YBAWS! Newsletter Privacy Policy

Effective Date: September 20, 2025
Last Updated: September 20, 2025

1. Introduction

This Privacy Policy explains how YBAWS! Inc. ("we," "us," or "our"), the operator of YBAWS! Newsletter, collects, uses, protects, and shares your personal information when you use our newsletter service hosted on Substack.

Our Commitment: We are committed to protecting your privacy and being transparent about our data practices. We collect only the information necessary to provide and improve our Service.

IMPORTANT DISCLAIMER: This newsletter provides educational content only and does not establish any professional relationship or duty of care. No attorney-client, accountant-client, consultant-client, or other professional relationship is created through your use of this Service.

Jurisdiction: We operate from Ontario, Canada, and comply with applicable Canadian privacy laws (PIPEDA) and international privacy regulations including GDPR for European subscribers.

2. Information We Collect

2.1 Information You Provide Directly

When you subscribe or interact with our Service, we may collect:

Subscription Information:

• Email address (required for newsletter delivery)

• Name (if provided)

• Payment information (processed by Substack, not stored by us)

• Subscription preferences and tier selection

Community Participation:

• Comments on newsletter posts

• Questions submitted for Q&A sessions

• Responses to surveys or feedback requests

• Testimonials or case studies you share

Communication:

• Messages sent through Substack's messaging system

• Support requests or inquiries

• Feedback and suggestions

2.2 Information Collected Automatically

Through Substack's Platform:

• Email engagement metrics (opens, clicks, time spent reading)

• Subscription and cancellation data

• Device and browser information

• General location information (country/region level)

Important: We do not independently track or collect data beyond what Substack provides as part of their platform services.

2.3 Information We Do NOT Collect

• Specific browsing history outside our newsletter

• Detailed personal financial information

• Social security numbers or government IDs

• Sensitive business confidential information (unless voluntarily shared)

3. How We Use Your Information

3.1 Primary Purposes

Service Delivery:

• Delivering newsletter content to your email

• Providing access to subscriber-only content

• Facilitating community features and discussions

• Processing subscription changes and cancellations

Communication:

• Responding to your questions and support requests

• Sending service-related announcements

• Providing requested information about our content

Content Improvement:

• Understanding which topics interest our subscribers

• Improving newsletter content based on engagement

• Developing new resources and materials

• Conducting subscriber surveys and feedback collection

3.2 Secondary Purposes

Business Operations:

• Maintaining subscriber records

• Analyzing subscription trends and patterns

• Ensuring compliance with legal obligations

• Protecting against fraud and abuse

Marketing (Opt-in Only):

• Informing subscribers about new features or content

• Sharing relevant business resources and tools

• Promoting related services available through SaferWealth (with clear opt-out options)

4. Legal Basis for Processing (GDPR Compliance)

For European subscribers, we process your personal information based on:

Contractual Necessity:

• Delivering the newsletter service you subscribed to

• Processing payments through Substack

• Providing customer support

Legitimate Interests:

• Improving our content and services

• Analyzing subscriber engagement

• Preventing fraud and abuse

• Business communications related to your subscription

Consent:

• Marketing communications beyond core service delivery

• Use of testimonials or case studies in our content

• Optional surveys and feedback collection

5. Information Sharing and Disclosure

5.1 Third-Party Service Providers

Substack (Primary Platform):

• Hosts our newsletter and subscriber database

• Processes payments and subscription management

• Provides analytics and engagement metrics

• Subject to Substack's own privacy policy and security practices

Important: We do not share your information with any other third parties for marketing purposes.

5.2 Legal Disclosure

We may disclose your information when required by law or to:

• Comply with legal processes or government requests

• Protect our rights, property, or safety

• Prevent fraud or abuse of our Service

• Enforce our Terms of Service

5.3 Business Transfers

In the event of a merger, acquisition, or sale of business assets, subscriber information may be transferred as part of the transaction. You will be notified of any such change in ownership or control.

6. International Data Transfers

6.1 Cross-Border Processing

Substack's Infrastructure: Your information may be processed on servers located outside Canada, including in the United States, as part of Substack's global infrastructure.

Safeguards: Substack implements appropriate safeguards for international data transfers, including:

• Standard contractual clauses

• Adequate security measures

• Compliance with applicable data protection laws

6.2 GDPR Compliance for EU Subscribers

For European subscribers, we ensure:

• Lawful basis for all data processing activities

• Adequate protection for data transferred outside the EU

• Your rights under GDPR are respected and enforceable

• Data minimization - we collect only necessary information

7. Data Retention

7.1 Active Subscribers

We retain your information for as long as you maintain an active subscription to ensure continuous service delivery.

7.2 Former Subscribers

After Cancellation:

• Core subscription data retained for 12 months for potential reactivation

• Payment records retained as required by financial regulations

• Community contributions may remain visible unless deletion is requested

• Marketing communications cease immediately upon unsubscription

7.3 Legal Requirements

Some information may be retained longer to comply with:

• Tax and financial record-keeping requirements

• Legal obligations under Canadian corporate law

• Dispute resolution and legal proceedings

8. Your Privacy Rights

8.1 All Subscribers

Access and Control:

• View and update your subscription preferences through Substack

• Cancel your subscription at any time

• Request removal from community features

• Contact us for data-related questions

Communication Preferences:

• Unsubscribe from newsletters through Substack

• Opt out of optional marketing communications

• Choose frequency of communications where options exist

8.2 Additional Rights for EU Subscribers (GDPR)

Enhanced Rights:

• Right of Access: Request a copy of your personal data

• Right to Rectification: Correct inaccurate or incomplete data

• Right to Erasure: Request deletion of your personal data

• Right to Restrict Processing: Limit how we use your data

• Right to Data Portability: Receive your data in a portable format

• Right to Object: Object to certain types of data processing

Exercising Your Rights:

• Contact us through Substack messaging for GDPR requests

• We will respond within 30 days of receiving your request

• Identity verification may be required for security purposes

• Some rights may be limited by legal obligations or legitimate interests

8.3 Canadian Subscribers (PIPEDA)

Under Canadian privacy law, you have rights to:

• Know what personal information we collect and why

• Access your personal information

• Request corrections to inaccurate information

• File complaints with the Privacy Commissioner of Canada

9. Data Security

9.1 Our Commitments

Security Measures:

• Rely on Substack's enterprise-grade security infrastructure

• Implement access controls for any data we handle directly

• Regular review of security practices and policies

• Incident response procedures for any potential breaches

Employee Access:

• Limited access to subscriber information on need-to-know basis

• Training on privacy and security best practices

• Confidentiality agreements with all team members

9.2 Your Responsibilities

Account Security:

• Protect your Substack account credentials

• Report any suspicious activity immediately

• Be cautious about sharing personal information in community features

• Keep your contact information updated

9.3 Limitations

While we implement reasonable security measures, no internet-based service can guarantee complete security. You acknowledge the inherent risks of online communication and data storage.

10. Children's Privacy

Our Service is intended for adults and business professionals. We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that we have collected information from a minor, we will take steps to delete such information promptly.

11. Cookies and Tracking

11.1 Our Practices

We do not use cookies or tracking technologies beyond what Substack implements as part of their platform. Any cookies or tracking are governed by Substack's privacy policy and cookie policy.

11.2 Analytics

Newsletter engagement analytics (open rates, click rates) are provided by Substack and used solely to improve our content and service delivery.

12. Privacy Policy Updates

12.1 Change Notification

We may update this Privacy Policy periodically to reflect:

• Changes in our data practices

• Legal or regulatory requirements

• Platform updates from Substack

• Feedback from subscribers

12.2 How You'll Be Notified

Material Changes:

• Email notification to all subscribers

• Prominent notice in our newsletter

• Updated "Last Updated" date on this policy

Minor Changes:

• Updated policy posted with new effective date

• Continued use of Service constitutes acceptance

13. Contact Us

13.1 Privacy Questions

For questions about this Privacy Policy or our data practices:

• Substack Messaging: Contact us directly through YBAWS! Newsletter on Substack

• Community Comments: Post questions in our newsletter comments

• Response Time: We aim to respond within 5 business days

13.2 Data Protection Officer

For GDPR-related inquiries, you may contact our designated privacy contact through the same channels listed above.

13.3 Regulatory Complaints

Canadian Subscribers:

• Privacy Commissioner of Canada: www.priv.gc.ca

EU Subscribers:

• Your local data protection authority

• European Data Protection Board: edpb.europa.eu

14. Jurisdiction and Governing Law

This Privacy Policy is governed by the laws of Ontario, Canada. Any disputes related to privacy matters will be subject to the jurisdiction of Ontario courts.

By subscribing to or using the YBAWS! Newsletter, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described herein.