Privacy Policy

Circulr is software that magazine publishers use to run a local edition: who they cover, who advertises, who attends the events. Most of the personal information in Circulr is not about the publisher — it is about the people they write about and do business with. This page says what we do with all of it.

Two different roles

For a publisher's own account — the name and email of the people who sign in, and their billing details — we are the controller. We decide what to collect and why, and this policy is that decision.

For everything a publisher puts into Circulr — their contacts, their photographs, their event attendance, their interview notes — we are a processor. The publisher decides what goes in and what it is for; we hold it and act on their instructions. If you are a real estate agent, a partner business or an event guest whose details are in a publisher's Circulr workspace, the publisher is the one who answers for it, and the Data Processing Addendum is the agreement that governs it.

For members of a publication's app — a real estate agent or partner who signs in to a publisher's member app — the sign-in itself (your email, and the name and photo your Google or Apple account shares) is ours to hold, and the profile you edit, the events you RSVP to, the recommendations you make and the notifications you receive are the publisher's records, held by us on their behalf. A phone you turn notifications on for is remembered by a device token that we delete when you turn them off, when the phone stops accepting them, or when you delete your account. You can delete your app account from the app itself (Profile → Delete my account): that removes your sign-in, tickets, notification history, device tokens, text-message consent, settings and the rest of the app's data about you. It does not remove your record in the magazine — your listing, contact details and history as the publisher keeps them — because the publisher, not Circulr, is the controller of that record. To ask for it to be deleted, use Profile → Request deletion of my record in the app, which sends the request to the publisher's review queue, or ask the publisher directly; if you cannot reach them, write to privacy@circulr.io and we will pass it on. We do not sell member information, and we do not show advertising in the app.

What we collect

From people who sign in

• Name, email address and profile picture, from the sign-in method used.
• Which workspace and publication an account belongs to, and its role.
• Sign-in events, and whether two-factor authentication was used.
• Billing contact details. Card numbers go directly to Stripe and never reach us.

From publishers putting their work into Circulr

• Contact records: names, email addresses, phone numbers, employers, licence identifiers, notes.
• Photographs, including of identifiable people, and automatically derived crops of faces.
• Events and who attended them, articles and who was featured, interviews and transcripts.
• Anything imported from a connected integration the publisher chose to set up.

From a connected QuickBooks company

When a publisher connects QuickBooks, Circulr reads — and only reads — the company's customers and the transactions money moves through (invoices, payments, sales receipts, deposits, credit memos and refunds) from January 1 of the current year, to match them to the sponsorship payments the publisher expects. Circulr never creates, changes or deletes anything in QuickBooks. Customers' email addresses, phone numbers and street addresses are removed before anything is stored. The copy is kept with the publisher's other records; disconnecting under Settings → Integrations revokes Circulr's access at Intuit immediately, and deleting the workspace deletes the copy.

Automatically

• Application logs, browser error reports and page-timing events, used to find and fix faults.
• IP address and user agent on requests, used for rate limiting and abuse prevention.

We do not use advertising trackers, we do not sell personal information, and we do not share it for cross-context behavioural advertising.

Why we use it

• To provide the product: showing a publisher their own data and acting on it.
• To keep it working and secure: diagnosing faults, preventing abuse, taking backups.
• To bill for it.
• To contact account holders about the service. We do not send marketing to the contacts in a publisher's workspace.

Text messages

A publication can offer text messages: event invitations, RSVP and ticket reminders, and day-of event updates. You only get them if you opt in, on the publication's own /sms page or in its member app.

• We store your mobile number, the exact consent wording you were shown, when you agreed and from what IP address, and when you stop.
• Your number is used only to send that publication's texts. Text delivery is not yet switched on: until it is, your number is stored with your consent and sent to nobody. When it is, the messaging provider that delivers them will be named on the subprocessors page, with 30 days' notice.
• Reply STOP to stop and HELP for help. Message and data rates may apply.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except our messaging provider to deliver the messages you asked for.

Artificial intelligence

Some features send data to AI vendors. They are off unless a publisher turns them on, and each one is listed on the subprocessors page.

• Research reads publicly available web pages about the people a publisher tracks, and sends that page text to Anthropic to be summarised.
• Semantic search sends article text, interview transcripts and the research profiles of the people you track to OpenAI to be turned into embeddings, and the words of each search you run. It is on unless you turn it off in Settings → AI.
• The assistant, a paid add-on switched on per publication, sends the questions a person asks and the records it reads to answer them — within that person’s role — to Anthropic. Its memory is a nightly summary of each contact, company, event and sponsorship, made by Anthropic from the publisher’s records, research profiles and interview summaries, with contact details removed and never transcripts or notebook pages; while semantic search is on, those summaries are also embedded by OpenAI. Conversations are private to the person who had them and deleted 30 days after last use.
• Assistant access lets a publisher connect an AI assistant that can read and change their workspace through our API, under a key they create and can revoke.

We do not permit these vendors to train models on customer data under the terms we use. A publisher can leave these features off, and turning them off stops any further data being sent.

Who else sees it

Only the service providers we need to run the product, each listed with the data it receives on the subprocessors page. We may also disclose information if the law requires it, and we will tell the affected customer unless we are prohibited from doing so.

Our staff can open a workspace to provide support. That access is recorded with a reason, is time-limited, and can be revoked. It is not silent.

Where it is kept

In the United States. The database and stored files are hosted in AWS's us-west-1 region through Supabase; the application runs on Railway; encrypted backups go to Cloudflare R2.

How long we keep it

• Workspace data — for as long as the workspace exists.
• After an account is closed — a 30-day hold, so a closing can be undone and the final archive downloaded, then every record and file is deleted and a deletion certificate sent.
• Data archives — 30 days after they are made, or until the account is deleted.
• Backups — 90 days. Deleted data persists in encrypted backups until they age out.
• Logs and telemetry — 90 days.
• Unused trial workspaces — removed after 30 days of inactivity.
• Billing records — kept as long as tax and accounting law requires.

Your rights

Depending on where you live, you may have the right to see the personal information held about you, correct it, delete it, obtain a copy, or object to certain uses. California residents have these rights under the CCPA, including the right not to be discriminated against for exercising them; we do not sell or share personal information as those terms are defined there.

If your details are in a publisher's workspace, ask that publisher — they decide what is held and we act on their instruction. If you do not know who that is, write to us at privacy@circulr.io and we will identify them or pass the request on. For your own Circulr account, write to us directly.

Children

Circulr is a business tool and is not directed at children. We do not knowingly collect information from anyone under 16.

Security

The specific measures in place are listed in the Data Processing Addendum, because they are commitments rather than description. To report a vulnerability, write to security@circulr.io.

Changes

If we change this policy in a way that materially affects how we handle personal information, we will tell account holders by email before it takes effect.