PUBLISHER.PAGE
Privacy Policy
Prepared 28 October 2026 · Effective date pending
1. Who is responsible
publisher.page is the service’s brand name. The legal operator responsible for personal data, its location and contact details will be confirmed before this notice takes effect. During invitation-only access, contact the person who sent your invitation with privacy questions. This draft is not an effective privacy notice until these identity details and the processing facts below have been confirmed.
2. Scope and roles
This notice covers our website, publisher accounts, service administration, support and security. For account and operational data, we determine the purposes of processing. When a publisher uses our tools to collect campaign applications, contact messages or reader correspondence, that publisher generally determines why those reader details are used, and we process them to provide the tools on its instructions. Contact that publisher about its campaigns or reader records. We may separately process limited technical and security data for our own service-protection purposes. These roles must be reflected in a separate data-processing agreement, not just this notice.
3. Information processed
Depending on how you use the service, information includes account email and workspace details, password-verification information, authentication sessions, support messages, brands and books, uploaded images and documents, published pages, campaign applications, reader names and email addresses, correspondence, attachments and campaign progress. Optional AI tools process the prompts, text, images or references supplied for the requested task. Technical information can include IP addresses, request details, device/browser information, security events, usage quantities and provider request identifiers. Publishers may enter reader information manually as well as receive it directly through forms or email.
4. Purposes and legal bases
Where GDPR applies, we process account data and requested service features to perform our contract with account holders; security, fraud prevention, service diagnostics and handling ordinary business enquiries on the basis of our legitimate interests in operating a reliable and secure service; and records required by law to comply with legal obligations. Where consent is required for an optional activity, we must obtain it before that activity and allow withdrawal. Reader data processed solely on a publisher’s instructions follows that publisher’s purposes and legal basis, described in its own notice. The legitimate-interest assessment and any consent-dependent activities must be confirmed before publication.
5. Service providers and disclosures
The reviewed local implementation uses Cloudflare for application hosting, database and file storage; Amazon Web Services/Amazon SES for email infrastructure; and OpenAI for optional AI features. Enabled link-safety checks submit URLs to Google Web Risk; URLs can contain personal information, so sensitive identifiers should not be embedded in them unnecessarily. If Paddle checkout is introduced, Paddle will process purchase information as Merchant of Record under its own privacy policy. Confirm the actual production providers, legal entities, contracts and regional configuration before this notice takes effect. Information may also be disclosed to advisers, authorities or other parties where legally required or necessary to protect rights, and in a business transfer subject to applicable protections.
6. Optional AI features
When you request writing, translation or image tools, the relevant inputs are sent to the AI provider to produce the result. Those inputs may include reader correspondence or uploaded reference images. Avoid unnecessary sensitive personal data. Provider retention, training settings and contractual restrictions must be verified for the production account; this draft makes no unverified promise that all inputs are immediately deleted or excluded from every form of provider use.
7. Public content and external services
Selected content becomes publicly accessible when you publish it. Copies may be retained by visitors or external search engines outside our control. Publisher pages can contain external links, retailer links and embedded videos. Following or loading those services can disclose technical information to their providers under their own notices. Publisher-specific notices and any consent requirements remain relevant.
8. Cookies and browser storage
The local implementation uses a first-party session cookie to keep invited users signed in, configured with a seven-day lifetime. Other access and browser-storage mechanisms may support protected downloads, preferences and draft recovery. Before publication, complete a deployed cookie/storage inventory, including infrastructure analytics and embedded media, and add any required consent controls. This draft does not claim the deployed site has no analytics or nonessential tracking.
9. Retention and deletion
We retain account records and workspace content while needed to provide the service, meet legal obligations, resolve disputes and protect security. Moving content Offline or to Trash is not permanent deletion. In the reviewed local media rules, Trash has no automatic expiry, and one prior active-slot image version is retained for up to 30 days; cleanup follows remaining references and may retry failures. Provider-held mail and backups have separate retention. Before publication, document actual account-closure handling, backup rotation, mail/log retention and legal-record periods. Do not promise automatic deletion after a fixed cancellation period until it is implemented and verified.
10. International processing
The operator’s location has not yet been confirmed. Infrastructure or support providers may process data in countries outside the operator’s or users’ countries. Production storage regions, administrative access locations and transfer safeguards must be confirmed and disclosed before publication. Where required, transfers must rely on an applicable adequacy decision or appropriate safeguards such as standard contractual clauses; this draft does not assert those agreements are already in place.
11. Your choices and rights
Depending on applicable law, you may request access, correction, erasure, restriction, portability or objection to processing, and withdraw consent without affecting earlier lawful processing. Contact the person who sent your invitation with privacy requests; we may need proportionate identity verification. For a publisher’s reader records, contact the publisher first; we can assist it where appropriate. You may complain to the competent data-protection authority. Required account information is needed to provide access, and missing information may prevent the requested service. Do not use the service to submit unnecessary sensitive data.
12. Security and decisions
The implementation includes authenticated workspace access and access controls for private files, with additional abuse and link-safety protections. No system can guarantee absolute security. Confirm production monitoring, analytics, marketing practices and any solely automated decisions with legal or similarly significant effects before publication; AI assistance and protective URL blocking should not be confused with a completed assessment of all automated processing.
13. Updates
We will date the effective notice and explain material changes appropriately. Draft prepared on 28 October 2026; no effective date has been set.