Who this covers
Three groups of people are described in this policy, and it is worth knowing which one you are.
- Account holders — people who sign up and run a blog on Inkhost. We are the controller of your account data.
- Readers — people who visit a blog published with Inkhost. We process a minimal amount of data about you on the blog owner’s behalf.
- Newsletter subscribers — people who subscribe to a blog. The blog owner is the controller of that list; we are their processor. See our Data Processing Addendum.
What we collect from account holders
- Account details — email address, password hash, display name. Used to sign you in and to contact you about the service.
- Content you create — posts, drafts, images, tags, design settings, and the business brief describing your company. Stored so we can serve your blog.
- Credentials you give us — if you connect your own email provider, its API key is encrypted before it is stored and is only ever decrypted to send your mail.
- Operational records — API key usage, an audit log of changes made through our API or AI-client integration, and error logs.
We do not sell this data, and we do not use your post content to train any AI model of our own.
What we collect from blog readers
Very little, and none of it identifies you across sites. When a post is viewed we record the post, the date, and a one-way hash of your IP address and browser string combined with a secret salt and the current date.
The hash cannot be reversed to your IP address, it changes every day, and it is not written to a cookie or to local storage. Because of this we can tell a blog owner roughly how many distinct people read a post on a given day, and nothing more. We do not build reader profiles, we do not track you from one blog to another, and there is no third-party advertising or analytics tag on any blog we serve.
Requests from known bots and crawlers are filtered out rather than counted.
Newsletter subscribers
Subscriptions are double opt-in. When you enter your email address on a blog we store it as pending and send one confirmation message. Nothing else is sent until you click the link in it. If you never confirm, the record stays unconfirmed and no newsletter reaches you.
Alongside the address we record when you confirmed, and the IP address and browser string at the moment of consent. That exists so the blog owner can prove the subscription was genuine if it is ever challenged.
Every newsletter carries an unsubscribe link. Addresses that hard-bounce or report a message as spam are added to a suppression list and are not mailed again.
The blog owner decides what to send you and is the controller of their list. Direct requests about a specific newsletter to the blog that sent it; we will help if you cannot reach them.
AI processing
Inkhost uses third-party AI services. This only happens when you invoke a feature that needs one, and you should know where your text goes.
- Writing, rewriting, SEO and naming suggestions send the relevant post text and your prompt to Anthropic.
- Cover image generation sends your image prompt to OpenAI.
- Related posts and internal linkingsend post text to Google’s embedding API when a post is published.
- The business brief and brand matchingsend a website address you nominate to Firecrawl, which fetches that site’s public pages.
Do not paste anything into an AI feature that you would not be comfortable sending to a third-party processor. The full list of providers is on the sub-processors page.
Why we are allowed to process it
- Contract — running your account and serving your blog.
- Consent — newsletter subscriptions, which you confirm explicitly and can withdraw at any time.
- Legitimate interests — keeping the service secure, preventing abuse, and counting page views in a form that cannot identify a reader.
- Legal obligation — where a law requires us to keep or disclose something.
How long we keep it
- Account and content — for as long as your account is open. Delete a blog and its posts, media, tags and subscriber records go with it.
- View records — aggregate daily counters, with no reversible identifier in them, retained to keep historical analytics meaningful.
- Suppression list entries — kept indefinitely, because forgetting that an address bounced or complained means mailing it again.
- Audit logs — retained for a limited period for security investigation.
Your rights
Whoever and wherever you are, you can ask us to show you the data we hold about you, correct it, delete it, or stop a particular use of it. Write to privacy@inkhost.app and we will respond within thirty days.
India. Under the Digital Personal Data Protection Act, 2023 you may access and correct your personal data, ask for it to be erased, nominate someone to exercise your rights if you cannot, and complain to the Data Protection Board of India. Grievances should go to privacy@inkhost.app in the first instance.
European Economic Area and United Kingdom. Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your national supervisory authority. Where we rely on consent you may withdraw it without affecting processing that already happened.
California. Under the CCPA and CPRA you may request the categories and specific pieces of personal information we have collected, ask for deletion or correction, and not be discriminated against for asking. We do not sell or share personal information as those terms are defined there.
International transfers
Our sub-processors are largely in the United States, so data you give us may be processed outside your country. Where a transfer needs a legal mechanism we rely on the standard contractual clauses or the equivalent safeguard offered by that provider.
Security
Access to data is enforced in the database itself rather than only in application code, secrets you entrust to us are encrypted at rest, and content is sanitised before it is served. The detail is on the security page.
Changes to this policy
If we change something that matters we will update the date at the top and, for material changes affecting account holders, email you. Continuing to use Inkhost after a change means you accept it.
Contact
Zwinny Solutions Pvt. Ltd.
[REGISTERED ADDRESS — TO BE COMPLETED]
privacy@inkhost.app