Privacy Policy

Crabcakes & Commerce

Last updated: [DATE]

This Privacy Policy explains how Mike DeBaugh Jr. (”we,” “us,” or “I”) handles information in connection with the Crabcakes & Commerce newsletter and any related pages (the “Publication”).

This Publication is hosted on Substack. Substack operates the platform, processes most of the data described below, and maintains its own Privacy Policy and Terms of Use, which govern your use of the platform itself. This Policy is supplementary and describes practices specific to this Publication. Where the two differ as to platform mechanics, Substack’s policies control. You can review Substack’s privacy practices at https://substack.com/privacy.

1. Information We Collect

Information you provide directly. When you subscribe, you provide your email address and, optionally, a display name. If you become a paid subscriber, payment is collected and processed by Substack’s payment processor (Stripe); we do not receive or store your full payment card details. If you reply to an email, comment, or otherwise contact us, we receive the contents of that communication.

Information collected automatically through Substack. Substack collects certain usage and engagement information on our behalf, which may include whether emails are opened, links clicked, posts viewed, and basic device or browser information. The specific data collected, and the cookies and similar technologies used, are determined and managed by Substack.

We do not independently run separate analytics, advertising trackers, or data brokers on top of the Substack platform.

2. How We Use Information

We use the information described above to:

• send you the newsletter and any subscriber communications you have signed up for;

• operate, maintain, and improve the Publication;

• understand which topics and posts are useful to readers, in aggregate;

• respond to your replies, questions, and requests;

• process and manage paid subscriptions, where applicable; and

• comply with legal obligations and enforce our Terms of Service.

3. How We Share Information

We do not sell your personal information.

We share information only as follows:

• With Substack, which hosts the Publication and processes subscriber and engagement data as our service provider.

• With Stripe, for processing paid-subscription payments, where applicable.

• For legal reasons, if required to comply with applicable law, legal process, or a governmental request, or to protect the rights, property, or safety of our readers, the public, or us.

• In connection with a business transfer, such as a merger, acquisition, or sale of assets, in which case subscriber information may be among the assets transferred, subject to this Policy.

4. Cookies and Tracking

Cookies and similar technologies on this Publication are set and controlled by Substack as part of operating the platform. For details on those technologies and any choices available to you, please refer to Substack’s Privacy Policy and cookie information.

5. Data Retention

We retain subscriber information for as long as you remain subscribed and as needed to operate the Publication, comply with legal obligations, resolve disputes, and enforce agreements. You can unsubscribe at any time using the link in any email, after which your information is handled in accordance with Substack’s retention practices.

6. Your Choices and Rights

You may unsubscribe at any time using the unsubscribe link in any email or through your Substack account settings.

Depending on where you live, you may have additional rights regarding your personal information:

• If you are in the European Economic Area or the United Kingdom, you may have rights to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability, under the GDPR / UK GDPR. The legal bases we rely on are your consent (for marketing communications) and our legitimate interests (in operating and improving the Publication).

• If you are a California resident, you may have rights under the CCPA/CPRA to know what personal information is collected, to request deletion or correction, and to opt out of any “sale” or “sharing” of personal information. As stated above, we do not sell your personal information.

To exercise any of these rights, contact us at mikedebaugh@crimsonbc.com. Many requests relating to platform data may also need to be directed to Substack as the platform operator. We will respond as required by applicable law.

7. Children’s Privacy

The Publication is intended for a general business audience and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can address it.

8. International Readers

The Publication is operated from the United States. If you subscribe from outside the United States, your information will be processed in the United States and other countries where Substack and its service providers operate, which may have different data-protection laws than your jurisdiction.

9. Security

We rely on Substack’s technical and organizational measures to protect subscriber information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be communicated through the Publication. Your continued subscription after changes take effect constitutes acceptance of the updated Policy.