Privacy Policy
Last updated: 28.10.2026
This policy explains what personal data Margin Notes handles about its own customers. If you are a reader or member of a site we host for someone else, that site’s owner decides how your data is used and we only process it for them; see the Data Processing Terms.
1. Who is responsible
Marginnotes, hello@marginnotes.me
2. What we collect and why
- Account details (name, email, billing details): to run your account and invoice you, this data is processed through stripe. Basis: contract.
- Payment records: to meet accounting law. Basis: legal obligation.
- Support emails: to answer you. Basis: contract or legitimate interest.
- Server logs (IP address, time, page requested): to keep the service secure and working. Kept for 30 days.
3. Who receives it
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Hostinger | Server hosting | All site data and backups | Hostinger vps server in Germany |
| Mailgun (Sinch) | Login emails and newsletters | Recipient addresses, message content | Europe |
| Our own backup server | Off-site nightly copies | Backups of all sites | Finland |
| Tailscale | Private network link to the backup server | Connection metadata | Germany |
| Stripe | Payments | Billing details | Europe |
4. Transfers outside the EU/EEA
No. No data is transferred out of the EU/EEA
5. How long we keep data
Account data while the account is active. A deleted site: a final backup is kept for 30 days and then removed. Nightly backups are kept for 14 days on the server and 30 days on the second location, so data from a deleted site can remain in older backups for up to 30 days.
6. Your rights
You can ask for access to your data, correction, deletion, restriction, a copy you can move, and you can object to processing. Write to hello@marginnotes.me. We answer within one month. You can complain to the Office of the Data Protection Ombudsman (Finland) or your local authority.
7. Cookies
Tthis website sets no cookies. Sites hosted for customers have their own cookie behaviour, which the site owner controls.
8. Security
Eeach site runs in its own container with its own database, HTTPS on all sites, restricted server access, nightly backups with a private link to the second location.
9. Changes
We post changes here and tell account holders by email when they matter.