnecessary personal data in prompts.

The Mentor supports you but does not make a decision that produces legal or similarly significant effects about you. You remain the decision-maker and can request correction, start a new conversation or delete your data.

5. Recipients and processors

We use OpenAI for AI generation, hosting/Sites and the optional legacy sign-in path; Google only when you choose Google sign-in; Cloudflare infrastructure for delivery and database services; Paddle as Merchant of Record for checkout, tax, receipts and subscription management; and Resend for one-time sign-in codes, account, subscription and consent-based marketing email delivery. Professional advisers or authorities may receive limited data where required for legal, security or claims purposes.

We do not sell personal data and do not use behavioural advertising profiles.

6. International transfers

Some providers may process data outside the European Economic Area. Where the GDPR requires it, transfers rely on an adequacy decision, approved contractual safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism. Provider privacy and transfer information may also apply to their independent processing.

7. Retention

Workspace content, Mentor conversations and feedback are kept while the account remains active so work can continue. Authenticated account deletion removes these application records. Active marketing subscriber data is kept until consent is withdrawn; a minimal unsubscribe record may remain where necessary to honour the opt-out and demonstrate compliance.

Transaction and accounting records are kept for the period required by Dutch tax and accounting law. Support, security, consent evidence and dispute records are kept only as long as reasonably necessary for their purpose or a legal claim. We review retention when the purpose or law changes.

8. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability or objection and may withdraw consent without affecting earlier lawful processing. The workspace footer provides authenticated export and deletion controls. You may also email us.

You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your country. We will not treat you unfairly for exercising a privacy right.

9. Security and incidents

We use authentication, user-level data separation, server-side secrets, request limits, input limits, signed billing webhooks, security headers and restricted administrative access. No online system is risk-free. If a personal-data breach requires notification, we will notify the competent authority and affected people as required by law.

10. Cookies, local storage and children

Authentication and security use essential, secure, HTTP-only session cookies and short-lived cookies during optional Google sign-in. Local browser storage remembers language and interface choices. The current release does not use advertising cookies. If analytics or marketing cookies are added, we will update this notice and request consent where required.

The service is for adults and is not directed to children. Contact us if you believe a child provided personal data.

11. Changes

We update this notice when data use, providers or law materially changes. The current date appears at the top. Material changes will be highlighted in the service or communicated directly where required.