Legal
Privacy Notice
Traffic Lights, Inc. · Effective September 14, 2026 · Questions: privacy@traffic-lights.io
This notice covers how Traffic Lights handles personal information collected through this website and the Traffic Lights platform. Customer Data that flows through Traffic Lights as part of your workflows is handled under your organisation's instructions and the applicable pilot or enterprise agreement.
What we collect
When you visit this website or apply for early access, we collect:
- Contact information — name, work email, company, and what you are trying to govern.
- Usage information — pages visited, browser type, and timestamps. We use three analytics tools: Vercel Analytics (aggregate page metrics, no personal data stored), Plausible Analytics (privacy-first, no cookies, no personal data), and Microsoft Clarity (session recordings to understand navigation patterns). None of these tools require a cookie consent banner under standard interpretations of GDPR because they do not collect personal data or use tracking cookies.
When you use the Traffic Lights platform as a pilot participant, we additionally collect:
- Account information — name, email, organisation, and role.
- Operational events — the structured event payloads your systems emit to Traffic Lights. You control which fields are included. No access to your databases, applications, or anything inside your infrastructure is required or used.
- Approval and decision records — who approved what, when, and what context was presented. This is the audit trail the platform exists to create.
How we use it
- To operate the platform, route notifications, and maintain your audit trail.
- To respond to your early access application and communicate about the pilot.
- To improve the platform — using anonymised, aggregated patterns such as escalation rates and threshold distributions, never individual customer data. You can opt out by emailing privacy@traffic-lights.io.
- To comply with law and protect the security of the platform.
We do not sell personal information. We do not use it for advertising.
Our security posture
Traffic Lights does not connect to your databases, applications, or anything inside your infrastructure. You emit structured events to us. We govern what happens to them. We never reach back in. The Event SDK schema is publicly documented. No PII required. No proprietary data required.
Who we share it with
- Infrastructure providers — AWS (hosting), Snowflake (analytics), Microsoft (Teams notifications). All under contractual data protection terms.
- Optional AI providers — if you connect Claude, ChatGPT, or Gemini via MCP, those providers process only what you configure them to receive under their own terms.
- Nobody else — unless required by law, or in a future acquisition with appropriate safeguards.
Your rights
You may request access to, correction of, or deletion of personal information we hold about you. Email privacy@traffic-lights.io. We will respond within 30 days.
If you are in the EU or UK, you have additional rights under GDPR including the right to lodge a complaint with your supervisory authority.
Retention
Website inquiry data is retained for 2 years or until you request deletion. Pilot operational data is retained for the duration of the pilot plus 90 days, then deleted, unless a longer period is agreed in writing.
Changes
We will update this notice as the platform and our practices evolve. Material changes will be communicated to active pilot participants by email.