Substack privacy & data

This Privacy Policy only applies to the processing of your Personal Information by Substack as a data controller, meaning where we process your Personal Information for our purposes.

your email address; your phone number

your payment details (including billing address, credit card details, where you make a purchase from us)

your location and/or mailing address

information related to the browser or device you use to access our website (including your IP address)

your direct message contents and metadata

your subscription status with Substack publications

To establish and fulfill a contract with you, for example when you subscribe to a subscription Service.

to monitor the use of our services and to help us monitor, improve and protect our services, content and website

to personalize our services for you and provide recommendations

to monitor any user accounts to prevent, investigate and/or report fraud, misrepresentation, terrorism, security incidents or crime in accordance with applicable law

we will send you, based on your consent (if required), direct marketing communication in relation to our relevant services

We retain information about you only for as long as reasonably necessary to fulfill the purposes for which it was collected.

Substack is established in the US and uses service providers established both in the US and in other countries to process Personal Information as described in this Privacy Policy.

Substack complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF)

Such third parties further include, but are not limited to, providers of: website hosting; maintenance services; email services; security services; generative AI services; content delivery networks; customer support operations and software services; traffic and usage analytics services; and cloud storage and computing services.

you may be entitled to ask Substack for a copy of your Personal Information

to correct it, erase or restrict its processing

or to ask us to transfer some of this information to other organizations

you have the right to object to such processing at any time on grounds relating to your particular situation

Where we have asked for your consent to process your Personal Information, you may also have the right to withdraw this consent.

you have the right to complain to a data protection authority