Being finalized. The company's business ID and the location of our server are still being completed; the rest of this notice describes how we work. Questions: [email protected].

Privacy

Privacy notice

Updated 10 October 2026. Articles 13 and 14 of the EU General Data Protection Regulation (GDPR). Section 13 is for people who are not readers but appear in a reader's profile.

1. Controller

Palomaki Labs Oy, Helsinki, Finland. Business ID: [pending]. Privacy contact: [email protected]. The same address works for every request in this notice.

2. Who this notice covers

Readers: people who sign up for an Edition of One newsletter, its free trial or its beta. We research and send issues only to people who have signed up and consented. We never send issues to anyone unasked, and we never research a person who has not signed up.

People named in a profile: coauthors, colleagues, board members, the organizations and public figures a reader follows. Section 13 is for you.

3. What we process about readers

• What you give us at signup: name, email address, organization, role or field, the links you add, what you want us to follow, the language of your issue, and the time and wording of your consent.
• Notes from your AI assistant (optional): if you paste what your assistant knows about you, we treat it as facts you told us. Before we keep any of it, we remove anything about health, religion or beliefs, ethnic origin, sexual orientation, trade union membership, home address, identification numbers and private finances, and anything about other people beyond their name and public role. Please do not paste other people's details.
• Your profile: what we find about you in public sources.
  • Work: current and past roles, companies and positions of trust, field, publications, talks, exhibitions or research, and publicly named collaborators.
  • Interests: hobbies, culture, sport, causes and places you follow, and public milestones.
  • Political interests and views, only if you tick the optional box at signup, and only what you have said publicly yourself. We never infer political views from whom you follow or what you like.
  • Your public network: the organizations, communities and public figures you follow and engage with. Other people appear only by name and public role.
• The profile log: a dated list of what you tell us in replies or on your page and what our weekly scan learns, so that your issues keep up with you.
• Your issues, reactions and settings: the issues we sent you, the items you marked useful, not for me or acted on, your replies, and your settings (language, cadence, pause).
• Billing: plan, dates and payment status. Card details are handled by our payment provider, never by us.
• Technical data: email delivery data (delivered, bounced), server logs, and one session cookie on your reader page (section 8).

We never record information about your health, religion or beliefs, ethnic origin, sexual orientation or trade union membership, nor your home address, identification numbers or private finances, even if a public source or your own notes mention them.

4. Sources

You, and public sources: company and trade registers, websites and press releases of companies and organizations, news media and trade press, publication databases and preprint servers, exhibition and event pages, public search engine results, and your own public social media accounts and posts: LinkedIn, Instagram, X, Bluesky, Threads, Mastodon, Facebook, TikTok, YouTube, GitHub, Substack, Medium and blogs.

We read social media through public interfaces (for example Bluesky's and Mastodon's public APIs, RSS feeds) and through search engine results, never by logging in and never by crawling the platforms. We skip accounts that are private or that have opted out of search indexing. From the accounts you follow we note only organizations, communities and public figures.

5. Purposes and legal bases

• Researching public sources to build and maintain your profile (work, interests, public network, the notes you paste): your consent, GDPR Art. 6(1)(a), given at signup. You can withdraw it at any time (section 9).
• Political interests and views you have expressed publicly: your explicit, separate and optional consent, Art. 9(2)(a). Without that consent we leave politics out entirely.
• Delivering your subscription (choosing items, writing and sending issues, the reader page, replies, customer service, pause and stop): contract or steps before a contract, Art. 6(1)(b). The free trial is delivered at your request on the same basis.
• Billing and bookkeeping: legal obligation, Art. 6(1)(c), Finnish Accounting Act.
• Keeping a suppression list so that we do not write to someone who has stopped or objected: legal obligation and legitimate interest, Art. 6(1)(c) and (f).
• Improving the service with aggregate figures (for example which sections readers find useful) and with feedback from which the reader cannot be identified: legitimate interest, Art. 6(1)(f).
• People named in a profile: legitimate interest, Art. 6(1)(f); see section 13.

Your profile is used for one thing: choosing and explaining the items in your own issues. Nobody else sees it, it is not used for advertising, and it is never sold or shared. We make no decisions about you with legal or similarly significant effects (Art. 22).

6. Recipients and processors

These providers process data on our behalf under data processing agreements:

• Brevo (Brevo SAS, France): the subscriber list, consent records and sending email. Data stored in the EU.
• Cloudflare, Inc. (United States): the website, the signup form, incoming email to our domain, and the reader page with its stored issues, profile summary and settings. Cloudflare's key-value storage is replicated across its global network, so this data is also stored outside the EU.
• Anthropic, PBC (United States): the AI models that read sources, extract facts and draft issues. During the trial phase we use Anthropic's Claude under its consumer terms with the account's model-training setting switched off, so inputs are not used to train models; before paid subscriptions open we move to Anthropic's commercial API, which comes with a data-processing agreement.
• Serper (search API): runs our web searches, which include your name and the names of your organizations.
• Our own server: the profiles, logs and issues are kept on a server we operate ourselves. At present it is located in the United States; we are moving it to a hosting provider in the EU. Backups are encrypted on the server before they are stored at Dropbox, Inc. (United States), which cannot read them.
• Accounting: an accounting firm in Finland, for bookkeeping.

Our payment provider, a merchant of record, sells the subscription to you as the seller of record, handles the card payment, taxes, receipts and refunds, and is an independent controller for the billing data it collects under its own privacy notice. We name it in the terms of service once payments open.

We never sell your data, share it for anyone else's marketing, or buy data about you.

7. Transfers outside the EU and EEA

Transfers to the United States rest on the EU–US Data Privacy Framework where the provider is certified (Cloudflare is) and otherwise on the European Commission's standard contractual clauses (Anthropic, Serper, and Dropbox for the encrypted backups). Processing on our own server in the United States is done by us, not by a third party; we apply the GDPR to it in full and treat the location as a reason to move to the EU. Ask us for copies of the safeguards.

8. Cookies and the reader page

The website sets no analytics, advertising or tracking cookies, and we do not track whether you open our emails. Your reader page sets one session cookie (eo_my) when you open it from the signed link in your issues. It keeps you signed in for 30 days, is not readable by scripts, is sent only to your page, and holds no data about you beyond the session. It is strictly necessary for the page you asked for, so it needs no consent. Deleting it signs you out.

9. Withdrawing consent, pausing, stopping

You can withdraw your consent to the research at any time: reply to any issue, use your reader page, or write to [email protected]. We then stop researching, stop sending, and delete your profile as described in section 10. Withdrawing does not affect the lawfulness of what was done before. You can also pause issues for a while or turn the optional political-views consent off; both take effect from the next issue.

10. How long we keep data

• Profile, profile log, issues, replies, reactions, settings and the copies on your reader page: for as long as your subscription or trial runs, and 30 days after it ends, so that you can come back and we can answer questions about your last issue. If you ask for deletion, we delete at once, within a month at the latest.
• Unconfirmed signups (no click on the confirmation email): deleted after 7 days.
• Consent records (who consented, when, to which wording): 3 years after the subscription ends, as proof of consent.
• Suppression list: a one-way hash of your email address and the date, for as long as you have not asked to be written to again. We cannot recover the address from the hash.
• Billing records: as the Finnish Accounting Act requires (vouchers 6 years, books 10 years, from the end of the financial year).
• Server and email logs: 90 days.
• Encrypted backups: rotated so that deleted data is gone from them within 30 days.

11. Your rights

You have the right to know what data we hold about you and to get a copy (your reader page has a download button; the full profile on request); to have inaccurate data corrected (edit it on your page or tell us); to have data erased; to restrict processing; to receive the data you gave us in a portable format; to object to processing based on legitimate interest; and to withdraw consent at any time. Requests: [email protected] or your reader page. We answer within one month.

Objecting to direct marketing. Issues are the service you subscribed to; emails that offer you a plan or a change of plan are marketing. You can object at any time by replying "no thanks" or using the opt-out line in the message, and we will not send marketing again.

12. Complaints

You can complain to the supervisory authority: the Office of the Data Protection Ombudsman, Finland, tietosuoja.fi, or the data protection authority of the EU country where you live. Readers outside the EU can write to us; we give everyone the rights listed above regardless of where they live.

13. People who appear in a reader's profile

A reader's profile may name you if you are publicly connected to their work: a coauthor, a colleague, a board member, a competitor's executive, or an organization or public figure they follow. This section is our notice to you under Article 14. Because the profiles name many people and we have no contact details for them, informing each person individually would be a disproportionate effort (Art. 14(5)(b)), so we publish the information here.

• What we hold: your name and public role, as they appear in a public source (an author list, a company register, a conference page, a public social media profile). Nothing else: no contact details, no views, no private matters.
• Why: to understand the reader's work and network so that we can choose items for them. Legal basis: legitimate interest, Art. 6(1)(f). We have assessed that this does not override your interests: the data is public, minimal, seen by nobody but the reader, never used to contact you, and never sold.
• Where it comes from: the public sources in section 4.
• How long: as long as the reader's profile exists (section 10).
• Your rights: to ask what we hold about you, to object, and to have your name removed. Write to [email protected] with your name; we remove you from profiles on request and answer within a month. You can complain to the authority in section 12.

14. Providing data

We need your name and email address to deliver the subscription, and your consent to research you to make it personal. Everything else is optional; it makes the first issue better.

15. Age

Edition of One is for adults. We do not knowingly process data of anyone under 18.

16. Changes

We update this notice when our processing changes and tell readers by email of changes that matter, for example a new processor or a new server location. The date of the latest update is at the top.