Privacy
Privacy Notice
Effective 2026-08-29
This notice explains what personal data HansaIndex collects, why, how long we keep it, and what you can do about it. It applies to the HansaIndex website at hansaindex.com, the HansaIndex newsletter, and any related sub-pages.
Who we are
HansaIndex is operated by Zenas, MB, registered in the Republic of Lithuania under registration number 305305980, registered office at Lazdynėlių g. 16, Vilnius, Lithuania. In this notice, “we”, “us”, and “HansaIndex” refer to Zenas, MB.
For any privacy-related question, contact privacy@hansaindex.com. We respond within five working days.
What we collect, and why
| Data | When we collect it | Why | Legal basis |
|---|---|---|---|
| Email address | You enter it on a subscribe form | Send the weekly newsletter you signed up for | Consent (GDPR Art. 6(1)(a)) |
| Email-engagement metadata (open, click, unsubscribe) | When you open or click in our newsletter | Improve issues, measure forward rate, drop cold subscribers | Legitimate interest (GDPR Art. 6(1)(f)) |
| Site analytics (page views, referrer, approximate location from IP address, device and browser, and a Google Analytics identifier stored in a cookie) | You visit a HansaIndex page | Understand traffic patterns | Legitimate interest (GDPR Art. 6(1)(f)) for the analysis itself. Storing the cookies needs your consent under the ePrivacy rules, and the site does not yet ask for it. |
| Correction or contact-form submissions | You email us or use a contact form | Reply to your message | Legitimate interest (GDPR Art. 6(1)(f)) |
| Payment data (paid tiers, when launched) | You purchase a subscription | Process payment, send invoice, fulfil order | Contract (GDPR Art. 6(1)(b)) |
We do not use advertising cookies, do not run advertising or remarketing pixels, and do not sell or share your email with anyone. We do use Google Analytics, which sets its own cookies. The section on what we track, below, sets out exactly what that involves and how to opt out.
How we collect it
- Subscribe form: double opt-in. You enter your email, we send a confirmation link, you click it. Until you click, no data is stored beyond a 24-hour pending record.
- Page analytics: Google Analytics 4. It sets first-party cookies in your browser and sends page-view data to Google, including your IP address, from which Google derives an approximate location. We read the reports as aggregates and do not attempt to identify individual readers.
- Newsletter analytics: Beehiiv records opens and clicks per subscriber. We use this to identify cold subscribers (90 days without opens) and prune them.
Processors we use
A “processor” is a service that handles personal data on our instructions. We use:
| Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Beehiiv, Inc. | Newsletter delivery and analytics | United States | EU Standard Contractual Clauses + EU-US Data Privacy Framework |
| Google Ireland Limited (Google Analytics 4) | Site analytics | Ireland / EU, with onward transfer to Google LLC in the United States | EU Standard Contractual Clauses + EU-US Data Privacy Framework |
| Supabase, Inc. (Frankfurt region) | Subscriber records, database | EU (Frankfurt) | Within EU |
| Stripe Payments Europe Ltd. (when paid tier launches) | Payment processing | EU + US (controller-to-processor) | EU SCCs |
| Sentry GmbH (when error monitoring is enabled) | Error monitoring | EU | Within EU |
If we add a new processor, this list is updated and a change note appears in the changelog below.
How long we keep it
- Email and engagement data: as long as you remain subscribed, plus 30 days after unsubscribe for audit. After 30 days the record is deleted from our active list.
- Google Analytics data: kept for the retention period set on our Google Analytics property, after which Google deletes the event-level records. Aggregated reports remain available to us.
- Correction and contact emails: 24 months from last reply, then deleted.
- Payment records: 7 years from invoice date, the statutory accounting retention under the tax law of the Republic of Lithuania.
Your rights
Under GDPR, you can ask us to:
- Access the data we hold about you
- Correct inaccurate data
- Delete your data (right to erasure, unless we have a statutory reason to keep it, like accounting records)
- Restrict processing
- Port your data to another provider
- Withdraw consent at any time. Every newsletter has an unsubscribe link in the footer; one click and you're gone
- Object to processing based on legitimate interest
Email privacy@hansaindex.com for any of these. We confirm within five working days and complete within 30 days.
You can also complain to the data protection authority where you live. The Lithuanian regulator is the supervisory authority for HansaIndex:
- Lithuania: State Data Protection Inspectorate, vdai.lrv.lt
- Estonia: Estonian Data Protection Inspectorate, aki.ee
Children
HansaIndex is intended for adult readers in the professional startup ecosystem. We do not knowingly collect data from anyone under 16. If you believe a minor has subscribed, email privacy@hansaindex.com and we will delete the record.
Security
- TLS on all pages (hansaindex.com).
- Subscriber data stored in Supabase (Frankfurt region) with role-based access control. Only the operator can query subscriber records.
- No subscriber data is logged in application logs. PII is hashed at the application boundary.
- Backups are encrypted at rest. Recovery tested monthly.
What we track (and what we don't)
We run no advertising pixels, no cross-site advertising identifiers, and no third-party fonts (we self-host them). We do run one third-party script, on every page: Google Analytics.
What we do use:
- Google Analytics 4: sets two first-party cookies, _ga and _ga_GR3B9R3PEH, which identify a returning browser. Google sets them to expire after two years; current browsers cap that at 400 days. They are set when the page loads, before you have been asked, because the site has no consent step yet. You can opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout, or by blocking googletagmanager.com.
- Beehiiv embed (on the subscribe form only): sets a session cookie if you fill the subscribe form. This is functional, not tracking.
- Stripe Checkout (only if you visit a paid-tier checkout): sets cookies necessary for payment processing.
That's the entire list. If you want to confirm, open the Network panel in your browser's developer tools while you read HansaIndex. The only third-party requests you will see are to googletagmanager.com and google-analytics.com, which are the Google Analytics calls described above.
Changes
When we change this notice, the effective date at the top of the page updates and a one-line summary appears below. Material changes are emailed to subscribers.
- 2026-07-03: Initial publication.
- 2026-08-29: Named Google Analytics 4 as the site analytics processor, disclosed its cookies, its retention and the transfer to Google, and added opt-out instructions. Removed the reference to Plausible Analytics, which was never deployed. Marked Sentry as a processor only once error monitoring is enabled, and stated that the analytics cookies are set without the consent the ePrivacy rules require.