Your SecretaryThe short version
- To write your brief we need what you tell us about your work, and to run the account we keep billing and security records as well.
- We do not sell or rent personal information to anyone. The site also runs without advertising or analytics trackers.
- Card numbers are typed into our payment processor's own page and never pass through our servers.
- Your brief is built from public web pages you add. Login-protected profiles such as LinkedIn are never read.
- AI language models write each brief from your profile and the day's articles, and they receive only what that brief needs.
- Advisors on the Team plan can add their clients and send briefs to them. How we handle those clients' information is set out in the section on advisor accounts.
- Most of what we hold about you is visible and editable in the app. Copies and deletions are handled by email at contact@your-secretary.com, with an answer within one month.
Who we are
Your Secretary (your-secretary.com) belongs to Analytics 4 Everyone LLC, Alloy 26, 100 S. Commons, Suite 102, Pittsburgh, PA 15212, United States. Under the General Data Protection Regulation of the European Union and the United Kingdom (the GDPR), Analytics 4 Everyone LLC is the controller of the personal information in this policy, as it alone decides what that information is used for and how. Questions and requests go to contact@your-secretary.com.
This policy covers the website, the web app and the emails we send. The news sites and funders that briefs link to have their own policies, and this one does not cover them.
Information we collect
Information you give us
- Account details. Name, email address, organization, job title, timezone and password. Of the password we hold only a salted one-way Argon2 hash, which nobody here can turn back into the password. With Google sign-in, Google confirms the name and email address and we never receive a password.
- Profile sources. Links to public pages about the work you do (a personal site, a staff page, an ORCID record), documents you upload, text you paste, and the news feeds or pages you follow. Their text becomes a private profile, which the Sources page shows in full.
- Interests and preferences. The topics, companies, industries, keywords, regions and outlets to follow, with a priority for each, along with delivery time, brief length and the choice to include funding calls.
- Messages. Whatever you send us by email or through the contact form, along with the request goal and how you heard about us.
Information created when you use Your Secretary
- Briefs. Each daily brief, with the articles and funding calls it was built from and the moment it was opened in the app.
- Billing records. Plan, trial and renewal dates, subscription status, and the identifiers our payment processor assigns to the customer record and the subscription. Card data remains with the payment processor.
- Email records. For each email, the send time and whether it arrived. Opens and link clicks may be recorded too, by our email provider, when that tracking is switched on, as the section on emails below explains.
- Sign-in records. The time of each sign-in together with the IP address and the browser identification your device sent, kept with your sign-in session to protect your account.
- Operational logs. Records of what the service did for your account, such as sources read, briefs written, emails sent and errors met, which we keep for 90 days to run and secure the service.
Information from other sources
- Publication catalogues. An ORCID iD you add is looked up in an open scholarly catalogue to list your public works.
- News and funding listings. Your brief quotes news anyone can read and open calls listed in public funding catalogues. Those sources are about events in the world, although one of them might name you or your organization when public reporting does.
What we do not collect
We never ask for payment card numbers, government identifiers, health details or other special categories of personal data, and we would rather they stayed out of uploaded documents too. Profiles behind a login, such as LinkedIn or X, are left alone. The service has no access to the location or contacts on a device, and the site has no advertising or analytics trackers.
How we use information and our legal bases
For every use of personal data the GDPR expects a stated legal basis, and the table below gives ours.
| Purpose | Information used | Legal basis under the GDPR |
|---|---|---|
| Create and run your account and sign you in | Account details, sign-in records | Performance of our contract with you |
| Build your profile and write your daily brief | Profile sources, interests, preferences, briefs | Performance of our contract with you |
| Send briefs and service emails such as password resets and trial and billing notices | Email address, name, email records | Performance of our contract with you |
| Take payment and manage your subscription | Billing records | Performance of our contract, and our legal duty to keep tax and accounting records |
| Send occasional product updates while that setting is on | Email address, name | Our legitimate interest in telling customers about the service they use, which you can switch off at any time |
| Keep the service secure, prevent abuse and fix faults | Sign-in records, operational logs | Our legitimate interest in a secure, working service |
| Check that emails reach readers | Email records, including opens and clicks when tracking is on | Our legitimate interest in reliable delivery |
| Answer your requests | Your messages and the information they concern | Performance of our contract, our legitimate interest in answering people who write to us, or our legal obligations when a request concerns your rights |
| Write and deliver briefs for an advisor's clients | Client details the advisor enters, interests, sources, briefs | We act for the advisor, who relies on a legal basis of its own |
| Keep honouring a request to stop emails | A keyed hash of the stopped address | Our legal obligations, and our legitimate interest in never writing to someone who asked us to stop |
| Comply with the law and handle legal claims | Whatever a specific obligation or claim requires | Our legal obligations and our legitimate interests |
Each legitimate interest in that table was balanced against your rights before we relied on it, and the section on your rights explains how to object. We use none of this information for advertising or for training AI models, and we sell none of it.
How AI writes your brief
Early each morning our software collects recent articles that fit the interests you set. An AI language model then receives those articles and the profile details a brief depends on, namely name, role, organization, interests and profile text, and drafts the brief from them. Before anything is sent to you, a separate automatic check compares every claim, number and link in the draft with its source.
More than one AI provider stands ready, so a brief can still be written when one of them is unavailable. When our own parsers cannot read a PDF you upload, up to 20 of its pages may go to an AI provider to be transcribed. These providers process that content in order to return the result to us, under their business terms.
A brief is a reading service. It takes no decision about anyone with legal or similarly significant effects, so the GDPR provisions on solely automated decisions have nothing to apply to.
Advisor accounts and their clients
Some customers are advisors who run Your Secretary for several clients on the Team plan. This section covers the information of those clients, who have no login of their own.
What an advisor adds about a client
For each client the advisor may enter a name, organization, job title, timezone, interests, sources and notes on the engagement. If briefs should go straight to the client, the advisor also enters the client's email address, and before it is saved the advisor confirms that the client agreed to receive briefs there. We record when that confirmation was given. Client information serves only to write and deliver that client's briefs, in the same way as any other reader's, which includes passing it to the AI providers and the email delivery provider described in this policy.
Who is responsible
The advisor decides which clients to add, what to enter about them and where their briefs go. For that information we act on the advisor's instructions as a service provider (a processor under the GDPR), and the advisor is responsible for having a lawful basis and for telling the client about it. Before adding clients, each advisor agrees with one tick to our Advisor Data Processing Addendum, which sets out these commitments in full. A client with a question or a request may write to their advisor or to contact@your-secretary.com. We then pass the request to the advisor, or handle it ourselves where the law expects that of us.
Briefs sent to a client
A brief emailed to a client names the advisor who sent it and carries a link to stop the emails, which also works from the unsubscribe button of most email programs. Once a client stops the emails, the advisor is told by email and in the app, and that client's briefs go to the advisor's inbox from then on. Only the client can start emails to that address again, from the same link. So that a stop still holds after the profile is removed, we keep a keyed hash of the address in place of the address itself, and we delete it when the client restarts the emails.
Advisor branding and custom sending domains
An advisor may add a brand name, a logo and a postal address. These appear in the briefs sent for that advisor's clients and on the page a client uses to stop the emails. With the custom sending domain add-on, an advisor sends client briefs from an address on the firm's own domain. For that purpose our email delivery provider receives the domain name, the reply address and any archive address the advisor sets up at the firm. An archive address receives a hidden copy of every client brief, which the firm then keeps under its own policies.
When a client is removed
Removing a client stops every brief for that client at once. That client's details remain on the advisor's account until the advisor or the client asks us to delete them. Deleting the advisor's account removes them too.
Who we share information with
Only the service providers listed below receive personal information from us. They handle it on our behalf, solely to run Your Secretary, and may do so in the United States or in other countries.
| Type of provider | What it does for us |
|---|---|
| Cloud hosting | Runs the servers of the service, in the United States |
| Managed database | Runs our database |
| Backup storage | Stores our encrypted nightly backup |
| Payment processing | Takes payments and manages subscriptions |
| Email delivery | Delivers our emails |
| AI language models | Write briefs, and transcribe PDFs our parsers cannot read |
| Web fonts | Serves the fonts of the website |
| Google sign-in | Confirms who you are if you choose to sign in with Google |
| Spam protection | Checks that a message sent through the contact form comes from a person |
Anyone who wants the current list of these providers by name can request it at contact@your-secretary.com.
The advisor who added a client profile also sees that client's briefs and whether the client stopped receiving them by email. Beyond those providers and an advisor's view of their own clients, information leaves us in three situations only. The law may require it. Protecting the rights or safety of our users or other people may call for it. A merger or sale of the business may involve it, and then you hear from us before a different policy applies to your information. We never sell personal information, and we never pass it on for ads that track people across websites.
International transfers
Analytics 4 Everyone LLC is based in the United States, and so is the service. If you use Your Secretary from the European Economic Area, the United Kingdom or Switzerland, your information is therefore transferred to the United States. For each provider that takes part in the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, we rely on that framework. For the others we rely on the European Commission's Standard Contractual Clauses in the provider's data processing terms, with the UK addendum where it applies. A copy of the safeguards covering your information is yours on request.
Cookies and similar technologies
Your Secretary sets a single cookie, and only once you sign in. Its job is to keep you signed in. Scripts on the page cannot read it, and it lasts 30 days unless you sign out first. Separately, while a brief is being written the app leaves a short note in your browser's session storage, gone as soon as the tab closes. The service you asked for cannot work without either of them, so there is no consent request and no cookie banner. We use no advertising, analytics or social media cookies.
One more connection happens on every page load. Our fonts come from a third-party font service, which means your browser contacts that service's servers and the service sees your IP address.
The contact page adds one more. Before a message goes out, a spam check from a third-party security service runs in your browser, so that service sees your IP address and technical details about the browser. We use its answer only to keep automated messages out.
Do Not Track and Global Privacy Control signals make no difference here, since there is no advertising tracking for them to switch off.
Emails
What we email you is the daily brief plus notes about your account, your trial and your billing. You can switch the daily email off on the Account page, or with the unsubscribe button your email program shows on each brief. Either way leaves each brief readable in the app for 30 days. Messages about security and billing belong to the service and continue while you have an account. If product updates are switched on, we may also write now and then about new features of Your Secretary, and you can switch them off on the Account page.
Like most email services, ours can note when a brief is opened and which of its links are clicked. That tracking may be switched on or off at our end at any time, so it is not necessarily running. When it is on, a tiny image in each email records the open, and links pass briefly through the email provider's address on their way to the article. These records tell us that briefs are arriving and being read, and that is all we use them for. They are never sold, never used for advertising and never used to build a profile of anyone. If you prefer, switching off images in your email program stops the open records, and every brief still arrives as usual.
Briefs that advisors send to their clients work the same way, and those clients receive nothing else from us.
How long we keep information
- Account, profile and interests. For as long as your account exists. Ask us to delete the account and all of this is gone within 30 days.
- Briefs. Each brief, including those written for an advisor's clients, is deleted from the app and our servers 30 days after its date, together with the list of articles and funding calls it was built from. Emailed copies stay in the recipient's inbox, outside our systems.
- Sources you remove. Removing a source in the app deletes the source, the text we read from it and any file you uploaded for it, after which your profile is rebuilt without it.
- Client profiles. Kept with the advisor's account, as the section on advisor accounts explains.
- Requests to stop emails. The keyed hash of a stopped address stays until that person starts the emails again, so the request keeps being honoured.
- Contact form messages. One year from the day they arrive, after which they are deleted.
- Operational logs. 90 days.
- Backups. We keep only the most recent nightly backup, so information you delete leaves our backups within two days.
- Billing records. The payment processor keeps payment records as financial regulations require, and we keep the billing records that tax law obliges us to keep.
- Email records. The email delivery provider keeps its delivery records, and any open and click records made while tracking is on, for a limited period under its own terms.
Your rights and choices
Wherever you live, you can do the following.
- See and change your account details, interests, preferences and sources in the app, and open the profile files your brief reads.
- Remove any source or interest at any time.
- Turn off the daily email or the product updates.
- Cancel your subscription on the Billing page.
- Ask for a copy of your information, or for your account to be deleted, by writing to contact@your-secretary.com.
In the European Economic Area, the United Kingdom and Switzerland
Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict how it is processed, to receive it in a portable format, and to object to processing that rests on our legitimate interests. Where we rely on your consent, you may withdraw it at any time, which does not affect processing that took place before.
To use any of these rights, write to contact@your-secretary.com from the address on your account. We may ask you to confirm your identity. We answer within one month, and when a request is complex the law lets us take two more months, in which case we tell you. Using your rights costs nothing.
You also have the right to complain to a data protection authority, in particular in the country where you live or work or where you believe your rights were infringed. We would be glad of the chance to resolve your concern first.
In California and other U.S. states with privacy laws
A number of state laws give residents rights over personal information. Depending on the state, they may include knowing what we collect and how we use and disclose it, seeing it, receiving a copy, correcting it and having it deleted. There is nothing to opt out of with us. We neither sell personal information nor share it for cross-context behavioral advertising, and we never use sensitive personal information to infer characteristics about anyone. Using these rights will not change the service or the price you receive. You, or an agent you authorize, can make a request by writing to contact@your-secretary.com.
Security
Every connection to Your Secretary uses HTTPS. Passwords exist here only as Argon2 hashes. The keys of the service and the backups are encrypted, repeated sign-in attempts are slowed down, and only the people who run the service can reach its systems. Perfect security is beyond any system, and if a breach ever involves personal data of yours, we will inform you and the relevant authorities as the law requires.
Children
Your Secretary is a professional service for adults. It is meant for people aged 18 and over, and we do not knowingly collect information from children. If a child may have sent us information, let us know and we will delete it.
Changes to this policy
Each revision of this policy carries a new date at the top of the page. Material changes to how personal information is used are announced by email or in the app before they take effect.
Contact us
Write to contact@your-secretary.com, or by post to Analytics 4 Everyone LLC, Alloy 26, 100 S. Commons, Suite 102, Pittsburgh, PA 15212, United States.