Draft. This notice will be reviewed before the service launches. Questions: hello@editionofone.ai.

Privacy

Privacy notice

Updated 8 October 2026. Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

1. Controller

Palomaki Labs Oy, Helsinki, Finland. Business ID: [pending]. Privacy contact: hello@editionofone.ai.

2. Who this notice covers

• Subscribers to an Edition of One newsletter or its free trial or beta.
• Recipients of an introductory issue: professionals to whom we send one sample issue because of their professional role, for example company CEOs and board members.

3. What we process

• What you give us: name, email address, organization, role or field, the links you add, what you want to follow, your language and when you gave consent.
• A description of your work (profile): public, work-related information such as current and past roles, companies and positions of trust, field, publications, talks, exhibitions or research, and publicly named collaborators. We do not process information about your private life or special categories of personal data.
• About recipients of an introductory issue: name, work email address, role and organization, and the limited professional profile described above.
• The customer relationship: issues sent, your replies and feedback, billing details.
• Technical data: email delivery data (delivered, bounced) and web server logs. The website uses no analytics or advertising cookies.

4. Sources

You, and public sources: company registers, websites and press releases of companies and organizations, news media and trade press, public professional profiles, publication databases, exhibition and event pages, and public search engine results. If someone recommended the service to you and gave us your details, we tell you who.

5. Purposes and legal bases

• Delivering your subscription (building your profile, putting together and sending issues, customer service): contract or steps before a contract, GDPR Art. 6(1)(b). Free trials and beta places are delivered at your request on the same basis.
• Billing and bookkeeping: legal obligation, Art. 6(1)(c), under the Finnish Accounting Act.
• One introductory issue to a professional because of their role: legitimate interest, Art. 6(1)(f). Our interest is to introduce the service to people whose work it relates to. We have assessed that this does not override the recipient's interests: we use only public professional information, send a single message, say in it where the information came from, make declining easy, and delete the data within 30 days unless the recipient subscribes. Electronic direct marketing is also subject to sections 200–202 of the Finnish Act on Electronic Communications Services and, where it applies, the national law of the recipient's country.
• Improving the service with aggregate data, such as which sections readers find useful: legitimate interest.

The profile is used only to choose content (which items go into your issue). We make no decisions about you that have legal or similarly significant effects.

6. Recipients and processors

We never sell your data or share it for anyone's marketing. These providers process data on our behalf:

• Brevo (Sendinblue SAS, France): email and the subscriber list, data stored in the EU.
• Cloudflare, Inc.: hosting of the website and the signup form.
• Anthropic PBC (United States): the AI service that reads sources and drafts issues.
• A search provider, e.g. Serper (United States): searching public sources.
• A server in the EU, e.g. Hetzner Online GmbH (Germany): running the service and storing data.
• Bookkeeping and invoicing, e.g. an accounting firm and an invoicing service.

7. Transfers outside the EU and EEA

Some processors operate in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses. Ask us for details.

8. How long we keep data

• Data about recipients of an introductory issue: deleted within 30 days unless they subscribe.
• Subscriber data: kept while the subscription runs and deleted within 30 days after it ends.
• Accounting records: kept as the Accounting Act requires (vouchers for six years after the end of the financial year).
• If you object to direct marketing, we keep your email address and the date on a suppression list so that we do not contact you again.

9. Your rights

You have the right to know what data we hold about you and get a copy; to have inaccurate data corrected; to have data erased; to restrict processing; to receive the data you gave us in a portable format; to object to processing based on legitimate interest; and to withdraw consent at any time. Requests: hello@editionofone.ai. We reply within one month.

Your right to object to direct marketing. You can object at any time to the use of your data for direct marketing, and after that it will not be used for that purpose. Reply “no thanks” to our message or use the opt-out link in it.

10. Complaints

You can complain to the supervisory authority: the Office of the Data Protection Ombudsman, Finland, tietosuoja.fi, or the authority in your own country.

11. Providing data

We need your name and email address to deliver the subscription. Everything else is optional, but it helps us put together a more useful issue.

12. Changes

We update this notice when our processing changes. The date of the latest update is at the top.