Privacy Policy

1. Who is responsible for your data

UpWrite is an early-stage product currently operated by an independent founder based in Utrecht, the Netherlands. For the purposes of the GDPR, the data controller responsible for your personal data is:

UpWrite
Oscar Bartman, operating UpWrite as an individual (pre-incorporation)
Utrecht, the Netherlands
Contact: privacy@upwrite.nl

If UpWrite becomes a registered legal entity (e.g. a Dutch B.V. registered with the Chamber of Commerce, KvK), this section will be updated with the entity's registered name, KvK number, and registered address.

2. What personal data we collect

When you use the sign-up form on our Site to request updates or early/beta access, we collect:

• Email address — the address you provide in the sign-up form.
• Signup metadata — the date and time of your submission, and, for security and fraud-prevention purposes, technical data such as your IP address and browser user-agent string, recorded automatically by our hosting and form infrastructure.
• Communication history — a record that you subscribed (and, if applicable, unsubscribed), and any replies you send us, so we can respect your preferences.

We do not ask for your name, payment details, or any special categories of data (such as health, religion, or political opinions) through this form, and you should not include such information in any free-text field or email to us.

3. Why we process your data (purpose and legal basis)

You may withdraw your consent at any time (see Section 8). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

4. How long we keep your data

We keep your email address and related sign-up data for as long as you remain subscribed, i.e. until you unsubscribe or ask us to delete it. If we have not launched a public product or contacted you within 24 months of your sign-up, we will delete or anonymize inactive records unless you have re-confirmed your interest. Suppression records (the fact that an address unsubscribed) are kept indefinitely in a minimal form, so we can honor your opt-out and don't accidentally re-add you.

5. Who we share your data with

We do not sell, rent, or trade your personal data. We only share it with service providers ("processors") who help us operate the Site and send communications, under data processing agreements that require them to protect your data and use it only on our instructions. These currently include:

• Website hosting / infrastructure provider — to serve the Site and process form submissions.
• Email delivery or newsletter platform — to store subscriber lists and send you updates (the specific provider will be named here once selected; we favor providers offering EU data residency or Standard Contractual Clauses).

We may also disclose personal data if required by law, to comply with a legal obligation, or to protect our rights, safety, or property.

6. International data transfers

We aim to keep your data within the European Economic Area (EEA) wherever possible. If a service provider we use is located outside the EEA (for example, in the United States), we ensure the transfer is protected by an adequate safeguard recognized under GDPR, such as the European Commission's Standard Contractual Clauses (SCCs), before your data is transferred.

7. How we protect your data

We apply reasonable technical and organizational measures to protect your data against unauthorized access, loss, or misuse, including encrypted connections (HTTPS/TLS) for data submitted through our Site, access controls limiting who can view subscriber data, and choosing service providers that commit to appropriate security standards. No system is completely secure, but we work to keep your data as safe as reasonably possible.

8. Your rights under the GDPR

Because we process your personal data, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data (the "right to be forgotten").
• Restriction — ask us to limit how we use your data in certain circumstances.
• Objection — object to processing based on legitimate interest.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — unsubscribe or withdraw consent at any time, free of charge and as easily as you gave it.

To exercise any of these rights, email us at privacy@upwrite.nl. We will respond within one month, as required by the GDPR. Every email update we send will also include a one-click unsubscribe link.

If you believe we have not handled your data properly, you also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or with the supervisory authority in your own EU member state. More information is available at autoriteitpersoonsgegevens.nl.

9. Cookies and similar technologies

Our sign-up form does not currently set any marketing or analytics cookies. If we introduce cookies for analytics or functionality in the future (for example, to measure Site traffic), we will update this policy and, where required, request your consent via a cookie banner before placing any non-essential cookies.

10. Children's privacy

UpWrite is intended for adults interested in newsletter publishing tools. We do not knowingly collect personal data from children under 16. If we learn that we have inadvertently collected data from a child under this age, we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy as UpWrite develops — for example, when we launch the full product, incorporate a legal entity, or add new service providers. We will post the revised version on this page with an updated "Last updated" date, and for material changes affecting how we use your data, we will notify subscribers by email before the changes take effect.

12. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please reach out to privacy@upwrite.nl.