1. Scope of processing
Subject matter. Providing the Inkhost blogging and newsletter service to you.
Duration. For as long as your account is open, plus the short grace period described in clause 7.
Nature and purpose. Storing subscriber records, sending confirmation and newsletter email on your instruction, recording delivery and engagement events, and counting page views.
Categories of data subject. Your newsletter subscribers and the readers of your blog.
Categories of personal data. Email addresses; subscription status and confirmation timestamp; the IP address and browser string recorded at the moment of consent; delivery, open, click, bounce and complaint events; and pseudonymised daily view records that do not identify a reader.
No special category data is required by the service. Do not put any into it.
2. Our obligations
We will:
- Process personal data only on your documented instructions, which your use of the service constitutes, unless a law we are subject to requires otherwise.
- Ensure that people authorised to process the data are bound by confidentiality.
- Implement the technical and organisational measures described in clause 3.
- Assist you, so far as is reasonable, with data subject requests, data protection impact assessments and consultations with a supervisory authority.
- Tell you without undue delay if we become aware of a personal data breach affecting your data, with the information you need to meet your own notification duties.
- Make available the information reasonably needed to demonstrate compliance with this addendum.
3. Security measures
We maintain measures appropriate to the risk, including authorization enforced at the database layer, encryption of credentials at rest, encryption of data in transit, sanitisation of untrusted content, validation of inbound webhook signatures, constrained outbound requests, rate limiting, and audit logging of changes made through our integrations.
Fuller detail, including what we do not claim, is on the security page, which is incorporated into this addendum by reference.
4. Sub-processors
You give general authorisation for us to engage the sub-processors listed on the sub-processors page. We impose data protection obligations on each of them no less protective than those in this addendum, and we remain liable to you for their performance.
We will update that page before a new sub-processor begins processing your data. Write to privacy@inkhost.app to receive that notice by email and to object; if you object on reasonable data protection grounds and we cannot offer an alternative, you may terminate the affected part of the service.
5. Your obligations
As the controller you are responsible for:
- Having a lawful basis for the data you collect, and for what you send to your subscribers.
- Providing your own privacy notice to your subscribers and readers.
- Responding to data subject requests about your list. We will help, and the platform lets you find, export and delete subscriber records yourself.
- Complying with the Acceptable Use Policy, particularly the consent and unsubscribe rules.
6. International transfers
Several sub-processors are located outside India and outside the European Economic Area. Where a transfer requires a legal mechanism we rely on the standard contractual clauses or the equivalent safeguard the provider offers, together with the measures in clause 3.
7. Return and deletion
You can export your subscriber list as CSV at any time. On termination, or on your written instruction, we delete the personal data we process for you after a short grace period, except where a law requires us to keep it and except for suppression records, which are retained in a minimised form precisely so a previously bounced or complaining address is not mailed again. Backups are overwritten on their normal cycle.
8. If you need a signed copy
This addendum applies without signature. If your compliance process requires a countersigned document, email legal@inkhost.app and we will arrange one.