Your inbox is not inventory.
This notice explains the information The AI-First Founder uses to publish the newsletter, operate membership, and protect the service.
Publication and membership data
When you ask to subscribe or join, the service uses your email, signup source, verification state, optional profile preferences, subscription state, entitlement history, and content you deliberately submit in member areas, such as discussions, replies, private cases, or opportunities. This is used to answer your request, confirm the address, deliver the newsletter, provide access, support you, prevent abuse, and meet billing or legal duties. Payment card details stay with Stripe.
Optional first-party analytics
Analytics is off by default. If you actively allow it, the site creates random visitor and 30-minute inactivity session identifiers and records public page paths, external referring hostname, campaign tags, active-visible reading seconds, maximum scroll depth and milestones, named link or button actions, destination path or hostname, coarse country, device class, browser family, and operating-system family. It does not record form contents or search words.
What is deliberately excluded
Admin, Studio, account, member-only, sign-in, verification, and unsubscribe routes are not measured. Analytics does not store raw IP addresses, full user agents, precise location, cursor coordinates, keystrokes, session replay, device fingerprints, advertising identifiers, or cross-site profiles. Signed-in identities are not attached to new analytics events.
Choice, storage, and retention
Your analytics choice is kept on this device for up to 180 days. The random visitor identifier rotates after 395 days; a session rotates after 30 minutes without activity. Raw analytics events are deleted after 395 days. Browser Global Privacy Control and Do Not Track signals keep analytics off. You can withdraw permission below at any time; this immediately stops future collection and removes the local analytics identifiers.
This device: no choice saved
Processors and safeguards
Cloudflare hosts the application, database, and bot checks. Resend delivers requested email. Stripe handles checkout and billing. Signed, single-use email links authenticate reader and owner sessions. Each provider receives only what its role requires. Webhooks are signed, access is checked on the server, and operational logs follow separate limited retention schedules.
Your rights and contact
Every issue includes a private unsubscribe link. A verified reader can export profile and subscription data or request permanent deletion from the reader account; active paid access must first be cancelled through the billing portal. Questions, access, correction, objection, withdrawal, or deletion requests can be sent to kaancanguven@clapdigital.co. Material changes will be dated here and communicated when required.