Privacy Policy

Data Controller

ClearingPost
Oslo, Norway
info@clearingpost.com

What Data We Collect

We use two kinds of analytics:

• Site analytics without cookies (Vercel Web Analytics and Vercel Speed Insights), which run on every visit;
• Google Analytics 4, which uses cookies only after you accept analytics cookies.

Site analytics without cookies (Vercel)

Our hosting provider, Vercel, provides Vercel Web Analytics and Vercel Speed Insights. We use them to understand which pages are used, how visitors move between them, and how fast they load. These tools do not set cookies or store anything on your device. For each page view they record:

• The page address, without its query string — so text you type into our search boxes and filter selections are not included
• The address of the page that linked to us, as reported by your browser (usually just the website)
• Approximate location (such as country), derived by Vercel from your IP address
• Browser, operating system and device type
• For Speed Insights, page performance measurements (for example, loading time) and, for some of them, which kind of page element or interaction the measurement relates to

We also record a small set of interactions with our content. Each is a fixed category chosen from a predefined list, for example:

• that a link to an official source or a document was opened;
• that a visitor moved from an article to a payment-system page;
• that a site search was opened or used and a result selected — but not what was searched for;
• that the browser tab showing a page was visible for at least 15 seconds (or 60 seconds) in total and that the page was scrolled, clicked, tapped or used with the keyboard at least once — only that this happened, not where, what was pressed or for exactly how long;
• that a page was opened from a link in a ClearingPost email (or from a copy of such a link), and which kind of email (for example the weekly email) — but not who received it or the address it was sent to;
• whether a newsletter sign-up attempt succeeded — but not the email address;
• that an email sign-up was handed to our email provider from a watch control, or that our provider’s confirmation page brought you back — but not the address or the systems sent with it;
• that a watch control was used (for example Watch or Stop watching), and on which page — but nothing from your stored watchlist.

These interaction records contain no text you type, no addresses of the links you open, and no identifiers. To count visitors, Vercel uses a hash created from the incoming request, which is discarded after 24 hours. It does not let us recognise you across days or on other websites, and Vercel states that these records are not tied to an IP address. We analyse this data in aggregate and as short-lived, per-day visit records (the daily hash with the page-view details and interaction categories above) — for example, to understand how visitors move between pages and to separate automated traffic from real visits. We do not use it to identify anyone.

Google Analytics 4 (only with your consent)

If you accept analytics cookies, we also use Google Analytics 4 (GA4) to collect:

• Pages visited (the page address without its query string, apart from short standard campaign tags) and time spent
• Referring source (how you found us), including standard campaign tags in the link you followed
• Interactions such as scrolling to the end of a page, following a link to another website, downloading a file, and starting or submitting a form (not what you type into it)
• Browser type, device type, screen resolution
• Approximate geographic location (country/city level, derived from your IP address)
• A randomly generated client identifier stored in cookies (_ga, _gid)

Google’s tag is loaded only after you accept analytics cookies. Before you choose, if you decline, and after you withdraw your consent, nothing is sent to Google Analytics and no Google Analytics cookie is set.

We do NOT collect:

• Names, email addresses, or other directly identifying information through analytics
• Financial or payment data
• Content of any communications

Stored in your browser

Two features save a small amount of information in your browser’s local storage. It stays on your device: ClearingPost’s servers do not receive it, it is not synced to other devices, and no account is involved.

Nothing else is stored for the watchlist: no email address, no identifier and no browsing history. When you use a watch control (for example Watch or Stop watching), the interaction is recorded the same way as other interactions on the site (see “Site analytics without cookies”): which kind of action it was and on which page, with no identifier and nothing from your stored watchlist. You can remove your watchlist on the Watchlist page, here, or by clearing this site’s data in your browser.

ClearingPost email (newsletter and watch updates)

ClearingPost has one mailing list. You can join it from a newsletter sign-up form or from the email step of Watch. It carries selected ClearingPost news and intelligence and, once they begin, email updates about the payment systems you watch. Emails about specific watched systems have not started yet.

What is held. Your email address. If you join from Watch, also the payment systems sent with the sign-up — those watched in that browser at the time — attached to your address as labels such as “watch-chaps”, which version of the sign-up wording you saw, and that the sign-up came from a watch control. Stopping a watch in your browser does not change the systems attached to your address. Buttondown also records when you subscribed and confirmed, and, to check that a sign-up is genuine and to prevent abuse, technical information about the request such as its IP address.

Where it goes. Your browser sends your address directly to Buttondown, our email provider, which stores it and sends ClearingPost email on our behalf. ClearingPost’s own servers do not receive or store your address, and it is never part of our analytics.

Confirmation. You join only after you open the confirmation link that Buttondown emails to you (double opt-in). Until you confirm, the address is held as unconfirmed and is not sent ClearingPost updates. If a sign-up is never confirmed, the address stays with Buttondown as unconfirmed; write to info@clearingpost.com and we will delete it.

Your choices. Every ClearingPost email has a link to manage your subscription or to unsubscribe. Unsubscribing removes you from all ClearingPost email. It does not change the watchlist saved in your browser, and forgetting that watchlist does not unsubscribe you. To change which systems are attached to your address, or to have your address deleted, write to info@clearingpost.com.

How long. We keep your address and the systems attached to it while you are subscribed. After you unsubscribe, Buttondown keeps a record that the address unsubscribed, so that it is not emailed again by mistake; ask us if you want that record deleted too.

Cookies

We use the following cookies:

Analytics cookies are set ONLY after you give explicit consent via our cookie banner. If you decline, no analytics cookies are placed. Vercel Web Analytics and Speed Insights do not use cookies.

Legal Basis

We process Google Analytics data based on your consent (GDPR Article 6(1)(a)). You may withdraw consent at any time using the “Cookie Settings” link in our footer.

We process the cookieless Vercel site analytics described above on the basis of our legitimate interest (GDPR Article 6(1)(f)). That interest is understanding how our site is used and how it performs, so that we can improve it, using data that is not used to identify you. Because this analytics uses no cookies or identifiers we can link to you, we cannot switch it off for you individually. You can object by contacting us, and you can prevent it with a browser or extension that blocks analytics scripts.

If you join ClearingPost email, we process your address and the systems attached to it based on your consent (GDPR Article 6(1)(a)). You can withdraw it at any time by unsubscribing.

Data Transfers

Google Analytics data may be transferred to Google LLC in the United States. Google operates under the EU-US Data Privacy Framework. We have implemented Google Consent Mode v2 to ensure your consent choices are respected.

Vercel Inc., based in the United States, hosts our site and processes the site analytics described above on our behalf. Vercel is certified under the EU-US Data Privacy Framework.

Buttondown, our email provider, is based in the United States and processes mailing-list subscriber data there on our behalf. Buttondown’s data processing agreement, which forms part of its terms of service, incorporates the EU Standard Contractual Clauses for these transfers.

Your Rights

Under the GDPR, you have the right to:

• Access your personal data
• Request deletion of your data
• Withdraw consent at any time
• Object to processing based on our legitimate interest
• Lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no

How to Exercise Your Rights

Contact us at info@clearingpost.com. We will respond within 30 days.

Changes to This Policy

We may update this policy. Changes will be posted on this page with an updated date.