Privacy policy

1. Who we are and who this covers

EditionCove, Inc. (“EditionCove”, “we”) operates the EditionCove platform at editioncove.com. This policy covers two kinds of people:

• Publishers — people and organizations who create an account to run a publication. You are our customer, and we are the controller of your account data.
• Subscribers — readers who buy a subscription to a publisher's newsletter. The publisher is the merchant of record and decides what to send you; we process your information on the publisher's behalf to bill, address and mail their publication. Where this policy says what we do with subscriber data, we do it as the publisher's service provider.

2. Information we collect

From publishers

• Account details: name, email address, password (stored hashed), organization name and the roles of any team members you invite.
• Publication details: name, description, format, schedule, pricing and the content of your issues, including uploaded PDF files and editor documents.
• Billing details for your software subscription and fulfillment charges. Card numbers are entered directly with Stripe and never touch our servers; we store Stripe's identifiers and the last four digits.
• Your Stripe connected-account identifier and the onboarding status Stripe reports to us.
• Support messages you send us.
• Usage information: pages visited in the dashboard, actions taken (which we record in an audit log for your own protection), IP address, browser type and timestamps.

From subscribers

• Name, email address and the mailing address you give at checkout or update later, plus the verification status of that address and any corrected form suggested by an address-verification service.
• Subscription details: plan, price, start date, paid-through date, status, pause and cancellation dates.
• Payment details are collected by Stripe on the publisher's account. We receive and store the subscription and payment status, the amount, the last four digits and card brand, and never the full card number.
• Fulfillment records: which issues you were entitled to, whether a copy was mailed to you, and any tracking or return event a print provider reports.

Automatically

• Server logs with IP address, request path, user agent and timing, kept for security and debugging.
• A session cookie to keep you signed in and a preference cookie for display settings. We do not use advertising cookies or third-party analytics trackers on the public site or in the dashboard.

3. How we use it

• To run the service: authenticate you, bill publishers, compute which subscribers receive which issue, prepare mailing lists, place print orders, show reports.
• To mail physical newsletters: a subscriber's name and address are sent to the print-and-mail provider for a specific issue, and only for that purpose.
• To verify and standardize mailing addresses so that copies arrive and publishers do not pay to print undeliverable pieces.
• To support you and to investigate and prevent fraud, abuse and security incidents.
• To send transactional messages: receipts, failed-payment notices, approval reminders and service announcements. We do not send marketing email to subscribers, and we only send marketing to publishers who opt in.
• To comply with law, including tax and accounting obligations.

We do not sell personal information, and we do not use publisher content or subscriber data to train machine-learning models.

4. Who we share it with

We share personal information only with service providers that need it to deliver the service (“subprocessors”), each bound by a contract limiting what they may do with it:

• Stripe, Inc. — payment processing, subscription billing, connected-account onboarding and the subscriber billing portal. Stripe's own privacy policy governs the data it collects directly from you at checkout.
• Print-and-mail providers — commercial printers that print, address and mail issues. For each mailing run we send the recipient names and addresses in the frozen manifest and the issue file. The provider used for a run is shown on that run in the publisher's dashboard. Providers may run addresses through USPS address-standardization and change-of-address processing as part of mailing.
• Address-verification services — to standardize and verify mailing addresses.
• Hosting and infrastructure providers — for servers, databases, file storage and email delivery of transactional messages.

We also share information when required by law or legal process, to protect the rights and safety of users and the public, or as part of a merger or acquisition (in which case this policy continues to apply until you are told otherwise). Publishers see their own subscribers' information; they do not see other publishers' data, and we do not share subscriber lists between publishers.

5. Mailing addresses, specifically

A mailing address is the most sensitive thing most subscribers give a publisher. We treat it accordingly:

• Addresses are used only to mail the publication the subscriber paid for and to verify deliverability. They are not used for any other purpose by us.
• Addresses are sent to a print provider only as part of an approved mailing run, and only the addresses entitled to that issue.
• Subscribers can view and change their address from their own subscriber page at any time. Changes made before an issue's cutoff apply to that issue; later changes apply to the next issue.
• Publishers are contractually bound (see the Terms of service) to use subscriber addresses only to fulfil the subscription, and not to sell, rent or share them.

6. Retention

• Publisher account data is kept while the account is active and for 90 days after cancellation to allow export and reactivation, then deleted or anonymized, except for records we must keep for tax, accounting and dispute purposes (generally seven years).
• Subscriber records are kept while the subscription is active and for as long as the publisher's account retains them. When a publisher cancels, they receive a complete export and the records are deleted on the schedule above.
• Fulfillment records (which address received which issue) are kept with the mailing run for the publisher's accounting and for resolving delivery disputes.
• Server logs are kept for 30 days.

7. Security

Data is encrypted in transit. Passwords are stored hashed. Access to production systems is limited to staff who need it and is logged. Each publisher's data is scoped to their organization in every query. Payment card data is handled entirely by Stripe, which is PCI DSS Level 1 certified. No system is perfectly secure; if we learn of a breach affecting your information we will notify you and, where required, regulators, without undue delay.

8. Your rights and choices

Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. How to exercise them:

• Publishers can view and edit account data in Settings, export all records from the data-portability page, and delete the account. See Your data & cancellation.
• Subscribers can update or delete their address and cancel from their subscriber page. For other requests, contact the publisher first — they are the controller of your subscription. If you cannot reach them, contact us at support@editioncove.com and we will help.

We will respond to a verified request within 45 days. We do not discriminate against anyone for exercising a privacy right.

California residents

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the right to know what personal information we collect and how it is used and shared, the right to delete it, the right to correct it, the right to opt out of sale or sharing, and the right to limit the use of sensitive personal information. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information other than as necessary to provide the service. To exercise a right, email support@editioncove.com with the subject “California privacy request”. You may use an authorized agent; we will ask for proof of authorization. For subscribers, we act as a service provider to the publisher and will refer your request to them where the law requires.

Other US states, the EU/UK and elsewhere

We serve United States publishers and mail to US addresses at launch. If you are outside the US and have given us personal information anyway, you may have similar rights under your local law, and you can exercise them through the same contact address.

9. Children

The service is for adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided information to us, contact us and we will delete it.

10. Changes

When this policy changes we will update the date at the top and, for material changes, notify publishers by email and show a notice in the dashboard before the change takes effect.

11. Contact

EditionCove, Inc.
support@editioncove.com
Or use the contact form.