Privacy Policy

1. Who is responsible

For account data and website visitors, we are the controller. For subscriber data that our customers upload or collect, the customer is the controller and we act as processor on their instructions. Subscribers should direct requests to the sender named at the bottom of each newsletter; we also honor unsubscribe and deletion requests directly.

2. What we collect

Account holders: email address, password (hashed), organization details you enter (name, website, sender details, postal address, contact), and usage records such as issues created and approved.

Subscribers: email address, optional name and company, the legal basis recorded by the sender, the date and source of consent, IP address and browser information when they use our signup or unsubscribe pages, and engagement events (delivery, bounce, complaint, open and click).

Website visitors: standard server logs and analytics data (Google Analytics 4 with IP anonymization) and the URL you submit when you request a sample issue.

Contact form: the name, email, message and language you submit.

3. Why and on what basis

To provide the Service under our contract with the account holder; to send confirmation, security and service emails; to generate newsletter drafts from the website content the customer designates; to keep legally required records of consent and unsubscribe; to protect the Service against abuse; and, with your consent where required, to measure website usage.

Legal bases under the GDPR: performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interests in security and improvement (Art. 6(1)(f)) and consent (Art. 6(1)(a)) where applicable.

4. AI processing

Newsletter drafts are generated by sending the designated website articles and the organization name to Anthropic’s Claude API. We do not send subscriber lists to the AI model. Anthropic processes this data as our service provider and, under its API terms, does not use it to train models.

5. Service providers and transfers

We use Supabase (database and authentication, hosted in Tokyo, Japan), Amazon Web Services SES (email delivery, Tokyo region), Vercel (application hosting, functions in Tokyo with a global edge network), Anthropic (AI drafting) and Google Analytics (website analytics). Data may be transferred outside your country, including to Japan and the United States. Japan benefits from an EU adequacy decision; for other transfers we rely on standard contractual clauses or equivalent safeguards offered by the provider.

6. Retention

Account and subscriber data are kept while the account exists and deleted within 90 days after closure. Consent, confirmation and unsubscribe records are kept for at least three years, and longer where the law requires, in a form that identifies the subscriber only as needed to prove the record. Engagement events are kept for 24 months. Sample-issue requests are kept for 30 days.

7. Your rights

Depending on your location you may have the right to access, correct, delete or export your data, to restrict or object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority. Subscribers can unsubscribe from every email in one click and can request deletion from the same page; we complete deletion immediately by removing identifying details and keeping only a hashed record. Account holders can exercise rights through the dashboard or by contacting us.

If you are in the EU/EEA or the UK you may contact your local data protection authority. Our contact details are on the operator page.

8. Security

Data is encrypted in transit and at rest. Access is restricted to the operator and protected by multi-factor authentication. Sending from unauthenticated domains is prevented; all mail is signed with DKIM and aligned with SPF and DMARC.

9. Cookies

We use a language preference cookie, authentication cookies for account holders, and Google Analytics cookies on public pages. You can block analytics cookies in your browser; the Service works without them.

10. Changes and contact

We will post changes to this policy here and, for material changes, notify account holders by email. Contact us via the contact page or the operator address listed on the operator page.