Privacy Policy

Last updated: August 2026

1. Data Controller

2. Scope

This policy covers all publications operated by Meelton:

• A Free Lunch, finance & markets newsletter (French, English, German)
• Zero Bullshit, investigative newsletter (English, French)
• Le Brief Patrimonial, wealth management newsletter (French)
• Helvetica, Swiss economy newsletter (French, English, German)
• Interlignes, Asia newsletter for French-speaking expatriates in Asia (French)
• Hysteresis, European tech news (German and English)
• The Long Bet, European tech news (French)

It applies to all associated websites, subscription forms, and any communication sent by Meelton.

3. Data We Collect

4. Legal Basis for Processing

Regarding B2B prospecting: Meelton uses professional enrichment services to identify relevant contacts for its editorial activity. In accordance with European regulations, this prospecting is limited to professional email addresses and relates directly to the recipient's professional activity. Every first email includes an immediate unsubscribe mechanism.

5. Data Sources

Your personal data may come from:

• You directly, through a subscription form on our websites
• Migration, if you were subscribed via Substack before we migrated to our own platform
• B2B enrichment, via Apollo.io, RocketReach or ContactOut, from publicly available professional data (LinkedIn, company websites)
• Partnerships, through co-registration operations with editorial partners, with your prior consent

6. Service Providers & Data Transfers

All service providers located outside the EU are governed by Standard Contractual Clauses (SCCs) in accordance with GDPR Article 46. No personal data is ever sold, rented, or transferred to third parties for commercial purposes. Our audience measurement (Umami) is self-hosted: the related data is not transmitted to any third party.

7. Cookies, Trackers & Email Tracking

Our websites and emails use the trackers described below. We do not use any advertising cookies or third-party behavioral tracking cookies.

Website trackers

Umami runs on our own servers (Hetzner, EU). Audience data is never shared with or transferred to any third party, and the browser's Do-Not-Track signal is honored.

Email open & click tracking

Newsletters you subscribed to. Our emails include a measurement pixel (1×1 image, no cookie) and redirect links that let us know whether an email was opened and which links were clicked. We use this measurement to ensure proper delivery of the service you requested and to identify subscribers who have become inactive so we can remove them from our lists. On this basis, measuring the deliverability of a requested service, it is exempt from consent under the CNIL recommendation of 14 April 2026 on email tracking pixels. You may object at any time by writing to privacy@meelton.fr or by unsubscribing.

First-contact emails (B2B prospecting). When we send you a professional prospecting email, it may contain an open-tracking pixel and click tracking that also log your IP address and email client type, for sales follow-up purposes. Legal basis: legitimate interest (GDPR Art. 6.1.f). You may object to this tracking at any time, without justification, by writing to privacy@meelton.fr; every email also includes an immediate unsubscribe mechanism.

8. Data Retention

9. Your Rights

Under GDPR (EU/EEA residents)

You have the right to:

• Access, obtain a copy of your personal data
• Rectification, correct inaccurate or incomplete data
• Erasure, request deletion of your data
• Object, object to processing based on legitimate interest (including the tracking of prospecting emails)
• Portability, receive your data in a structured format
• Restriction, temporarily restrict processing
• Withdraw consent, at any time, via the unsubscribe link in every email or by writing to privacy@meelton.fr

To exercise your rights, contact us at privacy@meelton.fr. We respond within 30 days.

If you believe your rights are not being respected, you may file a complaint with the CNIL (French Data Protection Authority) or your local supervisory authority.

Under CAN-SPAM Act (United States)

Every email sent by Meelton includes a functioning unsubscribe link. Unsubscribe requests are processed within 48 hours. Our mailing address appears in every communication:

Under CCPA (California residents)

You have the right to know what personal data we collect, to request its deletion, and to opt out of its sale. Meelton does not sell any personal data. To exercise your rights, contact privacy@meelton.fr.

10. Children's Privacy

Our newsletters are intended for a professional audience. We do not knowingly collect data from anyone under the age of 18. If you are a parent or guardian and believe your child has provided us with personal data, please contact us so we can delete it.

11. Security

Meelton implements technical and organizational measures to protect your data:

• Encrypted communications (TLS/HTTPS)
• Email authentication (SPF, DKIM, DMARC)
• Role-based access control
• Regular encrypted backups
• Primary data hosted exclusively within the European Union: server and database with Hetzner (Germany), websites with O2Switch (France)

12. Changes to This Policy

We may update this policy to reflect changes in our practices or applicable regulations. In case of material changes, we will notify subscribers by email. The last update date appears at the top of this document.

13. Contact