Privacy

Who is responsible for your data

OnFinal is the controller of personal data described on this page. For privacy questions or requests, email [email protected].

What we collect and why

Newsletter subscriptions

When you subscribe, we store your email address, subscription status, verification and unsubscribe tokens, relevant timestamps, and email-delivery records. We use this information to confirm your address, send the briefing, prevent unwanted sign-ups, and honour unsubscribes. We rely on your consent to send the newsletter. You can withdraw it using the unsubscribe link in any edition.

Messages

If you email us, we receive your address, message, and anything you choose to include. We use it to reply and follow up where needed. Our lawful basis is our legitimate interest in communicating with readers, contributors, and partners, or taking steps you request before a contract.

Technical and security information

Our hosting and security services may process IP address, device and browser details, request times, and diagnostic information. We use this to deliver the site, prevent abuse, investigate faults, and keep the service reliable. Our lawful basis is our legitimate interest in operating a secure, dependable website. For subscription abuse prevention, we immediately transform the network address into a keyed pseudonymous value rather than storing the raw address.

Analytics and cookies

We use local storage to remember whether you accepted or rejected analytics. This preference is essential to remember your choice. If a Google Analytics measurement ID is configured, Google Analytics loads only after you select Accept analytics. It may then set cookies and collect information about pages viewed, approximate location, device, browser, and interactions so we can understand readership in aggregate.

Analytics is based on your consent. Choosing No thanks keeps it off. You can reopen the banner at any time using Manage cookies in the footer. We do not use advertising cookies or sell personal data.

Services we use

• Microsoft Azure hosts the site, API, subscriber records, queues, and operational monitoring. Microsoft privacy statement.
• Resend delivers verification messages and weekly briefing emails and receives the email address needed for delivery. Resend privacy policy.
• Cloudflare Turnstile checks subscription requests for spam and abuse and may process technical information. Cloudflare privacy policy.
• Google Analytics measures site use only after consent. Google Analytics data controls.

Providers may process data outside the UK. Where required, they use recognised safeguards for international transfers, such as approved contractual clauses or the UK Extension to the EU–US Data Privacy Framework.

How long we keep information

We keep active subscriber details while you remain subscribed. After you unsubscribe, we retain the minimum record needed to honour that choice and maintain delivery records, unless we need it longer for legal, security, or dispute reasons. Pseudonymous subscription abuse counters become eligible for deletion 48 hours after the last request and are normally removed within 72 hours by a daily cleanup. Messages and technical logs are kept only for as long as reasonably needed for the purpose they were collected. You can ask us to delete your information where the law allows.

Your rights

UK data protection law may give you rights to access, correct, erase, restrict, or object to the use of your personal data, and to receive a portable copy. Where processing relies on consent, you can withdraw it at any time. Email us to make a request. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.

Changes to this notice

We may update this notice when the service or the providers we use change. The effective date at the top shows when it was last revised.