Privacy Policy

1. Overview and Controller Identity

This Privacy Policy describes how Harbinger Bros. LLC ("Company," "we," "us," or "our"), the operator of the News Radar platform, collects, processes, stores, and transfers personal data in connection with the use of the News Radar dashboard (world map, live ticker, events, sources, and analytics), the Blog, and related account features (collectively, "the Service").

This policy is designed to comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and other applicable data protection laws.

For purposes of the GDPR, the Company acts as the Data Controller with respect to account data and usage data. The news items shown in the Service are drawn from publicly available news feeds and do not contain personal data of our users; they may, however, mention individuals in the context of public events.

Age: The Service is intended for people who are at least 18 years old and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us and we will delete it.

2. Categories of Data Processed

We distinguish between the following categories of data:

2.1 Account and Identity Data

• •Email address and full name: Collected at registration for authentication, account management, and service communications. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• •Subscription and billing data: Active plan tier (Free, Starter, Growth, or Pro), billing cycle, and subscription status are stored for feature access and account management. Payment card data is processed exclusively by our Merchant of Record (see Section 6) and is not stored on our servers.
• •Preferences: Privacy and notification settings stored per account.
• •Watchlist: The regions, categories, and keywords you choose to follow are stored with your account so that matching events can be shown to you. Keywords are free text you enter; please do not enter personal data about third parties. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• •Article drafts: When you generate an article draft from an event, the draft text you edit, the title, the source link, the source text it was based on, and the result of the fact-check are stored with your account so you can come back to them. Drafts are never published by us and are not shared with other users. The public source text (a press release) and your draft text are sent to our AI provider (see Section 6) to generate the draft and to run the fact-check. Legal basis: performance of a contract (GDPR Art. 6(1)(b)). Please do not enter personal data of third parties into drafts. When you delete a draft it is hidden from your list; it is removed completely when your account is deleted.
• •Email alerts: If your plan includes email alerts, we send a digest of new events that match your watchlist to your account email address, at most once every six hours. We store only your on/off setting and the time of the last digest. Every alert contains a one-click unsubscribe link, and you can switch alerts off at any time on the Watchlist page. Legal basis: performance of a contract (GDPR Art. 6(1)(b)); you can object at any time by unsubscribing.

2.2 News Data (Not Personal Data of Users)

• •Public news feeds: News Radar automatically retrieves headlines, short descriptions, links, images, and publication times from publicly available RSS feeds of official institutions (for example the United Nations, European institutions, and government agencies). This data is not submitted by users.
• •AI-generated reports: The retrieved items are sent to an AI provider (see Section 6), which filters them, classifies them, and writes a short English summary, a location, and context notes. The resulting events are stored in our database together with a link to the original article and the name of the source.
• •Individuals named in press releases: Press releases and their summaries may name public figures, officials, or other individuals in connection with public events. We process these names only as part of the short report shown in the Service (purpose: operating a news-monitoring service; legal basis: our legitimate interests, GDPR Art. 6(1)(f), and, where applicable, information and journalistic purposes). The data come from the public institutional source named in each report. We do not build profiles of individuals from reports. If a report concerns you and you want it corrected or removed, contact us (Section 13); we review such requests promptly.

2.3 Blog and Publicly Accessible Content

• •Blog content: The News Radar Blog publishes articles that are publicly accessible without registration or login. No personal data is collected solely from reading Blog content. If you are logged in while accessing the Blog, your session cookie (strictly necessary) may be present.
• •AI-assisted content generation: Blog posts are generated with AI assistance and reviewed before publication. No user data is used in generating Blog posts.

2.4 Technical and Usage Data

• •Server and hosting logs: Request metadata (such as IP address, user agent, and requested URL) is processed by our hosting provider for security and operation.
• •Optional analytics: Only where you have consented, we measure aggregate page views (see Section 8).
• •Contact messages: If you contact us, we process the information you send so that we can respond.

3. Data Flow and Processing Pipeline

The following describes how news data moves through the Service. None of these steps involves content submitted by users:

1. 1.Retrieval: On a recurring schedule, our servers (Vercel serverless functions) fetch publicly available RSS feeds from the configured institutional sources.
2. 2.Classification and Rewriting: New items (headline and short description) are sent to the Anthropic Claude API, which filters out irrelevant items and returns a category, location, importance score, short English summary, and context notes.
3. 3.Storage: The resulting events are stored in our Supabase database together with the original article link and the source name.
4. 4.Display: Signed-in users can view the events on the dashboard according to the archive length of their plan.

4. Data Retention

4.1 News Events

News events are kept in our database; the archive length of your plan only determines how far back you can see them. We may delete older events at any time, and we delete an event when we remove or correct it after a takedown or correction request.

4.2 Account Data

Account and identity data (including your watchlist, alert settings, and article drafts) is kept while your account exists. When you ask us to delete your account, we delete this data without undue delay and within the period required by applicable law; copies in our providers' backups are removed when those backups expire. Billing and tax records are held by our Merchant of Record (Lemon Squeezy) and kept for as long as the law requires.

Messages you send us (for example support or privacy requests) are kept for as long as needed to handle your request and for up to twelve (12) months afterwards, and records of data protection requests for up to three (3) years as proof of how we handled them, unless a longer period is required by law.

4.3 Server Logs

Request metadata may appear in hosting logs for a limited period (see Section 6).

4.4 AI Training

We do not use your personal data to train, fine-tune, or evaluate any machine learning or artificial intelligence model. The news items we send to our AI provider are public institutional press releases; we contract only with providers whose terms prohibit the use of API inputs for model training. Please review the subprocessor list in Section 6 and the respective terms of each provider.

Depending on your jurisdiction, you may be entitled to exercise the following rights with respect to your personal data. Requests may be submitted to support@laenethylabs.com. We respond to verifiable requests without undue delay and within the period required by applicable law (for example one month under the GDPR and 45 days under the CCPA, each extendable where the law permits).

6. Subprocessors and Third-Party Service Providers

We engage third-party service providers ("subprocessors") to support the operation of the Service. These providers process data solely on our behalf, under data processing terms (or equivalent provisions in their service terms) that require them to: (i) process data only in accordance with our documented instructions; (ii) implement appropriate technical and organizational security measures; and (iii) not use customer data for their own purposes, including model training, product improvement, or any form of re-use, unless explicitly permitted and disclosed.

The following subprocessors are engaged:

An up-to-date list of active subprocessors may be requested by contacting us at support@laenethylabs.com. We will notify users of material changes to the subprocessor list where required by applicable law or data processing agreements.

7. International Data Transfers

The Company is incorporated in the United States. Personal data processed through the Service may be transferred to, and processed in, countries outside the European Economic Area (EEA), including the United States, where the level of data protection may differ from that provided under GDPR.

Where personal data originating in the EEA is transferred to countries not recognized by the European Commission as providing adequate data protection, we rely on one or more of the following transfer mechanisms:

• •Standard Contractual Clauses (SCCs): We rely on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as the primary transfer mechanism for data flows to third countries, including transfers to subprocessors such as Anthropic and Vercel.
• •Adequacy Decisions: Where the European Commission has issued an adequacy decision for a recipient country, we rely on that decision as the legal basis for the transfer.
• •Supplementary Technical Measures: Where appropriate, we apply supplementary measures (e.g., encryption in transit via TLS, data minimization) to reduce the risk associated with third-country transfers.

You may request a copy of the applicable transfer mechanisms by contacting us at support@laenethylabs.com.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies in accordance with applicable law, including the ePrivacy Directive and GDPR. A consent management interface is presented upon first access to the Service. Users may accept all cookies, reject non-essential cookies, or configure category-level preferences.

• •Strictly necessary: Authentication and session cookies set by our authentication provider (Supabase), and a record of your cookie choice stored in your browser's local storage. Required for the Service to work and to remember your choice. Legal basis: legitimate interests (GDPR Art. 6(1)(f)) and/or performance of a contract.
• •Analytics (optional): Aggregate page-view statistics through Vercel Web Analytics, which does not use cookies to identify you. Loaded only if you accept the analytics category. Legal basis: consent (GDPR Art. 6(1)(a)).
• •Marketing and preference: We do not currently use any marketing or advertising cookies or trackers; nothing is loaded for this category.

Cookie preferences may be modified at any time via the consent banner or browser settings. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction, in accordance with GDPR Art. 32. These measures include:

• •Encryption in Transit: Data transmitted between the client and our servers is encrypted using TLS 1.2 or higher (Transport Layer Security).
• •Encryption at Rest: All data stored in Supabase is encrypted at rest using AES-256.
• •Row-Level Security: Supabase RLS policies ensure that users can only access, modify, or delete their own data — enforced at the database layer, independent of application logic.
• •Access Controls: User accounts are protected by authenticated sessions managed by Supabase Auth. Administrative access to production systems is restricted to authorized personnel.
• •Data Minimization by Design: We collect only the personal data needed to run accounts and billing. Vercel serverless function logs are subject to automated rotation.
• •Payment Security: Payment card data is not processed or stored by News Radar. All payment transactions are handled exclusively by Lemon Squeezy, which is PCI-DSS compliant.
• •Incident Response: In the event of a personal data breach, we will notify affected users and relevant supervisory authorities as required under GDPR Art. 33–34 and applicable U.S. breach notification laws.

10. Legal Bases for Processing (GDPR)

For users located in the European Economic Area (EEA) or the United Kingdom, we process personal data on the following legal bases under GDPR Art. 6:

11. Additional Jurisdiction-Specific Rights and Data Breach Notification

Depending on your location, additional data protection frameworks may apply to our processing of your personal data, alongside the GDPR and CCPA rights described in Section 5. Requests may be submitted to support@laenethylabs.com.

12. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. In the event of material changes affecting your rights or our obligations, we will provide notice via the platform interface or by email to the address associated with your account, with reasonable advance notice before the changes take effect, unless a shorter notice period is required by law.

Continued use of the Service after the effective date of a revised policy constitutes your acceptance of the updated terms. If you do not agree to the revised policy, you should discontinue use of the Service and may request account deletion in accordance with Section 5.

13. Contact and Data Protection Inquiries

For privacy-related inquiries, data subject requests, or to exercise any rights described in this policy, please contact us at: