Privacy Policy.

Last updated: [date]

1. Who is responsible

The controller for personal data processed through The Aiomic Age is [The Aiomic Age Ltd], [registered office address], reachable at [privacy email]. We process personal data under the UK GDPR and, for readers in the European Economic Area, the EU GDPR.

2. What we collect, why, and on what legal basis

We only collect what each purpose requires.

2.1 Reading the site. Server logs record technical data (IP address, user agent, requested pages, timestamps) for security and operation. Legal basis: legitimate interests (Art. 6(1)(f) — running a secure service). Logs are retained for [30] days.

2.2 Newsletter. Your email address, confirmed by double opt-in; we record the confirmation to evidence consent. We measure aggregate engagement (delivery, opens where technically detectable) to keep the product working; we do not build individual reading profiles. Legal basis: consent (Art. 6(1)(a)), withdrawable at any time — every edition contains an unsubscribe link that works immediately.

2.3 Accounts, memberships and courses. Name (optional where possible), email, hashed credentials, subscription status, course progress, and correspondence with support. Legal basis: performance of a contract (Art. 6(1)(b)).

2.4 Payments. Handled by our payment processor [processor name]; we receive confirmation of payment and limited billing metadata, never full card numbers. Legal bases: contract performance (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c) — tax and accounting records, retained for the statutory period).

2.5 Analytics. If you agree, we use Google Analytics 4 to understand aggregate readership: which pieces are read, roughly where readers are, and how they arrived. It sets cookies and Google may associate the visit with its own signals, which is why we ask first. Legal basis: consent (Art. 6(1)(a)), withdrawable at any time from the footer of any page. Nothing is requested from Google before you agree — the tag is not loaded at all until then — and declining changes nothing about the site. Google Analytics 4 does not store IP addresses, and we keep Google Signals and advertising personalisation switched off, so the data is not used to build advertising profiles.

2.6 Community features. If you comment, we process your display name, content, and moderation records. Legal basis: contract performance and legitimate interests (keeping discussion lawful and civil).

2.7 Correspondence. If you write to us — including as an interview guest or source — we process what you send us for as long as the correspondence and any journalistic purpose requires. Journalistic processing enjoys specific protections under applicable law, and protecting sources is an absolute commitment that goes beyond this policy.

3. Cookies and similar technologies

We use strictly necessary cookies (session, security, remembering your consent choices and display preferences). One optional category exists: Google Analytics, which is off by default and asked for plainly, with "no thanks" exactly as easy as "allow". Your answer is remembered in your own browser and is never sent to us. We do not use third-party advertising cookies. A current list of cookies and lifetimes is maintained at [/cookies].

4. Embedded content

Articles may embed third-party players (for example YouTube in privacy-enhanced mode). Embeds are click-to-load where feasible: no data flows to the third party until you activate the embed. Once activated, the third party processes data under its own policy. Our presence on YouTube, Instagram and TikTok is governed by those platforms' policies; where platform law makes us joint controllers for page analytics, the platform's insights addendum applies.

The same rule covers the control that makes us a preferred source in Google Search. Nothing is requested from Google until you reach for that button. Using it loads a script from news.google.com, and Google then processes the interaction under its own privacy policy. Not using it leaves no trace with Google.

5. Who receives data

We share personal data only with processors who help us run the services — hosting, email delivery, payments, analytics, course platform — each bound by a data-processing agreement, and with authorities where the law requires it. Where you have allowed analytics, Google LLC receives the data described in 2.5 under Google's own terms. Current processors are listed at [/subprocessors]. We do not sell personal data, and we do not share it with data brokers or advertising networks.

6. International transfers

We prefer UK/EEA-based processing. Where a processor operates outside the UK/EEA, transfers rely on adequacy decisions or standard contractual clauses with supplementary measures as required. Google Analytics involves a transfer to the United States, made under the EU-US and UK data privacy frameworks and Google's standard contractual clauses; it happens only if you have allowed analytics. Details per processor are in the list above.

7. Retention

Newsletter data: until you unsubscribe, then suppressed (a minimal record kept to honour the opt-out). Account data: for the life of the account and up to [12] months after closure, except records we must keep longer by law (for example invoices). Server logs: [30] days. Correspondence: as long as the matter requires. We delete or anonymise when the purpose ends.

8. Your rights

You have the right to access your data; to rectify it; to erasure; to restriction; to portability; to object to processing based on legitimate interests; and to withdraw consent at any time without affecting prior processing. Write to [privacy email]; we respond within one month. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, your local authority.

We do not use your personal data for automated decision-making with legal or similarly significant effects, and we do not do profiling beyond the aggregate service analytics described above.

9. Children

The services address a professional readership and are not directed at children under 16. We do not knowingly collect children's data; if you believe we hold some, tell us and we will delete it.

10. Security

We use appropriate technical and organisational measures: encryption in transit, access on a need-to-know basis, reputable infrastructure providers, and minimal data by design. No internet service can promise absolute security; we promise honest and prompt notification if an incident affects you.

11. Changes

We will post changes here and, for material changes, notify subscribers by email. The date at the top reflects the current version.