Privacy Policy
Last Updated: October 2026
Augmented Media Literacy (“we”, “us”, or “our”) operates from Finland and the United States. We are committed to protecting your personal information in compliance with the General Data Protection Regulation (GDPR) in the EU, and state-specific privacy laws such as the California Consumer Privacy Act (CCPA) in the US.
1. Information We Collect & Payment Processing
We collect Account Data (Name, Email) and Usage Data (submitted URLs) to provide our service.
Waitlist Data: If you join the waitlist for our browser extension, we collect your email address, and — only if you choose to provide them — your country and how you heard about us. Email address is the only required field. We also record the date and time you gave consent and a version identifier for the exact consent wording shown to you at that moment, so that we can demonstrate what you agreed to. We do not collect or store your IP address for this purpose.
Extension Data: If you use our browser extension:
- Account. We receive your name and email address from Google when you sign in.
- Analysis. When you request an analysis, we send the article’s URL, headline and text to Google’s Gemini API. Google does not use this data to improve its products and retains it only temporarily for abuse monitoring.
- Storage. We store analyses, article URLs and article text to provide your history, avoid duplicate analysis, generate consensus comparisons and improve our service. Article text is used internally only. Consensus results are displayed only on the original article’s page.
- Legal basis. Performance of contract (analyses and history); legitimate interests (service improvement and consensus).
- Retention. Your analysis history is retained while your account is active. On account deletion, it is deleted, and stored analyses and article text are de-identified.
- Local data. Your history is also stored in your browser. You may delete it at any time from the extension, or by uninstalling it.
Payment Data: All purchases are processed by our Merchant of Record, Paddle.com. We do not collect, process, or store your full credit card numbers. Your billing information is collected directly by Paddle in accordance with their own Privacy Policy. To link a purchase to your account, we pass Paddle your account identifier and the email address of the Google account you signed in with. We only receive securely tokenized transaction references to provision your account.
2. Waitlist: Legal Basis, Retention, and Removal
Legal basis. We process your waitlist email address on the basis of your consent (GDPR Article 6(1)(a)), given by ticking the opt-in box on the signup form. That box is never pre-ticked, and the form cannot be submitted without it.
What we will send you. One email when the browser extension launches, and no more than one email per month before then. We will not send you anything else, and we do not share, sell, or rent your address to anyone.
Retention. We keep your waitlist entry until the earlier of: (a) you ask us to remove it; or (b) twelve months after the browser extension launches, at which point the waitlist has served its purpose and remaining entries are deleted. If the extension has not launched, we will re-confirm your interest rather than hold your address indefinitely.
Withdrawing consent and getting removed. You can withdraw your consent at any time, and doing so is as easy as giving it was. Email [email protected] and ask to be removed from the waitlist; we will delete your entry and confirm. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
3. Service Providers and Where Your Data Is Stored
We use a small number of third-party processors. We do not use any others, and we will update this policy before adding one.
| Provider | What it handles | Where |
|---|---|---|
| Google LLC | Waitlist entries are written to, and stored in, a Google Sheet via Google Apps Script. | United States |
| DigitalOcean, LLC | Hosts this website and serves its files, including video, from its content delivery network. | United States, served globally via CDN |
| Cloudflare, Inc. | Provides the Turnstile anti-bot check on the waitlist form (see Section 4). | United States, processed at the nearest edge location |
| Paddle.com | Merchant of Record for all purchases; collects and processes billing information directly, and provides the checkout on this website (see Section 4). | United Kingdom / United States |
| Supabase, Inc. | Provides account sign-in, runs the analysis service, and stores analyses and article text. | United States |
| Google LLC (Gemini API) | Analyzes the text of articles you submit through the extension. | United States |
Our website fonts are self-hosted rather than loaded from a third-party font service, so viewing this site does not disclose your visit to a font provider.
4. Bot Protection, Cookies, and Tracking
We set no cookies on this website, and we run no analytics or advertising trackers. No third-party service is contacted when you simply load a page here.
Cloudflare Turnstile. One exception is the waitlist form. When — and only when — you open the waitlist signup box, your browser loads Cloudflare’s Turnstile script to confirm you are not an automated script. To do this, Cloudflare receives your IP address and information about your browser, and Cloudflare processes this as our processor for the purpose of preventing abuse of the form. Turnstile is designed not to set cookies for cross-site tracking and Cloudflare states that it does not use this data to build advertising profiles. If you never open the waitlist form, this never happens. We rely on our legitimate interest (GDPR Article 6(1)(f)) in protecting the form from automated abuse for this processing.
Paddle checkout. The other exception is paying. When — and only when — you start a purchase on our Pricing page, or follow a payment link that Paddle has emailed you to our payment page, your browser loads Paddle’s checkout script from Paddle’s servers. Paddle then receives your IP address, information about your browser, your account identifier and the email address of the Google account you signed in with, which we fill in for you. Paddle processes this as our Merchant of Record to take your payment (see Section 1). We rely on performance of contract for this processing. If you never start a purchase or follow a Paddle payment link, this never happens.
5. International Data Transfers
Because we operate in both Finland and the US, your information may be transferred to, stored, and processed in countries other than your own. As set out in Section 3, our waitlist, hosting, bot-protection, account, and analysis providers are all US-based, so personal data originating from the EEA is transferred to the United States. When we make such a transfer, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs).
6. EU Privacy Rights (GDPR)
If you are a resident of the European Economic Area (EEA) or UK, you have the right to access, rectify, or erase your personal data, restrict or object to processing, the right to data portability, and — where processing is based on consent — the right to withdraw that consent at any time. You also have the right to lodge a complaint with your national supervisory authority; in Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).
To exercise any of these rights, email [email protected]. We aim to respond within one month, as required by the GDPR.
7. US Privacy Rights (CCPA/CPRA)
If you are a resident of California or a state with similar privacy laws, you have the right to know what personal information is collected, the right to delete that information, and the right to opt-out of the sale or sharing of personal information. We do not sell your personal information to third parties.
8. Age Requirement and Children’s Privacy
You must be at least 18 years old to join the waitlist, create an account, use the browser extension, or make a purchase. We do not knowingly collect personal information from anyone under 18.
If we learn that we have collected personal information from someone under 18, we will delete it and close any associated account. If you believe a person under 18 has given us personal information, email [email protected] and we will delete it.
No advertising, no sale, no AI training. Augmented Media Literacy is funded by subscriptions only. We show no advertising, we do not sell or share personal information for advertising, and neither we nor our AI provider use your analyses or article text to train AI models.
Google user data. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.