Privacy Policy

This policy explains how [COMPANY LEGAL NAME] ("Subswell", "we") handles personal data. It covers two groups of people: account holders (newsletter owners who advertise or publish on Subswell) and readers who subscribe to recommended newsletters through a Subswell widget or recommendation page.

1. Readers: if you subscribed through a recommendation

When you tick a recommended newsletter and click Subscribe, we:

• send your email address to that newsletter's email platform so you receive it. From then on, that newsletter is responsible for your data and must honour your unsubscribe requests;
• record the email, which newsletter recommended it and which you chose, and technical information about the signup (such as your IP address, browser and device information, and approximate location), to keep the Service secure and prevent fraud and abuse;
• receive information about your subscription from that newsletter's email platform, to confirm the signup is genuine.

The newsletter that showed you the recommendation sees only a partly hidden version of your email (e.g. j***n@gmail.com). We never sell your email address or use it to send you our own marketing. To unsubscribe from a newsletter, use the link in its emails. To ask us to delete our record of your signup, email [PRIVACY EMAIL].

2. Account holders: what we collect

• Account data: name, email, password (stored only as a salted hash) and login sessions.
• Technical data: information such as IP addresses and browser and device information, used to keep the Service and your account secure and to prevent fraud.
• Newsletter data: name, description, website, category, audience size and logo you provide.
• Email platform credentials: API keys you connect, stored encrypted (AES-256), used only to deliver subscribers and to verify the referrals we send.
• Payments: top-ups are processed by PayPal (or Stripe). We don't receive your card or bank details, only the amount, status and transaction references.
• Payout details: your PayPal email or bank instructions, used only to pay you.
• Activity: campaigns, partnerships, referrals, balances and transactions, plus technical logs needed to run and secure the Service.
• Support chats and emails: the messages you send through the chat on our website and dashboard or by email to our support addresses, the email you leave if you're not signed in, and, while you have a chat with us, whether you're currently on our site, the page you're on, whether you're typing (and, while you type, a preview of the message before you send it), your approximate location (city and country, worked out from your IP address by our hosting provider; we don't store the IP address), your browser and device type, and your time zone. Only our support team sees these, to help you faster. If our team replies while you're away, we email the reply to your account email or the email you left, and after a chat is closed you can rate it.

3. Why we use it (and legal bases)

• To provide the Service (contract): accounts, campaigns, delivering subscribers, quality check, payments and payouts.
• To prevent fraud and keep the Service secure (legitimate interests).
• To communicate with you (contract / legitimate interests): transactional emails such as confirmations, approvals, low-balance alerts and payouts.
• To meet legal obligations: accounting, tax and responding to lawful requests.

4. Who we share data with

• Advertisers: the email addresses of readers who chose to subscribe to them (see section 1).
• Service providers who process data for us under contract: Vercel (hosting), Neon (database), PayPal / Stripe (payments), Resend (email delivery), security and fraud-prevention providers, and the email platforms you connect (e.g. beehiiv, Kit, Mailchimp, MailerLite, ActiveCampaign, Klaviyo).
• AI providers that power the support assistant (Groq, Google Gemini, Anthropic or OpenAI, whichever is answering): the text of your chat messages and the Subswell help content used to answer. When you're signed in and ask about your own account, the assistant also receives a short summary of what your dashboard shows (for example your balances, payouts, and newsletter and campaign status, but never your payout details or password), and only from AI providers that don't use what they receive to train or improve their products. Some free AI services may use what they receive to improve their products; those never get account details, and we remove email addresses and long numbers from your messages first. Please don't share passwords, card numbers or other sensitive details in the chat.
• Authorities where required by law, or to protect our rights and users against fraud.

We don't sell personal data and don't use advertising or analytics cookies.

5. Cookies

We only use cookies that are essential for the Service: a login session cookie, a cookie remembering which of your newsletters is selected, and, once you use the support chat, a cookie with a random identifier so you see your conversation when you come back. The embeddable widget doesn't set cookies; it may keep a random identifier in your browser's local storage for security purposes.

6. International transfers

Our providers store and process data in the United States and other countries. Where the law requires it, we rely on appropriate safeguards such as Standard Contractual Clauses.

7. How long we keep data

• Account and newsletter data: while your account is open, then up to 30 days after closure (longer where needed for disputes or fraud).
• Support chats: while your account is open (or up to 24 months for chats without an account), and deleted when your account is closed or on request.
• Referral records (including reader emails): as long as needed to screen, settle and audit them. This is typically up to 24 months, then deleted or anonymised.
• Financial records: as long as tax and accounting law requires (commonly 8 years).

8. Security

We use encryption in transit (HTTPS) and at rest, hashed passwords and tokens, and access controls. No system is perfectly secure. If a breach affects you, we'll notify you and the authorities as the law requires.

9. Your rights

Depending on where you live (including under the GDPR/UK GDPR, California's CCPA/CPRA and India's Digital Personal Data Protection Act, 2023), you may have the right to access, correct, delete or port your data, object to or restrict processing, withdraw consent, and nominate someone to exercise your rights. Email [PRIVACY EMAIL] to exercise any right. We'll respond within the time the law requires. You can also complain to your local data protection authority.

10. Grievance officer (India)

[GRIEVANCE OFFICER NAME], [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Email: [PRIVACY EMAIL]

11. Children

The Service is for businesses and isn't directed at anyone under 18. Newsletters must not use Subswell to recruit subscribers under the age their local law requires for consent.

12. Changes

We'll post changes here and, if they're material, notify account holders by email or in the app.

13. Contact

Questions: [PRIVACY EMAIL]. See also our Terms of Service.