What we keep, what we do not
Privacy policy
This is a Stage 1 draft and has not been reviewed by a lawyer. It is published here so you can read it before you buy, and it is what we will hold ourselves to.
Not ready to publish. Still to fill: [BRAND-GMAIL-ADDRESS], [DATE], [POSTAL ADDRESS: Stage 1 sole-trader address], [TLD]. They are marked in red below.
1. Who is the data controller
The data controller for The One Hundred is Matt Kerr trading as The One Hundred, a sole trader based in New Zealand. You can contact us about anything in this policy at [BRAND-GMAIL-ADDRESS].
This policy is written to comply with the New Zealand Privacy Act 2020 as the primary governing law, and to honour applicable rights under the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Canada's PIPEDA, and Australia's Privacy Act 1988 where they apply to you.
2. Privacy by design: what we deliberately do not collect or keep
The One Hundred is structured around data minimisation. At the moment we receive your purchase webhook from Gumroad, we deliberately discard the following data: it is never written to our database and never persisted:
- Your billing email (Gumroad holds this, see section 5)
- Your billing IP address
- Your billing country / region beyond what we need for tax compliance
- Your name on card
- Your card details (we never see these even briefly: Gumroad does)
- Any payment metadata
We discard these because we do not need them for the service. This is a deliberate privacy-by-design choice consistent with the NZ Privacy Act 2020 Information Privacy Principle 5 (Storage and security of personal information) and GDPR Article 5(1)(c) (data minimisation).
3. What personal data we do collect, and why
We collect and retain the minimum data needed to deliver the service.
| Data | Why we collect it | When we collect it |
|---|---|---|
| Your name | To submit alongside your email to third-party mailing lists (most lists require a name) | At checkout |
| Subscription email address | The address we give to third-party mailing lists on your behalf | At checkout |
| Gumroad order ID | To verify your purchase and resolve service issues | At purchase (via webhook) |
| Purchase week (week-level timestamp) | To know which 100-week block your schedule runs through | At purchase |
| Your randomised 100-week schedule | The deliverable: which list you'll be signed up to in each week | Generated at purchase |
| Access token for your schedule page | So you can revisit your schedule via the link you received at purchase | Generated at purchase |
We deliberately store the purchase week at week-level granularity (e.g. "2026-W23") rather than precise timestamps. This is a further privacy-by-design choice: we don't need the precision and we don't keep it.
We do not collect contents of your inbox, your reading behaviour, your interactions with third-party emails, or any analytics about you beyond your purchase event.
4. Purpose and legal basis
Under GDPR, our legal bases are:
- Performance of a contract for delivering The One Hundred service to you (the schedule generation, the validator submissions).
- Explicit consent for the specific act of submitting your email address to third-party mailing lists. This consent is captured at checkout via a tick-box. You can withdraw consent for future signups at any time by emailing [BRAND-GMAIL-ADDRESS] (this will not retract past signups, see section 8).
Under the NZ Privacy Act 2020, our purpose is the legitimate operation of The One Hundred service as described in our Terms.
5. Who we share your data with: by design
The core feature of The One Hundred is that we share your email and name with third-party mailing list operators on your behalf. Over the 100-week subscription term you will be added to up to 100 different organisations' mailing lists, drawn from a curated pool of approximately 520.
Once a third party receives your data, they become an independent data controller. They process your data under their own privacy policies, which we do not control. You should expect:
- Their emails to begin arriving directly to your email address.
- Their unsubscribe links and processes to be the only way to leave their lists.
- Their data retention to be governed by their own policies.
We do not have contractual relationships with these third parties. They are real organisations operating independently. We choose them for inclusion in our pool based on our validation process, but we cannot bind them to The One Hundred's promises about how your data will be handled.
This is the trade-off you are accepting when you buy The One Hundred. We want it stated clearly.
6. Other recipients of your data
| Recipient | What they get | Why |
|---|---|---|
| Gumroad (gumroad.com) | Card details, billing email, country | To process payment, collect any indirect taxes |
| Cloudflare (cloudflare.com) | IP address, user agent | To serve the website and your schedule page (free WHOIS privacy is enabled on our domain) |
| Hetzner / DigitalOcean (validator VPS host) | No personal data of yours: the validator submits your data to third parties; the VPS host does not retain it | Infrastructure |
| Smartproxy / Bright Data (residential proxies) | No personal data: the proxies route validator traffic | Infrastructure / anti-bot defence |
We do not sell your personal data. We do not share your personal data with advertisers. We do not use an email service provider: we send you no direct email at all (see section 7). The only "sharing" with parties beyond infrastructure providers is the deliberate sharing with third-party mailing list operators described in section 5.
7. We send you no direct email, ever
The One Hundred itself sends you zero direct email. The Gumroad receipt is sent by Gumroad as part of payment processing, not by us. We have no email service provider, no mailing list of customers, no marketing email pipeline, no welcome email, no recap email, no service-update email.
This is a deliberate design choice with multiple effects:
- We hold less of your data and have nothing to leak via an email channel.
- We are outside the scope of UEMA / CAN-SPAM / CASL / AU Spam Act / GDPR e-Privacy direct-marketing rules because we don't send commercial messages.
- The third parties send their own emails directly to you with their own footers under their own legal obligations.
The only artefacts branded as The One Hundred are the Gumroad receipt (one-off) and your schedule page (accessed via your token).
8. Where your data lives
- Gumroad processes data globally (US-based).
- Our validator VPS is in Germany or another EU country (Hetzner) or the US (DigitalOcean), depending on which provider we use.
- The third-party mailing list operators are spread across many jurisdictions globally.
If you are in the EU/UK, your data will be transferred to non-EU jurisdictions. Where required, transfers rely on Gumroad's and Cloudflare's published data-processing terms.
9. Data retention
- We retain your record (name, email, order ID, week-level purchase timestamp, randomised schedule, token, list-assignment history) for the active duration of your 100-week subscription and for 24 months after the final week, to honour any late complaint or regulatory request.
- After that retention period, we delete or anonymise your personal data from our records. We cannot delete data already held by third parties to whom you have been subscribed.
- The data we deliberately discarded at the webhook handler (billing email, IP, country, card details, see section 2) is never retained at all.
10. Your rights: general
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Withdraw consent for future third-party signups (this stops the validator from adding you to any further lists, but does not retract past signups).
- Delete your personal data from our records (subject to the retention exceptions in section 9).
- Object to processing.
- Complain to a supervisory authority, see section 11 for the relevant authority in your jurisdiction.
To exercise any of these rights, email [BRAND-GMAIL-ADDRESS]. We will respond within 30 days (faster where required by law).
Because of our data-minimisation design (section 2), our responses to access requests will be shorter than for most services: we genuinely hold less data about you than typical providers.
11. Jurisdiction-specific rights
If you are in the European Union, the United Kingdom, or the European Economic Area
You have rights under GDPR/UK GDPR including access, rectification, erasure, restriction of processing, data portability, and objection. You may lodge a complaint with your national data protection authority.
Note that you also have a 14-day right of withdrawal under the Consumer Rights Directive, see section 7 of our Terms of Service for how this applies to The One Hundred and how the right is waived if you consent to immediate service performance at checkout.
If you are a California resident
Under the CCPA/CPRA you have the right to:
- Know what personal information we collect and how we use it (this policy).
- Request deletion of your personal information.
- Opt out of "sale" or "sharing" of personal information: we do not sell personal information, but our deliberate submission of your email to third-party mailing lists at your explicit request is a form of disclosure you have specifically authorised at checkout. You may withdraw this authorisation for future signups by emailing [BRAND-GMAIL-ADDRESS].
- Non-discrimination for exercising your rights.
If you are a Canadian resident
PIPEDA gives you the right to access, correction, and complaint to the Office of the Privacy Commissioner of Canada. CASL (Canada's anti-spam law) does not apply to our communications because we do not send you commercial electronic messages.
If you are an Australian resident
The Privacy Act 1988 and the Australian Privacy Principles apply. You have rights to access and correction, and to complain to the Office of the Australian Information Commissioner. The Spam Act 2003 does not apply to our communications because we do not send you commercial electronic messages.
If you are a New Zealand resident
The Privacy Act 2020 applies. The Unsolicited Electronic Messages Act 2007 does not apply to our communications because we do not send you commercial electronic messages. You may complain to the Office of the Privacy Commissioner of New Zealand.
12. Cookies
The One Hundred website (theonehundred.[TLD]) uses minimal cookies:
- A session cookie during checkout (required for the cart and consent flow).
- A token cookie to remember your schedule-page access token if you tick "remember me" on the schedule page.
- No analytics cookies, no advertising cookies, no third-party tracking cookies on the marketing site.
Gumroad's checkout page (which is part of the purchase flow) sets its own cookies under Gumroad's policies.
13. Children
The One Hundred is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has provided us data, contact us at [BRAND-GMAIL-ADDRESS] and we will delete it.
14. Updates to this policy
We will update this policy from time to time. Because we do not have an email channel to you (see section 7), material changes will be posted on our website at least 14 days before they take effect. The "Last updated" date at the top of this policy will always reflect the most recent revision.
15. Contact
Matt Kerr trading as The One Hundred [POSTAL ADDRESS: Stage 1 sole-trader address] Email: [BRAND-GMAIL-ADDRESS]
This document is a Stage 1 draft. It is not legal advice and has not been reviewed by a qualified lawyer. At Stage 2 flip (NZD $150k revenue), this policy is replaced by a lawyer-reviewed version naming the Wyoming LLC as data controller. See Task #11.