Privacy Policy for Newsletter Creators — Substack, Beehiiv, ConvertKit

Newsletter creators usually think they are too small for privacy compliance to matter. They are not. GDPR applies to anyone processing EU resident data, regardless of business size. CCPA has revenue and volume thresholds that exempt most small operators, but the EU has no such carve-out — even a 50-subscriber hobby newsletter is technically subject to GDPR if any of those subscribers are in the EU.

The good news: compliance is mostly a one-time setup. Generate the policy, link it in your signup form and email footers, and you are done.

What Newsletter Creators Collect

• Email addresses (the obvious one)
• Names (if you ask for first/last name)
• Open tracking (which emails subscribers open)
• Click tracking (which links subscribers click)
• Device info (mobile vs desktop, email client)
• Geographic data (rough location from IP at open time)
• Subscription source (which signup form, referrer, ad campaign)
• Payment info (for paid newsletters — typically processed via Stripe)

Most of this happens automatically through your email platform's tracking. You may not have set it up explicitly, but you are still legally responsible for disclosing it.

How to Generate a Newsletter Privacy Policy

1. Open the privacy policy generator
2. Enter your newsletter name and URL (your Substack URL, custom domain, or landing page)
3. Check data types: Name, Email, IP Address, Cookies, Device Info, Usage Data. Add Payment Information if you have a paid tier.
4. Check third-party services: Stripe (paid newsletters), Google Analytics (if you have a website), Mailchimp/ConvertKit/etc. or just describe Substack/Beehiiv as the platform
5. Enable GDPR — newsletters are inherently global
6. Generate, copy, paste

Where to Put It on Each Platform

Platform	Where to add policy	Effort
Substack	Settings > General > Privacy Policy URL field	Easy - native field
Beehiiv	Settings > Customize > Footer or custom page	Easy
ConvertKit	Settings > Email Templates > Footer	Add link to all emails
Mailchimp	Audience > Settings > Footer	Required field for compliance
Buttondown	Settings > Email Preferences > Footer	Easy
Custom newsletter	Add /privacy page on your domain	Standard

What to Include Beyond Standard Sections

Open and click tracking disclosure. "When you receive our newsletter, we may track which emails you open and which links you click. We use this data to understand which content resonates and to send more relevant follow-ups. You can disable image loading in your email client to prevent open tracking."

Subscription source tracking. "When you subscribe, we record which signup form or referrer you came from. This helps us understand which marketing efforts are working but is not shared with third parties."

Email platform disclosure. "We use [Substack/Beehiiv/ConvertKit] as our email service provider. Your email address and engagement data are stored on their servers in accordance with their privacy policy. You can review their privacy practices at [link]."

Paid subscription handling (if applicable). "Paid subscriptions are processed by Stripe. We never see or store your full credit card number. We retain billing records for tax and accounting purposes."

Cookie Banner — Yes, Even for Newsletters

If your newsletter has any kind of website or landing page (even a simple Substack about page), and you serve EU traffic, you need a cookie consent banner. Substack and Beehiiv handle this automatically for the platform itself, but if you have a separate site (Carrd, Webflow, custom), you need your own banner.

Substack-Specific Notes

Substack provides a privacy policy URL field in Settings > General. You can either:

1. Use Substack's default privacy policy (which is generic and may not reflect your specific use)
2. Create your own policy and host it as a Substack page or external URL, then enter the URL in the field

Option 2 is better. Create a free Substack post titled "Privacy Policy," paste your generated policy text, mark it as a page rather than a regular post, and use that URL.

The "Just Add Me" Problem

The most common GDPR violation among newsletter creators: importing email lists from other places (your contacts, a previous newsletter platform, friends who said it was fine) without explicit consent.

GDPR requires explicit, informed, freely given consent. Importing emails from your old Mailchimp list to your new ConvertKit list is fine because consent transfers. Importing emails from your phone contacts because "they would probably want it" is not.

Best practice for any imported list: send a re-confirmation email. "I am moving my newsletter to a new platform. Click here to confirm you want to keep receiving it." Subscribers who don't click are removed. Annoying but legally clean.

Paid Newsletter Considerations

If you have a paid tier, your privacy policy must additionally cover:

• How payment info is processed (typically Stripe — you don't store card numbers)
• Refund policies and data retention after cancellation
• How long billing records are kept (typically 7 years for tax purposes)
• Whether subscriber names are visible to other paid subscribers (in comments, community features)

GDPR Right to Deletion

Subscribers can request deletion of their data at any time. Set up a process:

1. Subscriber emails you with deletion request
2. You unsubscribe them from the email list
3. You delete their record from the email platform
4. You retain only what is required for legal/tax purposes (typically just the original transaction record if they paid)
5. You confirm completion within 30 days

Most email platforms have built-in unsubscribe and delete features that handle this in 2 clicks.