POLICY 001REV 01DRAFTED BY BRAND DESKAPPROVED A.R.LAST UPDATED 22 SEP 2026
Privacy policy
Last updated 22 September 2026.
What we collect from you as a client or a visitor, why, who else touches it, how long we keep it and how to make us stop. If you are a journalist, the notice that covers you is at /media-privacy.
1. Who we are
Mainlore, Inc., Postal address to be added before launch, is the controller.1 Write to privacy@mainlore.com for anything on this page.
2. What we collect, and why
One row per category. The lawful basis is in the last column, in plain words first and the article after it.2
| Category | Why we have it | Basis |
|---|---|---|
| Account details | To run your account | Contract (Art 6(1)(b)) |
| Your canon and the documents you upload | To do the work | Contract (Art 6(1)(b)) |
| Your connected mailbox | To send approved pitches from a real address; you can disconnect it any time | Contract (Art 6(1)(b)) |
| Billing details | To charge you | Contract and legal obligation (Art 6(1)(b), (c)) |
| Usage data | To keep the desk working and secure | Legitimate interest (Art 6(1)(f)) |
| Snapshot requests | To send you the snapshot you asked for | Consent (Art 6(1)(a)) |
| Marketing email | Only if you said yes | Consent (Art 6(1)(a)) |
3. Who else touches it
Our sub-processors, listed by name and role: hosting and edge (Cloudflare), the model provider (Anthropic), email delivery (Cloudflare Email Service, or Resend where configured), payments (Stripe). We do not sell or share personal information, and never will for advertising.3 If that ever changed, a "Do not sell or share" link would appear in the footer first.
4. Where it goes
Some sub-processors are in the US. Transfers from the UK and EU rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or the Data Privacy Framework where the recipient is certified.4
5. How long we keep it
The retention schedule, published in full: outreach logs and approvals, 3 years; your canon, documents and content, for the length of the contract plus 90 days, then deleted or returned; monitoring data, 12 months; model prompts and outputs tied to an approval, 3 years, otherwise 30 days; billing records, 7 years; opt-out hashes, indefinitely. The schedule with its reasons is its own page: Retention schedule.
6. Your rights
Access, correction, deletion, restriction, portability, objection, and the right not to be subject to a purely automated decision (there are none; a human approves everything that matters).5 One address for all of it: privacy@mainlore.com. We answer within 30 days.
7. Complaints
The ICO (UK), your national data protection authority (EU), or your state attorney general (US). We would rather you told us first, but you do not have to.
8. Cookies
One strictly necessary cookie for sign-in. Analytics only with your consent, asked once, remembered, changeable in the footer. No advertising cookies.6 The detail is on the cookies page.
9. Security
Encryption in transit and at rest, per-workspace isolation, access on a need basis, an append-only audit log, and a 72-hour breach notification commitment to you and to regulators where required.7
10. For clients: our processor terms
When you give us journalists' details or your customers' data, we process it on your instructions. Our data processing agreement is available on request and is incorporated into the terms for Situation Room.
11. Changes
We will email account holders about material changes 30 days before they take effect. Every version is archived here.