Privacy Policy

Accounts. When you join we collect your email address and your name. We use them to sign you in with an emailed link and to send service messages.

Newsletters. To list a newsletter we collect its name, address, a description of who reads it, subscriber counts and open and click rates, the rate you ask for per placement, and a logo taken from your website. We also keep the placements you approve and the reports you send after an issue goes out.

Advertisers. To shortlist for a brief we collect your company name, the brief itself, the creative you supply for a booking, and your billing details.

Payments. Card details and payout account details are collected and held by Stripe, our payment processor, and never touch our servers. We keep transaction records for invoicing, accounting and fraud prevention.

This website. The marketing site sets no cookies. It counts page views with Pirsch, a cookieless analytics service hosted in Germany, and with PostHog in cookieless mode, hosted in the European Union; neither stores personal data or can identify you. Our hosting provider keeps standard server logs.

The app. The app uses first-party cookies for sign-in, and a PostHog cookie for product analytics, error logs and session replays that help us find what is broken or confusing. Signed-in users are identified by their account id, never by name or email, and replays mask everything you type. PostHog holds this data in the European Union.

• To run the service: shortlisting, bookings, invoicing, payouts and reports
• To sign you in and manage your account
• To send service messages such as booking updates and deadline reminders
• To detect and prevent fraud and abuse
• To comply with legal obligations

Matching means showing each side to the other. Advertisers signed in to the app may see a newsletter's listing: its name, audience description, subscriber and engagement numbers and rate. We may also include that listing in a curated shortlist. Newsletters proposed for a placement see the advertiser's company, brief and creative. Newsletter listings are not published on the open web.

People working on Placery read your data to put shortlists together and to handle support, and otherwise only when investigating abuse. We share data with the providers that run the service: our hosting and database provider, Stripe for payments and payouts, and our email delivery provider. Some of these are US companies. Where data leaves the EU it does so under standard contractual clauses. Every provider is named on our Subprocessors page. We disclose data beyond that only when the law requires it.

Under the GDPR and other applicable data protection laws you have the right:

• to know what personal data we hold and why
• of access, to a copy of your personal data
• to correction of inaccurate data
• to erasure, which may end your use of the service
• to restrict how we process your data
• to object to our processing of it
• to portability, receiving your data in a machine-readable format
• to complain to your local supervisory authority

To exercise any of these, email hello@placery.co.

Data is encrypted in transit with TLS and at rest, and backups are encrypted. Access to the database is restricted to the account that owns each record.

We keep account data for the life of your account. After an account is closed, its data is removed from active systems within 30 days and from backups within 60 days. Invoices and payment records are kept for as long as tax and accounting law requires.

We update this policy as the service changes and tell account holders about material changes by email. The date at the top shows the current version. Our Terms of Service cover the rest of the relationship.

Questions about privacy: hello@placery.co.