Privacy Policy

Who we are

Materiality is operated by Dan Ibbotson, a sole trader based in Auckland, New Zealand ("we," "us," "our"). You can reach us at [email protected].

We publish an independent weekly newsletter for accounting professionals, available free at materiality.media with an optional paid subscription tier.

What we collect

We collect the minimum data needed to deliver the newsletter, process paid subscriptions, fulfil sponsor arrangements, and improve the publication.

When you subscribe (free or paid)

• Your email address — collected by beehiiv at signup
• First name (optional)
• Approximate country (from IP at signup) — used for geo-staggered send times and regional rules
• Engagement data (issues opened, links clicked) — to inform editorial decisions and detect deliverability issues

When you upgrade to a paid subscription

• Payment information (card details) — collected and processed by Stripe via beehiiv. We never see or store your card details.
• Subscription record (tier, billing date, status)

When you email us

Your email address and message contents — stored in our inbox so we can reply.

When you visit materiality.media

Standard cookie-less analytics (page views, referrer, approximate country, device type) via Cloudflare Web Analytics. We don't use tracking pixels, third-party advertising cookies, or browser fingerprinting.

What we don't collect

• We don't track you across other websites.
• We don't buy or sell data about you.
• We don't require social-media logins.
• We don't serve third-party ads (sponsorships are first-party, vendor-disclosed).
• We don't share subscriber data with sponsors (sponsors get aggregated reports only).
• We don't collect sensitive categories of data.

Why we collect it

• Delivery — to send you the newsletter you subscribed to
• Paid-tier fulfilment — to bill paid subscriptions and deliver paid content
• Engagement signal — to know what's working editorially
• Support — to answer questions and process refunds
• Sponsor operations — to invoice and report on placements
• Editorial improvement — aggregated patterns inform what we cover
• Legal obligations — tax records kept per NZ law

Who your data is shared with

Provider	What they receive	Why	Where based
beehiiv	Email, name, engagement, paid status	Newsletter platform	United States
Stripe	Card details, name, country	Payment processing	United States
Zoho Mail or Google Workspace	Email correspondence	Email hosting	India / United States
Cloudflare	IP, web analytics	DNS + performance	United States
Wise (Business)	Aggregated payout data	Multi-currency banking	Global
SparkLoop	Email + recommendation engagement	Cross-promo network	United States

Each provider has its own privacy policy and offers GDPR + UK GDPR Standard Contractual Clauses where required.

We never sell your data. We never share it with advertisers, data brokers, or affiliate networks. Law enforcement requests would be complied with only as strictly required, with notification where legally possible.

How long we keep your data

• Subscriber records — life of subscription + 30 days after unsubscribe
• Paid-subscription records — 7 years per NZ tax law
• Sponsor records — 7 years per NZ tax law
• Email correspondence — life of relationship; purged on request after 24 months of inactivity
• Web analytics — 12 months, then aggregated

Your rights

• Access — what we have about you
• Correction — fix anything wrong
• Deletion — delete your data (subject to legal retention for tax)
• Portability — get your data as CSV
• Objection / restriction — object to processing for specific purposes
• Withdraw consent — unsubscribe anytime, no friction
• Complain — file with your local data-protection authority

Email [email protected] with "Privacy request" in the subject. Acknowledged within 5 business days, actioned within 30 days.

Security

• Two-factor authentication on every account
• Password manager with unique high-entropy credentials
• No personal data in code or anywhere accidentally publishable
• Email authentication (SPF, DKIM, DMARC) configured
• Encrypted weekly subscriber backups

AI-use disclosure

Materiality is built using Claude (Anthropic) for research, drafting, and verification, alongside human editorial supervision. We don't process subscriber data through Claude — only public industry information, vendor docs, and aggregated engagement signals. Full editorial standards at /standards.

Cookies + tracking

materiality.media uses minimal cookies via Cloudflare for security. We use cookie-less analytics (Cloudflare Web Analytics or Plausible). No advertising cookies, no third-party tracking cookies. The site works fully if you block all cookies. No EU/UK consent banner is required given our cookie-less analytics choice.

Children

Materiality is a B2B publication for accounting professionals. We don't knowingly collect data from anyone under 18.

Changes to this policy

Material changes (new data types, new sharing parties, new jurisdictions) trigger a "Last updated" date refresh and 30-day email notification to subscribers. Minor edits don't.

Jurisdiction

Governed by New Zealand law. We comply with the NZ Privacy Act 2020 and meet or exceed the standards of GDPR, UK GDPR, Australian Privacy Act 1988, Canadian PIPEDA, and California CCPA where they apply.

Contact

Email: [email protected]
NZ supervisory authority: privacy.org.nz — Office of the Privacy Commissioner

Plain-English principle: if something here doesn't make sense, that's our failure. Email us and we'll explain — and probably rewrite the section.