Privacy Policy

Who controls your data

Template for solicitor and data-protection review, not a certification of GDPR compliance. The Daily Lift is published by Rithim Collective Limited, the data controller. Registered address: 6 Tinnycross Park, Ballymore Eustace, Co. Kildare, W91 YHR2, Ireland. Company number: 812566 (registered in Ireland). Privacy contact: info@rithimcollective.com. Confirm provider contracts, locations and retention before publishing. The applicable regulator in Ireland is the Data Protection Commission: https://www.dataprotection.ie/.

Minimum information, not a reading profile

Public news is available without a reader account. We do not run advertising or sell personal information. Hosting receives ordinary request information such as IP address, timestamp and browser information for delivery and security. Saved stories, accessibility choices and topic preferences may be stored on your device when you request those features.

Where accounts are used, Clerk handles account identifiers, email, verification and sign-in security. Administrator access is restricted to approved verified accounts. Reports collect only a reply email, relevant story or image URL, type of request and your explanation; do not send identity documents, medical details or unnecessary information about other people.

Optional services — not all are switched on

If reader payments are enabled, Revolut processes payment details under its own terms. We need only transaction references, amount, currency, payment status and access entitlements; not full card numbers or security codes. Payment activation and the final data flow require a separate review.

No newsletter subscription is collected by this legal form. A future newsletter must have a separate explicit opt-in and simple unsubscribe, with its provider named before activation. Instagram publishing is a planned administrator-only integration: if enabled, Meta receives authorised professional-account identifiers, publishing permissions and approved content. Tokens must remain server-side, be access-controlled and be removed when disconnected; do not enable it before these controls are verified.

Optional aggregate Plausible analytics is cookieless where configured, but still does not run until you opt in. You can reject or withdraw in Cookie settings without losing news access. We do not send reader accounts or removal requests to the news-classification AI.

Purposes and lawful bases

Delivery, account and paid-access administration use contractual necessity where applicable. Optional analytics and a future newsletter use consent, which can be withdrawn as easily as given. Proportionate security, abuse prevention and handling corrections or rights requests use legitimate interests, balanced against your rights. Required accounting and statutory disclosures use legal obligation. We do not make decisions producing legal or similarly significant effects about readers solely by automated means.

Providers and international transfers

Replit: application hosting, database, storage and operational request data. Clerk: sign-in and account security. OpenAI through the configured AI integration: public news titles/excerpts and generated briefs for screening; not intentionally reader profiles or report emails. Revolut: payment processing if enabled. Meta: professional Instagram connection and publishing if enabled. Wikimedia Commons and any activated Unsplash/Pexels service: licensed-image search and delivery; remote images can expose IP/browser information to their hosts. Plausible: optional consent-based aggregate traffic measurement if configured.

These organisations are not all necessarily processors; some act as independent controllers for their services. The operator must verify each role, signed data-processing terms, subprocessors, hosting locations and any transfers outside the EEA. Use an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses where required. Do not assume an integration means all data stays in Ireland.

Retention and security

The consent-choice cookie lasts six months and can be changed at any time. Browser preferences remain until changed or cleared. Resolved report records are scheduled for deletion 90 days after resolution; pending requests remain until handled and must be reviewed at least annually. Keep a separate legally necessary record only where justified and explain any retention exception.

Account data is kept while needed for the account, then deleted or anonymised subject to security, dispute and legal requirements. If payments launch, accounting records may need retention for six years or another legally required period, to be confirmed with an accountant/solicitor. A future newsletter retains subscription details until withdrawal, with only a minimal suppression record where needed. Hosting logs, backups and provider deletion periods must be confirmed with the providers; we do not promise immediate deletion from backups.

Use access controls, TLS, server-side secret storage and proportionate monitoring. No online system can be guaranteed completely secure. The operator must maintain a breach-response process and make legally required DPC/individual notifications when applicable.

Your rights and complaints

Contact info@rithimcollective.com to request access, correction, erasure, restriction, portability where applicable, or to object to legitimate-interest processing. You can withdraw consent without affecting prior lawful processing and complain to the Irish Data Protection Commission. We normally respond within one month; lawful extensions must be explained. We may request proportionate identity confirmation, not excessive documentation. Some rights have statutory exceptions.

The service is not intended to collect optional account or marketing data from children under 16 without appropriate authorisation where required in Ireland. Reading public news is separate. Contact us about mistakenly collected children's information. We will update this notice when the actual services or data flows change.