Effective September 27, 2026

1. Who we are and what this policy covers

Quilli ("Quilli", "we", "us") publishes Quilli newsletters and operates quillinewsletter.com and app.quillinewsletter.com (the "Services"). This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. It applies to subscribers, website visitors, advertisers, employers who post jobs, event organizers, partners and anyone who contacts us. It should be read together with our Terms and Conditions.

For the purposes of European and UK data protection law, Quilli is the controller of your personal information.

2. Summary

• We collect the information you give us at sign-up (name, work email, company, title, organization type, function, seniority, region, interests and newsletter choices), plus basic technical and email-engagement data.
• We use it to send the newsletters you chose, shape our coverage, keep our list healthy, and describe our readership to advertisers in aggregate.
• We tell advertisers things like how many readers work in a given industry or role. We do not give advertisers your name, email address or other information that identifies you, unless you expressly agree, for example when registering for a sponsored event whose form says so.
• We do not sell your personal information for money, and we do not use advertising cookies or share personal information for cross-context behavioral advertising.
• You can unsubscribe, change your choices, access, correct or delete your information at any time.

3. Information you give us

• Subscription and profile: email address, full name, company, job title, organization type, function, seniority, region, topics of interest, the publications and editions you select, and your acceptance of our Terms.
• Communications: messages you send us, including tips, corrections, people-move announcements, partnership enquiries and support requests.
• Advertisers, employers and organizers: business contact details, billing details, and the content of advertisements, job postings and event listings. Card payments are handled by our payment processor; we do not receive or store full card numbers.
• Events and webinars (if offered): registration details, and any questions you submit.

4. Information we collect automatically

• Email engagement: our emails contain standard tracking technologies that record whether an email was opened and which links were clicked, along with the time, approximate location derived from IP address, and device or email-client type. Some email clients (for example, Apple Mail Privacy Protection) may cause opens to be recorded automatically.
• Website usage: pages visited, referring page, time and date, browser and device type, and approximate location derived from IP address, collected through privacy-focused analytics that do not use advertising cookies.
• Security and operations: IP address, request logs and signals from anti-spam and bot-protection tools (such as Cloudflare Turnstile) used to prevent abuse of our forms.
• Cookies: we use strictly necessary cookies, for example to keep you signed in and to remember your preferences. We do not use third-party advertising or cross-site tracking cookies.

5. Information from other sources

We may match the domain of your work email address, or the company name you provide, to our own database of companies so that we can understand our readership by company and industry. We may also receive information from service providers (for example, delivery and bounce information from our email provider) and from partners where you have asked them to share it with us.

6. How we use your information

• Provide the Services: send the newsletters and editions you chose, manage your subscription and sign-in, and respond to you.
• Improve and shape coverage: understand which topics, industries and roles our readers work in and which items they find useful.
• Aggregate audience reporting: produce statistics about our readership (for example, the share of readers in utilities, or at director level or above) and campaign results (for example, total opens and clicks on a sponsored placement) to sell and report on advertising. These reports do not identify individuals.
• List hygiene and deliverability: remove invalid or long-inactive addresses and keep our email sending reputation healthy.
• Commercial relationships: process advertising, job-posting and listing purchases, invoices and payments, and communicate with advertisers, employers and partners.
• Security and integrity: detect and prevent spam, fraud, abuse, scraping and security incidents.
• Legal: comply with law, enforce our Terms, and establish, exercise or defend legal claims.
• Business transfers: evaluate or carry out a merger, acquisition, financing, reorganization or sale of all or part of our business, including an individual publication.

7. Legal bases (EEA and UK)

Where European or UK law applies, we rely on: performance of a contract (to provide the newsletters you request); consent (for optional communications and any sharing you expressly agree to, which you may withdraw at any time); our legitimate interests (to improve our Services, produce aggregate audience statistics, keep our list healthy, secure the Services and grow our business, balanced against your rights); and legal obligation (for tax, accounting and legal compliance).

8. How we share information

We share personal information only as described below:

• Service providers that process data on our behalf under contract, including: Ghost (newsletter publishing, membership and email delivery, with its email delivery provider); Supabase (database hosting); Vercel (website and application hosting); Cloudflare (DNS, security, bot protection and web analytics); Stripe (payments); and providers of email, customer-relationship management, analytics, AI processing and professional services.
• Advertisers and partners: aggregate, de-identified statistics only, unless you expressly agree to share your details with a named sponsor (for example, on a sponsored event registration form).
• Legal and safety: where required by law, subpoena or court order, or where we believe disclosure is necessary to protect the rights, property or safety of Quilli, our readers or others.
• Business transfers: to a buyer, successor or investor in connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business, including the sale of an individual publication together with its subscriber list. We will require the recipient to honor this policy or notify you of material changes.
• With your consent or at your direction.

9. Artificial intelligence

We use AI tools to help collect, classify and draft news content from public sources. We do not use your personal information to train third-party AI models. Where an AI service provider processes personal information for us (for example, to help answer a support request), it does so under contract as our service provider.

10. How long we keep information

• Subscriber and profile information: while you remain subscribed, and for up to 24 months after you unsubscribe so that we can honor your preferences, after which it is deleted or de-identified. We keep a minimal suppression record (your email address and unsubscribe status) so we do not email you again.
• Email engagement data: individual-level data for up to 24 months, then only in aggregate.
• Advertiser, employer and billing records: as long as needed for the relationship and for up to 7 years for tax and accounting purposes.
• Security logs: typically up to 90 days, longer if needed to investigate an incident.
• Legal holds: longer where required by law or to resolve disputes.

11. Your choices

• Unsubscribe from any newsletter using the link in each email, or change your choices from the Manage subscriptions link.
• Update your profile information at any time.
• Block or delete cookies in your browser settings; strictly necessary cookies are required for sign-in.
• Many email clients let you block images, which prevents open tracking.

12. Your rights

Depending on where you live, you may have the right to: know what personal information we hold about you and how we use it; access a copy; correct inaccurate information; delete your information; receive your information in a portable format; object to or restrict certain processing; withdraw consent; and not be discriminated against for exercising your rights. To exercise these rights, email support@quillinewsletter.com. We will verify your request, usually by confirming control of your email address, and respond within the time required by law. You may use an authorized agent where the law permits. If we deny your request you may appeal by replying to our decision, and you may complain to your data protection authority or state attorney general.

13. U.S. state privacy disclosures

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws have the rights described above, subject to the conditions of those laws. In the preceding 12 months we have collected the following categories of personal information: identifiers (name, email address, IP address); professional or employment-related information (company, job title, function, seniority, organization type); commercial information (purchases of advertising or listings); internet or other electronic network activity (email engagement and website usage); and inferences about professional interests drawn from the topics you select and the items you click. We collect them from the sources and use them for the purposes described in this policy, and disclose them to the categories of recipients described in "How we share information". We do not sell personal information, do not share personal information for cross-context behavioral advertising, and do not use or disclose sensitive personal information for purposes that require a right to limit. We honor Global Privacy Control signals as a request to opt out of any sale or sharing.

14. International transfers

We are based in the United States and our service providers may process information in the United States and other countries. Where we transfer personal information from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK addendum, or the EU-U.S. Data Privacy Framework where a provider is certified.

15. Security

We use administrative, technical and physical safeguards appropriate to the information we hold, including encryption in transit, access controls limited to staff who need access, server-side-only handling of secret keys, and bot and abuse protection. No system is completely secure, and we cannot guarantee the security of information transmitted to us. If we become aware of a breach that affects your personal information, we will notify you and regulators as required by law.

16. Children

The Services are intended for adult professionals and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact support@quillinewsletter.com and we will delete it.

17. Do Not Track

Some browsers send a "Do Not Track" signal. Because there is no common standard for these signals, we do not respond to them, but we do honor Global Privacy Control as described above.

18. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, for material changes, notify subscribers by email or a notice on the website before the change takes effect.

19. Contact

Quilli. Email support@quillinewsletter.com.