Privacy Policy#

Treadstone Collective

Effective date: August 27, 2026 Last updated: August 27, 2026

---

Notice of a Material Change — Effective August 27, 2026#

This version takes effect on August 27, 2026 and supersedes the version dated August 26, 2026, which remains readable in full.

What is changing. We are adding one advertising measurement tag to our marketing website — the X (Twitter) Website Tag. It loads only for visitors who allow the advertising category in our cookie banner, and it reports an IP address, browser user agent, page address, and referring page to X, together with a signal that a newsletter signup completed. No email address or other identifier is attached to it. Under the California Consumer Privacy Act and comparable state laws, this counts as sharing personal information for cross-context behavioral advertising, and we describe it that way below rather than reaching for a narrower word.

What you can do. You can opt out at any time, and an opt-out already on file stays in force without any further action from you. Use the Do Not Sell or Share My Personal Information control, decline the advertising category in our cookie banner, or send a Global Privacy Control signal from your browser. Any of the three stops the tag from loading at all.

---

1. Overview#

This Privacy Policy explains how TREADSTONE COLLECTIVE LLC, a Florida limited liability company ("Treadstone," "we," "us"), collects, uses, shares, and protects personal information.

It covers two distinct things, and the difference matters:

1. Information about you — our subscribers, waitlist members, and website visitors. Sections 2 through 6.
2. Information about people who appear in our intelligence content — public figures, officials, and named individuals who show up in the open-source material we process. Section 7.

If you have questions, contact us at privacy@treadstonecollective.com.

---

2. Information We Collect About You#

2.1 Information you give us#

2.2 Information collected automatically#

• Usage data: pages and briefs viewed, searches run, features used, timestamps, session duration
• Device and technical data: IP address, browser type and version, operating system, device type, screen size, language, referring URL
• Approximate location: derived from IP address at city or region level. We do not collect precise GPS location.
• Email engagement: whether you clicked a link in an email we sent you. We do not place open-tracking pixels in The Daily Signal. See Section 8.5.
• Cookies and similar technologies: see Section 9

2.3 Information from third parties#

• Stripe — subscription status, payment outcomes, fraud signals
• Resend — email delivery outcomes: deliveries, bounces, spam complaints, and unsubscribe events
• Authentication providers — if you sign in through a third-party identity provider, the basic profile information they share

2.4 What we do not collect#

We do not intentionally collect sensitive personal information about you — such as government ID numbers, precise geolocation, biometric data, health information, or information revealing racial or ethnic origin, religious beliefs, political opinions, trade union membership, or sexual orientation. Please do not send us this information.

---

3. How We Use Your Information#

We never sell your personal information. As of August 27, 2026 we share a limited amount of technical information for advertising measurement, and you can switch that off. See Section 8.

We do not use your personal information to train third-party AI models. Your account data, queries, and content are not used as training data by our AI providers under our API agreements with them.

---

4. Legal Bases for Processing (EEA, UK, and Switzerland)#

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information on these bases:

For the separate question of information about individuals appearing in our intelligence content, see Section 7.

---

5. How We Share Your Information#

We share personal information with the following categories of recipients. We do not sell it to data brokers.

5.1 Service providers (sub-processors)#

We require service providers to protect personal information and to use it only for the purposes we specify. We maintain a current list at /subprocessors and will update it as providers change.

5.2 Other sharing#

• Legal and safety: when required by law, subpoena, or court order, or where we believe disclosure is necessary to protect rights, safety, or property, or to investigate fraud or violations of our Terms
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy
• Advertising measurement: the limited technical information described in Section 8.1, shared with X only when you have allowed the advertising category and never after an opt-out
• With your direction: when you ask us to share information with a third party

---

6. Retention#

We may retain information longer where required by law or to establish, exercise, or defend legal claims.

---

7. Information About Individuals Appearing in Intelligence Content#

This section is about people who are named or described in the material we process, not about our subscribers.

7.1 What we process. Treadstone monitors publicly available sources — news reporting, government publications, public social media accounts, public messaging channels, and academic and research datasets. That material frequently names individuals, most often public figures: heads of state, government officials, military and security leadership, diplomats, executives, and others whose conduct is the subject of public reporting. We extract, structure, and store references to these individuals in an entity database, and we generate summaries and assessments that mention them.

7.2 Purpose. We process this information for journalistic, research, and analytical purposes — reporting on and analyzing public affairs, armed conflict, security, and geopolitical developments.

7.3 Legal basis. Where the GDPR or UK GDPR applies, we rely on legitimate interests under Article 6(1)(f) — our interest and our subscribers' interest in analysis of matters of public concern, balanced against the rights of the individuals concerned. We also rely, where applicable, on the exemptions for processing carried out for journalistic purposes and for academic, artistic, or literary expression under Article 85 and the national laws implementing it. Where a source contains special category data under Article 9, we rely on Article 9(2)(e) (data manifestly made public by the data subject) or Article 9(2)(g) where applicable.

7.4 Sources. We do not collect information covertly, by deception, from private communications, from stolen or leaked datasets, or by any means requiring circumvention of access controls. We process material that is publicly available.

7.5 Accuracy. Our content is generated by automated systems from third-party sources and may contain errors, including errors about named individuals. We take accuracy seriously and will act on credible correction requests.

7.6 Your rights if you appear in our content. If you are named in our intelligence content, you may contact us at privacy@treadstonecollective.com to request access to what we hold about you, correction of inaccuracies, deletion, or to object to our processing. We will assess each request against the exemptions above and applicable law, and will respond within the time required by law. We will not disclose subscriber identities or our sourcing in responding to such a request.

---

8. Advertising, Analytics, and Your Opt-Out Rights#

8.1 The advertising technology we use. Our marketing website loads one advertising measurement tag: the X (Twitter) Website Tag. It loads only for visitors who have allowed the advertising category in our cookie banner. When it loads, it reports to X your IP address, browser user agent, the address of the page you are on, and the address of the page you arrived from, together with a signal that a newsletter signup completed. We attach no email address and no other identifier to any of it.

We run no other advertising pixels, no third-party analytics services, and no server-side advertising integrations — nothing about you is sent to an advertising platform by our servers, only by the tag in your browser and only with your consent. Before August 27, 2026, we ran no advertising or analytics trackers of any kind.

8.2 Sale and sharing of your personal information. We do not sell personal information for money, and we never have. The tag described in Section 8.1 does amount to sharing personal information for cross-context behavioral advertising, as that term is defined by the California Consumer Privacy Act and comparable laws in Colorado, Connecticut, Virginia, Texas, and other states. That sharing happens only where you have allowed it, and it stops entirely when you opt out.

8.3 How to opt out. Any one of the following stops the tag from loading, which means nothing is shared at all — the script is never added to the page, rather than loaded and then asked to behave:

• Use the Do Not Sell or Share My Personal Information control, linked in the footer of every page
• Decline the advertising category in our cookie banner, reachable at any time through the Cookie Preferences link in the footer
• Send a Global Privacy Control (GPC) browser signal, which we honor automatically on your first request as a valid opt-out request, with no action required from you

An opt-out recorded at any time applies from that moment onward and stays on file. It covers both our website and the intelligence portal. We will not deny you service, charge you a different price, or degrade the product because you opted out (Section 12.2). If we later add advertising or analytics technologies beyond the one described in Section 8.1, we will update this Policy and notify you before that change takes effect, as described in Section 14.

8.4 The Daily Signal and marketing email. The Daily Signal is a free daily email. You subscribe by entering your email address on our website; we do not add subscribers from any other list, we do not buy or rent email addresses, and we do not sell, rent, or share the subscriber list with anyone. The advertising tag described in Section 8.1 reports that a signup happened, never who signed up — your email address is not included in it. Subscription is single opt-in — we do not send a confirmation email — so if someone enters your address without your permission, use the unsubscribe link in the first issue you receive and we will stop.

Every issue includes a working unsubscribe link and a one-click List-Unsubscribe header, and identifies us by name with our postal address, as required by the CAN-SPAM Act. Unsubscribing takes effect immediately and permanently. Unsubscribing from The Daily Signal does not stop transactional messages such as renewal notices, receipts, or security alerts, which are part of your account rather than marketing.

8.5 Email tracking. We track which links are clicked in the email we send, so we can tell which content readers find useful. We do not use open-tracking pixels in The Daily Signal, so we cannot tell whether you opened it. Click data is processed by Resend on our behalf (Section 5.1) and is not shared with advertisers or data brokers. If you would rather not generate click data, navigate to our site directly rather than through an email link, or unsubscribe.

---

9. Cookies and Similar Technologies#

We use:

• Strictly necessary cookies — authentication, session management, security. These cannot be disabled.
• Functional cookies — remembering your preferences and settings.
• Advertising cookies — those set by the X (Twitter) Website Tag described in Section 8.1. They are set only where you have allowed the advertising category, and never where you have opted out or sent a GPC signal.

We use no analytics cookies. If we add them, they will be set only with your consent where consent is required. You can manage every non-essential category through our cookie banner, reachable at any time from the Cookie Preferences link in the footer.

You can manage your choices through our cookie banner or your browser settings. Blocking necessary cookies will break core functionality.

Email. Tracking in the email we send is separate from cookies on our website and is described in Section 8.5.

---

10. Security#

We protect personal information with measures including encryption in transit (TLS) and at rest, hashed password storage, row-level security on our database, access controls limiting internal access to what is necessary, and audit logging.

No system is perfectly secure. We cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

Use a strong, unique password and notify us immediately at security@treadstonecollective.com if you suspect unauthorized access to your account.

---

11. International Data Transfers#

We are based in the United States, and our infrastructure is primarily located there. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and other countries whose data protection laws may differ from those in your country.

Where we transfer personal information out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where needed. You may request a copy of the relevant safeguards at privacy@treadstonecollective.com.

---

12. Your Rights#

12.1 All users#

You may access and update most account information directly in your account settings, cancel your subscription at any time, unsubscribe from The Daily Signal or any other marketing email using the link at the bottom of every issue, and contact us with any privacy request.

12.2 U.S. state privacy rights#

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you may have the right to:

• Know what personal information we collect, use, disclose, and share
• Access a copy of your personal information in a portable format
• Correct inaccurate personal information
• Delete your personal information, subject to legal exceptions
• Opt out of sale, sharing, and targeted advertising — we never sell personal information; you can opt out of the sharing described in Section 8 using any of the controls in Section 8.3, and we honor GPC signals automatically
• Limit use of sensitive personal information — we do not use sensitive personal information for purposes requiring this right
• Non-discrimination — we will not deny service, charge different prices, or provide a different level of service because you exercised these rights

Authorized agents may submit requests on your behalf with proof of authorization.

Appeals: if we deny your request, you may appeal by replying to our decision. We will respond within 45 days. If we deny your appeal, you may contact your state attorney general.

All U.S. residents. Not every state has a comprehensive privacy law, and some that do — including Florida — apply only to very large companies. Regardless of where you live in the United States, we will honor access, correction, deletion, and opt-out requests from any user through the process in Section 12.4.

12.3 EEA, UK, and Swiss rights#

You have the rights to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests — including objecting to direct marketing at any time. You may withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing.

You have the right to lodge a complaint with your local supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL); in the UK, the Information Commissioner's Office (ICO).

12.4 How to exercise your rights#

Email privacy@treadstonecollective.com with your request and the email address on your account. We will verify your identity before acting, and we will respond within the time required by applicable law — generally 45 days in the United States and one month in the EEA and UK.

---

13. Children#

The Service is intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us at privacy@treadstonecollective.com and we will delete it.

---

14. Changes to This Policy#

We may update this Policy. If we make a material change, we will notify you by email or through the Service before it takes effect and update the "Last updated" date above. Prior versions are available on request.

---

15. Contact Us#

Treadstone Collective LLC 525 N. Fort Lauderdale Beach Blvd, Unit 902 Fort Lauderdale, FL 33304 United States

Privacy: privacy@treadstonecollective.com Security: security@treadstonecollective.com Corrections: corrections@treadstonecollective.com

EU / UK representative: [TO BE APPOINTED IF REQUIRED — see Article 27 GDPR]