Privacy Policy
A starting draft, not legal advice. It must be corrected to match what your site actually does before you publish it — a privacy policy that describes collection you don't do, or omits collection you do, is worse than none. Check it against your real analytics, hosting, and email setup, and fill every highlighted field.
1. The short version
We collect as little as possible. If you subscribe, we keep your email address and use it to send you the thing you asked for. We do not sell your data, we do not share it with advertisers, and we do not build profiles for ad targeting. You can leave at any time and ask us to delete what we hold.
2. Who we are
[Legal Entity Name], [address, Waxahachie, TX], is the controller of personal data described in this policy. Contact: legal@combocrusher.com.
3. What we collect
3.1 Information you give us
- Email address, when you subscribe.
- Subscription preference, the topic option you select.
- Name, email, and message content, if you use the contact form or email us.
- Phone number, only if you specifically opt in to SMS alerts. [Delete this line if you never offer SMS to users. If you do, SMS consent must be collected separately from email consent, and A2P 10DLC registration and TCPA requirements apply.]
3.2 Information collected automatically
- Server and request data — IP address, browser type, referring page, pages viewed, and timestamps, logged by our host for security and reliability.
- Analytics — aggregate usage measurement. [Name the provider. A cookieless, privacy-focused analytics tool such as Plausible or Fathom lets you honestly say you set no tracking cookies and lets you skip a consent banner in most cases. If you use Google Analytics instead, this section and section 7 both change materially.]
- Email engagement — whether an email was opened and which links were clicked, reported by our email provider. [Remove if you disable open and click tracking.]
3.3 What we never collect
We do not collect, request, or store exchange account credentials, API keys, brokerage or bank details, payment card numbers, government identifiers, or any information about your positions, balances, or trading activity. We have no visibility into any account you hold anywhere. Do not send us any of this.
4. Why we use it, and on what basis
| Purpose | Data | Basis (UK/EU) |
|---|---|---|
| Sending the email you subscribed to | Email, preference | Consent |
| Answering your message | Name, email, message | Legitimate interests |
| Keeping the site up and secure | Server logs, IP | Legitimate interests |
| Understanding aggregate usage | Analytics data | Legitimate interests |
| Meeting legal obligations | As required | Legal obligation |
We do not use your data for automated decision-making that produces legal or similarly significant effects on you.
5. Who we share it with
We do not sell personal data and we do not share it for cross-context behavioural advertising. We use a small number of service providers who process data on our instructions under contract:
- Email delivery — [Resend / your provider], to send and deliver the newsletter.
- Hosting and CDN — [provider], to serve the site.
- Analytics — [provider].
- SMS delivery — [Twilio, if user-facing SMS is offered].
We may also disclose data where required by law, valid legal process, or to protect our rights or the safety of others, and in connection with a merger, acquisition, or sale of assets — in which case this policy continues to apply to the transferred data until replaced with notice to you.
6. How long we keep it
- Subscriber email — until you unsubscribe or ask for deletion, then removed from active lists promptly and from backups within [90] days. We retain a minimal suppression record (a hashed address) so we don't accidentally email you again.
- Contact messages — [24] months.
- Server logs — [30] days.
- Analytics — aggregate only, retained per our provider's default.
7. Cookies and similar technologies
[If you use only cookieless analytics and set no cookies of your own, say exactly that: "We do not set cookies and do not use any tracking technology that requires consent." If you use anything that does set cookies, you need a categorised list — strictly necessary, analytics, marketing — and a consent mechanism that lets EU/UK visitors decline non-essential cookies before they are set.]
8. Your choices and rights
Regardless of where you live, you can:
- Unsubscribe using the link in any email, at any time.
- Ask what we hold about you, and get a copy.
- Ask us to correct or delete it.
Email legal@combocrusher.com. We respond within 45 days and may need to verify your identity first, usually by confirming control of the email address in question. Exercising a right never results in worse service or a different price.
8.1 Texas residents
Under the Texas Data Privacy and Security Act, Texas residents may confirm whether we process their personal data, access it, correct it, delete it, obtain a portable copy, and opt out of sale, targeted advertising, and certain profiling. We do not sell personal data, engage in targeted advertising, or profile in a way that triggers an opt-out right. If we deny a request you may appeal by replying to our decision; if the appeal is denied you may complain to the Texas Attorney General.
8.2 California residents
Under the CCPA as amended by the CPRA, you have rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information. We do not sell or share personal information as those terms are defined, and we have not done so in the preceding 12 months. We do not knowingly collect personal information from anyone under 16. Categories collected are listed in section 3; purposes in section 4; recipients in section 5. You may use an authorised agent.
8.3 UK and EU residents
You additionally have rights to restrict or object to processing, to portability, and to withdraw consent at any time without affecting prior lawful processing. You may lodge a complaint with your supervisory authority. Where data is transferred to the United States, we rely on [Standard Contractual Clauses / your provider's transfer mechanism].
9. Security
We use HTTPS throughout, restrict access to subscriber data to the minimum number of people, and hold credentials in a secrets manager rather than in code. No system is perfectly secure, and we can't guarantee absolute security. If a breach affects your personal data, we will notify you and any required regulator as the law requires.
To report a security issue, email security@combocrusher.com. We won't pursue good-faith researchers who follow responsible disclosure.
10. Children
The Service is for adults 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, email legal@combocrusher.com and we will delete it.
11. International visitors
We operate from the United States. Using the Service means your data is processed in the United States, which may not offer the same protections as your home jurisdiction.
12. Changes
We'll update the date at the top when this changes, and notify subscribers by email of material changes before they take effect.
13. Contact
[Legal Entity Name]
[Street address, Waxahachie, TX ZIP]
legal@combocrusher.com
See also the Terms of Service.