Privacy Policy

#1. Controller

The controller for the processing described here, within the meaning of Article 4(7) GDPR, is:

Company

MATTALNET GRUPP OÜ

Address

Tuukri tn 19-315, 10120 Tallinn, Estonia

Company register number

14744075

VAT identification number

EE102519059

E-mail

mail@vicelume.com

Write to that address for anything in this policy, including every request under Section 15. Put “Data protection” in the subject line and we will route it accordingly.

We have not appointed a data protection officer. Our processing does not meet the thresholds in Article 37(1) GDPR: we do not carry out large-scale regular and systematic monitoring, and we do not process special categories of data on a large scale. The e-mail address above is the contact point for data protection matters.

#2. What this policy covers

The website vicelume.com, the ViceLume applications for iOS and Android, the radio stream and the service e-mails we send. It does not cover websites we link to. Once you follow a link to an outlet, that outlet’s own privacy policy applies and we have no influence over it.

#3. Processing activities at a glance

Each row is one purpose, the data it needs, the legal basis under Article 6(1) GDPR and how long the data stays. The sections after the table describe each row in words.

#4. Your account and passkeys

ViceLume has no passwords. Registration and sign-in use passkeys (WebAuthn). Your device generates a key pair; the private key never leaves it, and we only ever receive and store the public key, the credential id and a signature counter. There is nothing in our database that could be replayed as a password if it leaked, and there is nothing for a phishing page to capture.

We store an e-mail address alongside the account. It exists so that we can confirm the address belongs to you, so that we can reach you about the service (a security notice, a change to these documents, an answer to your request), and so that you have a recovery channel. It is not a login credential and it is never used to profile you.

A handle is whatever you choose it to be. If you would rather not be identifiable, choose one that is not your name — nothing in the service requires a real one.

#5. Usage analytics

We measure how the service is used, so that we know which languages, stories and stations are worth the cost of producing. There are two measurements, and both are off until you switch them on. Until you do, no analytics script is loaded, no analytics cookie is written, and nothing about your visit is sent anywhere — Google included.

Our own measurement

The first measurement is first-party: the data goes to our own server in Germany and to nobody else. It is the one the operator console reports on, and it is the reason we can tell whether translating into a language was worth doing.

• A session key: a random identifier your browser or app generates for itself. We do not derive it from anything about you, and it is not linked across devices.
• The platform (web, iOS, Android), your interface language, the event type, and a small fixed set of properties for that type — a path without its query string, a story id, an outbound link you clicked, a station slug.
• Your account id, but only if you are signed in at the time. Signed out, an event has no user in it at all.
• Not your IP address and not your user-agent string. Neither is written to the analytics store.

Raw events are deleted 400 days after they are recorded. The aggregate counts we keep for reporting (visits per day, plays per station) contain no identifiers at all.

Google Analytics 4

The second measurement is not ours. If you switch Analytics on, we load Google Analytics 4 (property G-GS3J1SR3NS) from googletagmanager.com, and it reports your page views to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google is a third party. It processes this data on our instructions under Article 28 GDPR, but it does so on its own infrastructure, under its own terms, and we cannot inspect what it holds. Adding it is a change from how this service worked before, and this section says so rather than burying it.

• What Google receives: the path of the page you are on, the site that referred you, your interface language, and technical facts about your browser, device and screen.
• A cross-site identifier. Google sets the _ga cookies described in Section 10 and uses them to recognise the same browser on later visits. It is Google’s identifier rather than ours, and we cannot see what else Google associates with it.
• Your IP address, from which Google derives a coarse location. Analytics 4 does not log or store IP addresses, and we set the tag’s IP-anonymisation flag on top of that.

#6. Radio, audio and spoken stories

The radio plays AI-generated instrumental and wordless-vocal music, spoken news bulletins read by a synthetic host voice, and audio advertisements. None of it is a recording of a real performer, and no listener’s voice is ever captured — the service has no microphone access and no voice input anywhere.

Listening is available to signed-in users, so the server knows which account is streaming and counts the play. With analytics accepted, the play also produces a radio_play event as described above. With analytics declined, only the server-side play counter — which is attached to the track, not to you — is incremented.

#7. Push notifications and e-mail

Push is optional and always off until you enable it. When you do, your browser or operating system issues a push endpoint and a pair of keys, and we store them so that a message can be delivered. We use them for what you enabled them for — new digests, breaking bulletins — and nothing else.

Turn them off in the app or in your browser’s site settings and the subscription is deleted. Legal basis: your consent, Article 6(1)(a) GDPR.

Letters you can switch on

Two letters exist, and both are off until you switch them on in your account's notification settings: a weekly letter summarising what moved on the topics you follow, and alerts for a change that should not wait for the week. Neither is ever sent to somebody who has not switched it on. Legal basis: your consent, Article 6(1)(a) GDPR.

• What we store in order to send them: the two switches, your e-mail address, the language to write in, a token that identifies the subscription inside an unsubscribe link, and the time zone your browser reported when you opted in — so that a weekly letter arrives in your morning rather than in the middle of your night. The letters report on the watchlist topics you chose yourself; nothing else about what you read goes into them.
• Leaving is one click, and it holds. Every stream letter carries a stop button in its footer and a List-Unsubscribe header, so your mail program's own unsubscribe button works too, without opening the letter. The switches in your account do the same thing.
• We keep a record that somebody left. Each unsubscribe appends one row: which stream, by which route (the button in the footer, the mail program's one-click, your account settings, or an administrator), when, a masked form of the address — r***@example.test, never the address itself — and a reference to the account or list entry it belonged to. It exists so that we can see a leaving rate per thousand letters sent, which is how a bad letter is told apart from an ordinary week. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in knowing whether our own mail is working.
• That log is never used to write to anybody. It is read by the operator console and nowhere else, and no row in it can be turned back into an address.

Transactional mail is a different thing, and it cannot be switched off. Confirming your address, a passkey invitation, a receipt, a notice about your account or about these documents — none of these is a stream and none carries an unsubscribe, because without them you would lose access to your own account. The distinction is not left to whoever writes the mail: every message is declared either transactional or stream, and the composer refuses a stream mail that offers no way out, and a transactional mail that offers one. Legal basis: Article 6(1)(b) GDPR, the contract you have with us.

#8. Server logs, security and abuse prevention

Our web server writes a standard access log: IP address, time, requested URL, response status, referrer and user agent. It is what lets us see that a page is broken, that a crawler is hammering the feed, or that somebody is trying passkey enumeration. The log is deleted after 30 days and is never used to build a profile or joined to the analytics store.

Rate limits keyed on IP address protect sign-in, the takedown form and the AI endpoints. Administrative and moderation actions are written to an audit log so that a decision about content can be reconstructed. Legal basis for all of it: Article 6(1)(f) GDPR, our legitimate interest in a service that stays available and is not abused. We consider that interest not to be overridden by your interests, because the data is minimal, short-lived and never used for anything else.

#9. Payments

Billing is not live yet. Premium exists as a plan, but no payment is currently taken and no payment data is currently processed.

When billing is activated, payments will be handled by Stripe (Stripe Payments Europe, Limited, Ireland, with onward transfer to Stripe, Inc. in the United States). Card details are entered on Stripe’s own infrastructure and never reach our servers. We will store the subscription’s status, its term, and the customer id Stripe assigns — enough to know what you are entitled to, and nothing more. Invoices will be retained for the seven years Estonian accounting law requires. This policy will be updated, and this section replaced, before the first payment is taken.

#10. Cookies and local storage

We use no advertising cookies. The only third-party cookies this service can set are the two Google Analytics ones below, and they exist only if you switched Analytics on. Everything the service stores in your browser is listed in full here.

Legal basis for the strictly necessary entries: § 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and its equivalents elsewhere in the EU, together with Article 6(1)(b) and (f) GDPR. For the two analytics entries — the session key and the cookies: § 25(1) TDDDG and Article 6(1)(a) GDPR — your consent.

#11. Processors and sub-processors

We use the following service providers. Each acts on our instructions under a data processing agreement pursuant to Article 28 GDPR, or — where no personal data reaches them at all — under an ordinary service contract.

#12. Transfers to third countries

The servers, the database, the backups and the mail all stay inside the European Union. Three transfers reach further. Only the first of them concerns you, and only if you switched Analytics on; the others concern content — published article text and our own scripts — and are listed so that the picture is complete:

• United States — Standard Contractual Clauses under Article 46(2)(c) GDPR, supplemented, where the provider is certified, by the EU–US Data Privacy Framework (Article 45 GDPR). Google LLC is certified under the Framework, and that is the basis on which the analytics data in Section 5 reaches it.
• United Kingdom — covered by the European Commission’s adequacy decision of 28 June 2021, so no further safeguard is required.
• China — Standard Contractual Clauses under Article 46(2)(c) GDPR, together with a transfer impact assessment. We reduce the residual risk to nil in practice by sending only text that is already published, and no personal data at all.

You may ask us for a copy of the safeguards in place for any of these transfers by writing to mail@vicelume.com.

#13. Where our content comes from

Our digests are written from press articles, official announcements and creator coverage that the publisher has already made public. That is content, not personal data about you, so Article 14 GDPR has little to bite on — but for completeness: if a public article names a person, that name may appear in a digest about it, on the legal basis of Article 6(1)(f) GDPR (our and the public’s interest in reporting on published information), and you may object under Article 21 as described below.

We do not buy data, we do not enrich accounts from third-party sources, and we do not scrape social profiles.

#14. How long we keep things

• Account data — until you delete the account. Deletion is self-service in your profile: the account is immediately marked deleted and disappears from the service, and the record is purged within 30 days. A passkey credential is removed at once.
• E-mail list entries — until you unsubscribe, or until the pre-launch list is purged after launch.
• Unsubscribe log — no separate expiry: a row is deleted together with the account or list entry it points at. The rows hold a masked address, never an address.
• Analytics events — 400 days.
• Server access logs — 30 days.
• Push subscriptions — until switched off or expired.
• Takedown and complaint files — 3 years after the case is closed, so a repeat claim can be judged against the first one.
• Admin audit log — 12 months.
• Invoices and accounting records (once billing is live) — 7 years, as Estonian law requires.

#15. Your rights

Under the GDPR you have the following rights against us. Exercising any of them is free, and we answer within one month.

• Access (Art. 15) — a copy of the data we hold about you and an explanation of what we do with it. Your profile also offers a self-service export.
• Rectification (Art. 16) — correction of anything inaccurate.
• Erasure (Art. 17) — deletion of your data. Self-service in your profile, or by writing to us.
• Restriction (Art. 18) — a freeze on processing while a dispute about accuracy or lawfulness is resolved.
• Portability (Art. 20) — the data you gave us, in a structured, machine-readable format, to take elsewhere.
• Objection (Art. 21) — you may object at any time, on grounds relating to your particular situation, to processing we base on legitimate interests (Section 8 and Section 13). We then stop, unless we can demonstrate compelling legitimate grounds that override your interests.
• Withdrawal of consent (Art. 7(3)) — for analytics, push and the mailing list. One click, effective immediately, with no effect on what was lawful before it.

Write to mail@vicelume.com. We may ask you to confirm control of the account or of the e-mail address before we act — not to obstruct you, but because handing an account export to the wrong person would itself be a breach.

#16. Complaints

If you believe we process your data unlawfully, you have the right under Article 77 GDPR to lodge a complaint with a supervisory authority — in the Member State where you live, where you work, or where the alleged infringement took place. Our lead authority is the Estonian one:

Authority

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)

Address

Tatari 39, 10134 Tallinn, Estonia

E-mail

info@aki.ee

Website

https://www.aki.ee

You are of course welcome to raise it with us first — it is usually faster, and we would rather fix a mistake than argue about it.

#17. No automated decision-making

We do not carry out automated decision-making or profiling within the meaning of Article 22(1) GDPR. Nothing about you is decided by a machine and nothing legal or similarly significant follows from what you read.

AI is used to produce content — digests, translations, Coach plans, spoken bulletins, music — not to evaluate people. A Coach plan is a suggestion generated from the play time and goal you typed in yourself; it is not an assessment of you, and it has no consequences outside the plan you asked for.

#18. Is providing data mandatory?

No. Reading, listening and searching require no account and no data. If you want an account, a handle, a passkey and an e-mail address are necessary to create one — without them the contract cannot be performed. Everything else is optional and clearly marked as such.

#19. Children

The service is not directed at children. Accounts are for users aged 16 and over; below that age, consent under Article 8 GDPR would have to come from a holder of parental responsibility, and we are not set up to verify it. If you believe a child has registered, tell us and we will delete the account.

#20. Changes to this policy

We update this policy when the service changes — when billing goes live, when a processor is added or dropped. The date at the top always says when. A material change is announced on the site before it takes effect, and, if we hold your e-mail address, by mail.