Privacy
Privacy Notice
Effective 2026-07-03
This notice explains what personal data HansaIndex collects, why, how long we keep it, and what you can do about it. It applies to the HansaIndex website at hansaindex.com, the HansaIndex newsletter, and any related sub-pages.
Who we are
HansaIndex is operated by Zenas, MB, registered in the Republic of Lithuania under registration number 305305980, registered office at Lazdynėlių g. 16, Vilnius, Lithuania. In this notice, “we”, “us”, and “HansaIndex” refer to Zenas, MB.
For any privacy-related question, contact privacy@hansaindex.com. We respond within five working days.
What we collect, and why
| Data | When we collect it | Why | Legal basis |
|---|---|---|---|
| Email address | You enter it on a subscribe form | Send the weekly newsletter you signed up for | Consent (GDPR Art. 6(1)(a)) |
| Email-engagement metadata (open, click, unsubscribe) | When you open or click in our newsletter | Improve issues, measure forward rate, drop cold subscribers | Legitimate interest (GDPR Art. 6(1)(f)) |
| Aggregated page analytics (page views, country, referrer, device class) | You visit a HansaIndex page | Understand traffic patterns | Legitimate interest (GDPR Art. 6(1)(f)) |
| Correction or contact-form submissions | You email us or use a contact form | Reply to your message | Legitimate interest (GDPR Art. 6(1)(f)) |
| Payment data (paid tiers, when launched) | You purchase a subscription | Process payment, send invoice, fulfil order | Contract (GDPR Art. 6(1)(b)) |
We do not use third-party advertising cookies, do not track you across sites, and do not sell or share your email with anyone. There are no marketing pixels on the HansaIndex site.
How we collect it
- Subscribe form: double opt-in. You enter your email, we send a confirmation link, you click it. Until you click, no data is stored beyond a 24-hour pending record.
- Page analytics: Plausible Analytics, hosted in the EU, cookieless. We see anonymised aggregates only: no individual reader is identifiable.
- Newsletter analytics: Beehiiv records opens and clicks per subscriber. We use this to identify cold subscribers (90 days without opens) and prune them.
Processors we use
A “processor” is a service that handles personal data on our instructions. We use:
| Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Beehiiv, Inc. | Newsletter delivery and analytics | United States | EU Standard Contractual Clauses + EU-US Data Privacy Framework |
| Plausible Insights OÜ | Aggregate site analytics | Germany / EU | Within EU; no cross-border transfer |
| Supabase, Inc. (Frankfurt region) | Subscriber records, database | EU (Frankfurt) | Within EU |
| Stripe Payments Europe Ltd. (when paid tier launches) | Payment processing | EU + US (controller-to-processor) | EU SCCs |
| Sentry GmbH | Error monitoring | EU | Within EU |
If we add a new processor, this list is updated and a change note appears in the changelog below.
How long we keep it
- Email and engagement data: as long as you remain subscribed, plus 30 days after unsubscribe for audit. After 30 days the record is deleted from our active list.
- Aggregate analytics: rolling 24-month window. Older data is permanently anonymised or deleted.
- Correction and contact emails: 24 months from last reply, then deleted.
- Payment records: 7 years from invoice date, the statutory accounting retention under the tax law of the Republic of Lithuania.
Your rights
Under GDPR, you can ask us to:
- Access the data we hold about you
- Correct inaccurate data
- Delete your data (right to erasure, unless we have a statutory reason to keep it, like accounting records)
- Restrict processing
- Port your data to another provider
- Withdraw consent at any time. Every newsletter has an unsubscribe link in the footer; one click and you're gone
- Object to processing based on legitimate interest
Email privacy@hansaindex.com for any of these. We confirm within five working days and complete within 30 days.
You can also complain to the data protection authority where you live. The Lithuanian regulator is the supervisory authority for HansaIndex:
- Lithuania: State Data Protection Inspectorate, vdai.lrv.lt
- Estonia: Estonian Data Protection Inspectorate, aki.ee
Children
HansaIndex is intended for adult readers in the professional startup ecosystem. We do not knowingly collect data from anyone under 16. If you believe a minor has subscribed, email privacy@hansaindex.com and we will delete the record.
Security
- TLS on all pages (hansaindex.com).
- Subscriber data stored in Supabase (Frankfurt region) with role-based access control. Only the operator can query subscriber records.
- No subscriber data is logged in application logs. PII is hashed at the application boundary.
- Backups are encrypted at rest. Recovery tested monthly.
What we track (and what we don't)
We don't use cookies for tracking. No advertising pixels. No cross-site identifiers. No third-party fonts (we self-host) and no third-party scripts on most pages.
What we do use:
- Plausible Analytics: cookieless, EU-hosted aggregate page analytics. Counts visits and referrers, not people. No personal data is sent.
- Beehiiv embed (on the subscribe form only): sets a session cookie if you fill the subscribe form. This is functional, not tracking.
- Stripe Checkout (only if you visit a paid-tier checkout): sets cookies necessary for payment processing.
That's the entire list. If you want to confirm, open the Network panel in your browser's developer tools while you read HansaIndex. You'll see no third-party requests from analytics, ads, or tracking vendors.
Changes
When we change this notice, the effective date at the top of the page updates and a one-line summary appears below. Material changes are emailed to subscribers.
- 2026-07-03: Initial publication.