Last updated: 08.09.2026
This Privacy Policy explains how [Company Legal Name] ("The Modern", "we", "us", "our") collects, uses, shares and protects personal data when you use the website at [yourdomain] and its related services (the "Service"), and the rights and choices you have. We are the data controller for the personal data described in this policy.
If you do not agree with this policy, please do not use the Service. Capitalised terms not defined here have the meaning given in our Terms of Service.
1. Personal data we collect
We collect the following categories of personal data. Where a category is optional, you can use the Service without providing it.
1.1 Data you give us
- Account data: your name or display name, email address and password. Passwords are stored only in hashed form; we cannot read them. We also record whether your email address has been verified.
- Profile data (optional): a profile photo and any other details you choose to add to your profile.
- Subscription and billing data: your plan, subscription status, billing period dates, and a history of payments and invoices. Card and bank details are entered directly with our payment processor, Stripe, and never reach our servers. We store only an identifier that links your account to your Stripe customer record.
- Reading preferences (optional): the topics and sections you choose to follow, the articles you save, and your "For You" feed settings.
- Comments and other content you post on the Service, together with your display name and the time of posting.
- Newsletter sign-up: your email address, if you subscribe to our newsletter.
- Correspondence: anything you send us through the contact form, by email, or in an error report, including your name and email address.
- Search queries you type into the site search, including the AI-assisted search described in Section 4.
1.2 Data we collect automatically
- Technical and security data: your IP address, browser type and version, device type, operating system, the pages you request and the time of each request, referring URLs, and error logs. This is collected through server logs and is used for security, abuse prevention and keeping the Service working.
- Login activity: when you sign in, we record the time, IP address and browser used and send you an alert email so that you can spot unauthorised access.
- Reader ratings: if you rate a review, we record the rating together with a hashed reference to your IP address for 24 hours to prevent duplicate votes.
- Cookies and similar technologies as described in our Cookie Policy.
1.3 Data we do not collect
We do not knowingly collect special categories of personal data (such as health, political opinions, religious beliefs, or biometric data), and we ask you not to include such data in comments or correspondence. We do not build advertising profiles of you, and we do not use your personal data to generate news content.
2. How and why we use personal data
We use personal data for the following purposes, relying on the legal bases indicated (which apply where the EU or UK General Data Protection Regulation, or a similar law, governs our processing):
| Purpose | Data used | Legal basis |
|---|---|---|
| To create and administer your account, authenticate you, and provide the features you request (saving, following, commenting) | Account, profile, reading preferences | Performance of a contract (the Terms of Service) |
| To sell, deliver and manage premium subscriptions, process payments, send receipts and handle billing issues | Account, subscription and billing | Performance of a contract; legal obligation (tax and accounting) |
| To personalise your "For You" feed | Reading preferences you have chosen | Performance of a contract; you control the inputs and can clear them at any time |
| To send transactional emails: verification, password resets, login alerts, billing and subscription notices, account changes | Account, login activity, subscription | Performance of a contract; legitimate interest in account security |
| To send our newsletter | Email address | Consent, which you can withdraw at any time using the unsubscribe link in every email |
| To respond to your questions, error reports and requests | Correspondence | Legitimate interest in responding to you; legal obligation where a request concerns your rights |
| To provide site search, including AI-assisted interpretation of your query | Search query text | Legitimate interest in providing a working search; see Section 4 |
| To keep the Service secure, prevent fraud and abuse, rate-limit logins, and enforce our Terms | Technical and security data, login activity | Legitimate interest in protecting the Service and its users; legal obligation |
| To comply with legal obligations, respond to lawful requests, and establish, exercise or defend legal claims | Any relevant data | Legal obligation; legitimate interest |
| To understand aggregate use of the Service and improve it | Technical data, in aggregated or de-identified form | Legitimate interest in improving the Service |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and interests. You may object to processing based on legitimate interests at any time (see Section 8).
We do not use personal data for automated decision-making that produces legal or similarly significant effects on you.
3. Who we share personal data with
We do not sell personal data, and we do not share it with third parties for their own marketing. We share personal data only as follows:
- Service providers (processors) who process data on our behalf, under contracts that restrict their use of the data to providing services to us:
- Stripe — payment processing, subscription billing and invoicing. Stripe acts as an independent controller for the payment transaction itself; see Stripe's privacy policy.
- Intuit Mailchimp — sending our newsletter and managing the subscriber list, if you subscribe.
- Anthropic — AI interpretation of search queries (Section 4).
- Web hosting, content delivery, and email delivery providers that run our infrastructure and deliver transactional email.
- Professional advisers such as lawyers, auditors and accountants, under confidentiality obligations.
- Authorities and other parties where required by law, including to comply with a court order, subpoena or other legal process, to protect the rights, property or safety of The Modern, our users or the public, or to enforce our Terms.
- A successor in the event of a merger, acquisition, reorganisation, or sale of all or part of our business, in which case we will notify you where required by law and the successor will be bound by this policy for data collected before the transfer.
Comments you post are public and visible to anyone who visits the Service.
4. AI-assisted search
When the AI-assisted search feature is enabled, the text of a search query you submit is sent to Anthropic, PBC, an AI service provider, so that its model can interpret the intent of the query (for example, the topics, places and time frame it refers to). Only the query text is sent; we do not send your name, email address, account identifier or IP address with it. Interpreted results are cached on our servers for up to one hour so repeated searches do not require a further request. Please do not enter personal data into the search box. Anthropic processes this data under a data processing agreement and, under its commercial terms, does not use it to train its models.
5. International transfers
Our service providers may process personal data in countries other than the one you live in, including the United States. Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision of the relevant authority, the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), or another lawful transfer mechanism, and we take supplementary measures where necessary. You may request a copy of the relevant safeguards by contacting us.
6. How long we keep personal data
- Account data: for as long as your account exists. Unverified accounts are deleted automatically 48 hours after sign-up (accounts with an active paid subscription are exempt). When you close your account, we delete or anonymise your account data within 30 days, except as noted below.
- Billing records: for the period required by tax, accounting and anti-fraud laws, typically up to 10 years after the transaction.
- Comments: for as long as the article they belong to remains published; when you close your account, comments are retained but disassociated from your name unless you ask us to delete them.
- Newsletter data: until you unsubscribe, after which your address is retained on a suppression list only so that we do not email you again.
- Server logs and security data: up to 90 days, unless needed longer to investigate a security incident.
- Login activity: the details used for a login alert are held only long enough to send the alert.
- Search queries: cached interpretations are held for up to one hour; we do not keep a per-user search history.
- Correspondence: up to 3 years after our last exchange, or longer where needed for a legal claim.
7. How we protect personal data
We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), hashed password storage, rate limiting and login alerts, access controls that restrict who can view personal data, and contractual safeguards with our providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in a risk to you, we will notify you and the relevant authorities as required by law.
8. Your rights
Depending on where you live, you may have some or all of the following rights in relation to your personal data:
- Access — to obtain confirmation that we process your data and a copy of it;
- Rectification — to have inaccurate data corrected and incomplete data completed;
- Erasure — to have your data deleted in certain circumstances;
- Restriction — to limit how we use your data in certain circumstances;
- Portability — to receive the data you provided to us in a structured, machine-readable format and to have it transmitted to another controller;
- Objection — to object to processing based on legitimate interests, and to object at any time to direct marketing;
- Withdraw consent — where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing before withdrawal;
- Complain — to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work, or where an alleged infringement occurred.
You can update your profile, change your password, manage the topics you follow, unsubscribe from the newsletter, cancel your subscription and close your account directly from your account pages. For anything else, or to exercise any of the rights above, email privacy@[yourdomain]. We may need to verify your identity before acting on a request. We will respond within one month, extendable by up to two further months for complex requests, and we will not charge a fee unless a request is manifestly unfounded or excessive.
8.1 Residents of California and other US states
If you live in a US state with a comprehensive privacy law (including California, Colorado, Connecticut, Virginia and Utah), you may have the right to know what personal data we collect and how we use and share it, to access and delete it, to correct it, to opt out of the "sale" or "sharing" of personal data and of targeted advertising, and not to be discriminated against for exercising your rights. We do not sell or share personal data as those terms are defined under those laws, and we do not use it for targeted advertising. You may exercise your rights, or appeal a decision, by emailing privacy@[yourdomain]. You may designate an authorised agent to make a request on your behalf; we will require proof of the agent's authority.
9. Children
The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us at privacy@[yourdomain] and we will delete it.
10. Third-party links and services
The Service contains links to third-party websites and embeds content from third-party sources. This policy does not cover those third parties, and we are not responsible for their privacy practices. We encourage you to read their privacy policies.
11. Do Not Track
We do not currently respond to browser "Do Not Track" or Global Privacy Control signals, because we do not track users across third-party websites or engage in targeted advertising.
12. Changes to this policy
We may update this policy from time to time. We will post the updated policy on this page with a new "Last updated" date and, where the change is material, notify you by email or by a prominent notice on the Service before it takes effect. Please review this policy periodically.
13. Contact
[Company Legal Name]
[Address]
Email: privacy@[yourdomain]
If you are in the EEA or UK and we have appointed a data protection officer or a representative, their details will be listed here.