Privacy notice
Who we are
Constructive News Mirror is provided by Fonden Constructive Foundation (Constructive Institute), CVR 38360809, Tåsingegade 3, 8000 Aarhus C, Denmark. You can write to us about anything in this notice at newsmirror@constructiveinstitute.org.
If you use the service through your newsroom
When your newsroom has an agreement with us, the newsroom decides how the service is used, and it is the controller for your account and for everything you submit and receive. We process that data on its behalf under a data processing agreement, and this notice does not cover it. Questions about it, including requests to see or delete your data, go to your newsroom. If you send them to us, we pass them on.
What we are responsible for ourselves
How the service is used
- What we process
- We record how the service is used: which features are used, when, and whether they work, together with your user identifier and figures such as word count, language and number of suggestions. We never record the text you submit, or the written assessments and suggestions the service returns. If you allow analytics cookies, we also record the pages you visit, without anything that follows the page address, and a random identifier stored in your browser.
- Why, and on what legal basis
- To understand how the service is used and find what does not work. Recording the use of features is based on our legitimate interest in doing so (Article 6(1)(f) GDPR). Analytics in the browser is based on your consent (Article 6(1)(a)), which you can withdraw at any time on the cookies page.
- Who receives it
- PostHog, Inc., which stores the data in the EU.
- How long we keep it
- One year.
Customers and invoicing
- What we process
- For newsrooms that buy the service, we keep the names, email addresses and roles of the people we deal with, our correspondence with them, and invoices.
- Why, and on what legal basis
- To manage the agreement with your organisation, which is our legitimate interest (Article 6(1)(f)), and to keep accounting records as the law requires (Article 6(1)(c)).
- Who receives it
- Our email and accounting providers.
- How long we keep it
- For as long as the agreement runs and we need to follow up on it. Invoices and other accounting records are kept for five years from the end of the financial year they belong to, as the Danish Bookkeeping Act requires.
When you write to us
- What we process
- If you email us, for example to ask for access, we use your name, email address and message to answer you.
- Why, and on what legal basis
- Our legitimate interest in answering you (Article 6(1)(f)).
- Who receives it
- Our email provider.
- How long we keep it
- For as long as we need it to deal with your enquiry and anything that follows from it.
Accounts without a newsroom agreement
- What we process
- If you create an account and your organisation has no agreement with us, we are responsible for your account details: email address, name, organisation and a hashed version of your password.
- Why, and on what legal basis
- To give you the access you asked for (Article 6(1)(b)).
- Who receives it
- Supabase Pte. Ltd., which stores the data in Germany. Plus Five Five, Inc. (Resend) sends the emails that confirm or reset your account.
- How long we keep it
- Until you ask us to delete the account.
Visiting the website
- What we process
- Our hosting provider processes your IP address and the details of each request to deliver pages and protect the site against abuse. Errors that occur in your browser are reported to us so that we can fix them.
- Why, and on what legal basis
- Our legitimate interest in running a service that works and is secure (Article 6(1)(f)).
- Who receives it
- Vercel Inc. hosts the website, and Functional Software, Inc. (Sentry) receives error reports, which it stores in Germany.
- How long we keep it
- Request logs for the short period Vercel keeps them. Error reports for up to 90 days.
Transfers outside the EEA
PostHog, Vercel, Sentry and Resend are United States companies, and Supabase is a Singapore company. Where they store or access the data outside the EEA, that is a transfer. Transfers to Supabase are made under the EU's standard contractual clauses, and transfers to the United States companies under the EU-US Data Privacy Framework and the EU's standard contractual clauses.
Your rights
You have the right to see the personal data we hold about you and to have it corrected or deleted. You can also ask us to restrict its use, object to processing based on our legitimate interests, and receive the data you gave us in a common machine-readable format. Where we rely on your consent, you can withdraw it at any time without affecting what was done before. Write to newsmirror@constructiveinstitute.org.
You can complain to the Danish Data Protection Agency (Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk) or to the data protection authority where you live. In Norway that is Datatilsynet, www.datatilsynet.no.
We make no automated decisions about you.