Privacy Policy

1. Who we are

Eastern Europe Impact is the data controller for personal data processed through this site. Contact: privacy@easterneuropeimpact.com.

2. What we process

• Account data: email address, subscription tier (legal basis: contract).
• Billing data: processed by Stripe; we store customer and subscription identifiers, never card numbers (contract).
• Newsletter: email address until you unsubscribe (consent).
• Watchlists and alerts: the filters you configure and the alerts we sent you (contract).
• Email delivery logs: recipient, subject, delivery status, kept for audit (legitimate interest).
• Usage analytics: aggregated, privacy-preserving statistics (legitimate interest).

3. Where data lives

Our database is hosted on Neon (Postgres, EU region) via Vercel. Email is delivered via MailerSend. Payments run on Stripe. Each processor is bound by a data processing agreement; transfers outside the EEA rely on standard contractual clauses.

4. Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability and object to processing. Write to privacy@easterneuropeimpact.com. You can complain to your supervisory authority (in Poland: UODO).

5. Retention

Account data is kept for the life of the account plus 30 days; billing records as required by tax law; newsletter data until unsubscription; email logs for 12 months.

6. Public-figure data in our intelligence content

Our sanctions and event coverage includes names of listed persons and entities as published in official government registers — this journalistic/archival processing in the public interest is separate from the account data described above.