Privacy Policy

Sabia Insights (“Sabia,” “we,” “us,” or “our”) respects and protects the privacy of every individual who uses our publishing platform, reads content, creates an account, or applies to become a Sabia author. This Privacy Policy describes what information we collect, why we collect it, how it is used and shared, and the rights you have in relation to your personal data.

This policy applies to all visitors, registered users, authors, and other individuals who access the Service at any time. By using Sabia, you acknowledge that you have read and understood this Privacy Policy in its entirety. If you do not agree with any part of this policy, please discontinue your use of the Service immediately.

For the purposes of the General Data Protection Regulation (GDPR) (EU) 2016/679, the California Consumer Privacy Act (CCPA), and other applicable data protection legislation, the data controller responsible for your personal information is:

Our nominated Data Protection Officer (DPO) oversees compliance with this policy and applicable privacy laws. You may contact the DPO directly at the email address above for any privacy-related inquiries, requests, or complaints.

We collect only the information reasonably necessary to operate, improve, and protect the Service. We do not sell your personal information, and we never will.

We use your personal information exclusively for the following legitimate business purposes, each of which is described below and tied to a lawful processing basis where required by law:

• Service delivery & account administration: creating and maintaining your account, authenticating sign-ins, syncing bookmarks across devices, and delivering content you have requested.
• Publishing operations: reviewing, editing, and publishing submitted content; attributing authorship; responding to reader comments on author articles; and processing royalties or incentives (if/when introduced).
• Personalization & recommendations: suggesting stories, authors, or categories we think may interest you based on your reading history; remembering your theme preferences (light/dark mode); and tailoring the editorial digest.
• Product improvement: analyzing aggregated, de-identified usage patterns to inform editorial direction, design changes, feature prioritization, and infrastructure scaling.
• Communications: sending security notices, account lifecycle emails (e.g. welcome, password reset), editorial newsletters (when opted-in), author application status updates, and support responses. You can unsubscribe from non-essential email at any time.
• Abuse prevention & security: detecting and mitigating spam, brute-force attacks, vote manipulation, content policy violations, and unauthorized account access; enforcing our Terms of Service.
• Legal compliance: responding to lawful subpoenas, court orders, regulatory inquiries, and other legally binding requests where we are compelled to cooperate.

Where applicable under the GDPR and equivalent regulations, we rely on one or more of the following lawful bases each time we process personal data:

Where processing is based on consent, you may withdraw that consent at any time by emailing privacy@sabiahq.com or by using the preference controls available within your account settings or cookie banner. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

We share your personal information only with the following categories of recipients, subject to strict contractual data protection safeguards, and only to the extent necessary to deliver the Service:

• Service providers & subprocessors: cloud infrastructure, database hosting, authentication providers, email delivery services, error monitoring, and analytics vendors listed in Section 7 below.
• Author attribution (public): If you publish as a Sabia author, your display name, avatar, bio, and social media links are shown publicly alongside your published articles on the Service and in promotional content (newsletters, social features) featuring your work.
• Professional advisors: our auditors, lawyers, insurers, and accountants in the course of providing their professional services to us, under strict duties of confidentiality.
• Law enforcement & regulators: in response to a valid, specific, and binding legal demand — and only after verifying its authenticity and scope. We will notify affected users of the disclosure where permitted by law.
• Business transfers: in connection with a merger, acquisition, consolidation, sale of assets, financing, or bankruptcy proceeding involvingSabia. You will be notified of any such change in ownership via email or prominent in-product notice.

We do not sell, rent, license, or trade your personal information to advertisers, data brokers, or marketing networks — ever.

You can manage your cookie preferences at any time using the cookie banner accessible via the footer, or by configuring your browser to block cookies. Please note that blocking essential cookies may cause the Service, including authentication, to malfunction or become unavailable.

We retain your personal information only for as long as is reasonably necessary to fulfill the purposes for which it was collected, comply with legal and accounting obligations, resolve disputes, and enforce our agreements. Our default retention schedule is:

• Account profiles & credentials: retained for the duration of your account plus 30 days after deletion request to allow recovery.
• Published articles & author attribution: retained indefinitely unless the author requests unpublishing or deletion, in which case content is removed from public view within 7 days and fully hard-deleted within 30 days. Backups are rotated out within 90 days.
• Bookmarks, reading progress & preferences: retained for the duration of your account.
• Author applications (rejected / incomplete): retained for 12 months from last activity for support and anti-fraud purposes, then deleted.
• Newsletter subscription records: retained until unsubscribe request, plus 30 days for compliance.
• Support correspondence: retained for 24 months after case closure, or longer if required by law.
• Access logs & telemetry: raw request logs rotated within 30 days; aggregated, anonymized analytics data retained for up to 24 months.
• Tax, legal & audit records: retained for the period required by applicable law (typically 6–10 years) and then securely destroyed.

Once a retention period expires, we securely erase or anonymize personal data by one or more of the following measures: cryptographic erasure, logical deletion from production and backup systems, or irreversible anonymization such that the data can no longer be linked back to an identifiable individual.

Because the internet and our infrastructure providers operate globally, your personal information may be transferred to, and processed in, jurisdictions other than the one in which you reside — including the United States and the European Economic Area (EEA). These jurisdictions may have data protection laws that differ from those in your home country.

You may obtain a copy of our transfer impact assessments and executed SCCs by writing to privacy@sabiahq.com.

Subject to applicable law (including the GDPR, UK GDPR, CCPA/CPRA, PIPEDA, and other regional data protection regimes), you have the following rights in respect of your personal information:

Sabia is not directed at, and we do not knowingly collect personal information from, children under the age of 13 (or the applicable age of digital majority in your jurisdiction, e.g. 16 in the EEA under the GDPR).

If you are a parent or legal guardian and believe your child has provided us with personal information without your consent, please contact us immediately at privacy@sabiahq.com. Upon verified notification, we will take commercially reasonable steps to delete that information from our active databases and backup rotation schedules as quickly as is technically feasible.

If you are between the ages of 13 (or the local digital age of majority) and 18, you may only use Sabia with the consent and supervision of a parent or legal guardian who has agreed to these terms on your behalf.

We implement and maintain a comprehensive information security program designed to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and access. Our security measures include, but are not limited to:

• Encryption in transit: All communication between your browser and Sabia uses TLS 1.3 with HSTS enforced at the edge.
• Encryption at rest: All data stored in Supabase is encrypted at rest using AES-256, with volume-level and field-level encryption layers.
• Authentication: Short-lived, cryptographically-signed JWTs with rotating refresh tokens. Passwords (when used) are hashed with bcrypt at a minimum work factor of 12. We never store raw passwords.
• Access control: Role-Based Access Control (RBAC) enforced at both the application and database layer via PostgreSQL Row Level Security (RLS) policies. Zero standing administrative access for production data.
• Networking: Firewalled subnets, IP allow-listing for admin endpoints, and CDN edge security with DDoS mitigation and rate limiting.
• Vulnerability management: Automated dependency scanning, quarterly static application security testing (SAST), annual penetration testing by a third-party firm, and a responsible disclosure program.
• Operational security: All engineers are required to use hardware-backed 2FA, single-sign-on, and encrypted endpoints. Production data access is logged, audited, and time-bounded.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the competent supervisory authority without undue delay and in any event no later than 72 hours after becoming aware of the breach, in accordance with Articles 33–34 of the GDPR and equivalent regional regulations.

We may update this Privacy Policy from time to time to reflect changes in our processing activities, legal or regulatory requirements, new features, or corporate transactions.

Material changes that expand the categories of data we collect, alter the ways we share data, or reduce your rights will be flagged by: (i) updating the “Last updated” date at the top of this page; (ii) displaying a prominent in-app notice for 30 days; and (iii) where the changes are especially significant, sending an email notification to registered users with an active account. Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes.

We maintain a changelog of policy versions available on request from the DPO at privacy@sabiahq.com. If you object to any revised policy, you must stop using the Service and request account deletion.

Questions, subject-access requests, complaints, or breach notifications regarding privacy and data protection should be directed to our Data Protection Officer and legal team via the channels below. We will acknowledge every request within 3 business days and provide a substantive response within the applicable statutory timeframe.