Security and data handling

Your subscribers' email addresses are one of your most valuable assets. Here is how Newsletter Ready handles and protects that data.

Last updated: 2026-11-04

We don't send your subscriber list to AI

To write drafts, we send the AI (Anthropic's Claude) the articles from the site you chose, your answers in the AI interview, and your organization name. For translation we send the issue text, and for reply handling we send the text of the reply you received.
To score leads we send open, click and reply records, but never email addresses or names. Your subscriber list itself is never sent to an AI model.
Under its API terms, Anthropic does not use this data to train its models.
For the voice interview (Japanese organizations only), audio is sent to AmiVoice (Advanced Media, Inc.) with logging turned off. Neither we nor they store the audio.
If you turn on “Process AI in Japan” in settings, drafting issues from your site's articles and the AI pre-send check run on Sakura Internet's “Sakura AI Engine” in data centers in Japan. That data is then not sent to an AI abroad.

All traffic to and from Newsletter Ready uses HTTPS (TLS). Our database is encrypted at rest by the provider.
Access tokens for connected stores (Shopify, Colorme Shop) are additionally encrypted in the database with AES-256-GCM and never shown on any screen.

Our database (Supabase) and email sending (Amazon SES) are in Tokyo, and the app's server functions (Vercel) also run in Tokyo.
Paid plans are billed through Stripe. We never store card numbers.

You and your team can see only your own organization's subscribers. This is enforced by row-level security in the database.
Only one operator can administer the production database and servers, using two-step verification wherever the provider offers it.
When someone views, imports or moves subscriber personal data, we record who did what, how many records and when, and keep that record for one year.

Every email has an unsubscribe link and supports one-click unsubscribe in Gmail and Yahoo.
Addresses that bounce or report an email as spam are suppressed automatically.
Sending is blocked until the sender details required by law in your region (such as your name and postal address) are filled in.
You can record the consent basis and date for each subscriber. For organizations in the EU and UK, new sign-ups confirm by email (double opt-in).

When you uninstall our Shopify or Colorme Shop app, we delete the connection, the token and the subscribers imported from that store. When a subscriber asks to be erased, we delete their personal data.
The database has automated daily backups by the provider, stored encrypted.

If we become aware of a personal data breach, we notify affected customers within 72 hours, and the authorities where the law requires.
The detailed steps are in our internal security policy.

For security questions, or to report a problem you found, email support@newsletterready.com.