Privacy notice

Who we are

Pressmerit is a trading name of Miraspaces OÜ, a private limited company incorporated in Estonia on 11 November 2024 and entered in the Estonian Commercial Register (Äriregister), kept by the Registration Department of Tartu County Court, under registry code 17111689. Its registered address is Katusepapi tn 6-502, Lasnamäe linnaosa, Tallinn, Harju maakond, 11412, Estonia, and the register entry is public at ariregister.rik.ee. Miraspaces OÜ is not currently registered for VAT in Estonia, so no VAT identification number is stated.

For the personal data described below, Miraspaces OÜ is the controller. Data protection questions, and any request to exercise the rights set out at the end of this notice, go to privacy@pressmerit.com or to the registered address above. We have not appointed a data protection officer: the processing described here does not meet the criteria in Article 37(1) GDPR, and we say so rather than leaving the question open.

Roles: where we are the controller and where we are not

We are the controller for account data, for the business-contact data described below, and for the operational records the platform keeps about its own use.

We are not a party to what a subscriber sends. Outreach leaves the subscriber’s own mailbox, addressed by them, and the duties that attach to a sender attach to them: identifying themselves accurately, honouring an opt-out, and complying with the marketing and electronic-communications rules of the recipient’s country. Section 4 of the terms of service states that division, and the platform enforces the part it can.

Data we process

Four categories, kept separate from one another.

• Account data for subscribers: name, work email address, password credentials, the websites added to the account, notification preferences, and the billing identifiers held on our behalf by Stripe. We do not receive or store full card numbers.
• Business-contact data for publishers and site owners: a work email address, the website it belongs to and, where the source published them, a name and a role or department. Never a personal address, never special-category data, and never a profile assembled about an individual.
• Operational records: which contact was disclosed to which subscriber and when, which requests were prepared and marked as sent, what the two sides agreed, and the results of the link verification checks that follow.
• Technical records: server and application logs containing IP address, user agent, timestamp and the request path, produced by our hosting provider and used for security, abuse investigation and debugging.

Where business-contact data comes from, and the notice you are owed for it

This section is the Article 14 GDPR disclosure: the one that applies when personal data was not obtained from you.

A work address reaches the platform in one of two ways. Either our crawler read it from a public page on the site it belongs to, typically a contact, about or masthead page, or it came from a licensed business-contact data provider. The category is always the same, a work address in a business capacity, and the purpose is always the same, contacting the site about a collaboration on that site.

The first message a recipient receives carries this notice in its footer, together with the link that removes the address. That is deliberate: Article 14 asks for the information to reach the person within a reasonable period and at the latest at the first communication, and the first communication is the only one we can be certain of.

Legal bases

For business-contact data the basis is legitimate interest under Article 6(1)(f) GDPR: contacting a site in a business capacity, about work it has already published, regarding a collaboration on that same site. That basis obliges us to weigh our interest against the interests and rights of the person, and a legitimate interests assessment records the weighing.

The outcome of that assessment is visible in the product rather than only on paper. The scope is business to business, no consumer data is collected, no profile is built about a recipient, contact frequency is capped at platform level rather than left to a subscriber’s judgment, and the objection route needs no account and no explanation. Those caps are described in the next section, because a limit nobody can see is not a safeguard.

Account data is processed to perform the contract with the account holder under Article 6(1)(b), and to meet accounting and tax obligations under Article 6(1)(c). Technical records rest on legitimate interest in keeping the service secure and available. Marketing to account holders, where it requires consent, is asked for separately and can be withdrawn without affecting the service.

A copy of the legitimate interests assessment is available on request to privacy@pressmerit.com.

The limits that make the balance hold

These are enforced by the platform rather than promised by it, and they are stated because the legitimate-interest balance depends on them.

• A given contact can be disclosed once in any 30 days, across all subscribers, not once per subscriber.
• A subscriber may reveal at most 25 contacts a day, whatever their credit balance.
• One open request per site at a time across the whole platform, and one active request per subscriber and site, with a 60-day cooldown after a decline.
• Two follow-up reminders at most. They are reminders to the subscriber to write again, not messages we send.
• A request that goes unanswered expires after 21 days and cannot be reopened against the same site without the cooldown above.
• A site that has no reachable contact is recorded as such for 90 days so that nobody pays to look again, and so that nobody looks again.

Disclosure of contact data to subscribers

Revealing a verified work contact to a subscriber is a processing purpose in its own right rather than a side effect of something else, and it is named separately because it is the part a publisher most needs to see stated plainly.

A contact is disclosed to the single subscriber who requested it, for a named site of their own, together with the provenance of the address and a confidence score. It is not published, not sold, not shared with other subscribers, and not assembled into a directory anyone can browse. The platform has no export, no bulk lookup and no contact-search endpoint, which is a product decision taken for this reason.

A subscriber who receives a contact takes on the obligations of a sender, set out in section 4 of the terms of service. Using a disclosed contact for anything other than the collaboration it was disclosed for, or moving it into a separate list, ends the account.

The do-not-contact list, and your right to object

Any address can be suppressed across the whole platform, with no account and no reason given, at pressmerit.com/why-this-email. That form is an objection under Article 21 GDPR and is handled as one, directly and without an email exchange to reach it.

A suppressed address is dropped from search results, cannot be disclosed to any subscriber, and is not written to again by anyone using Pressmerit. Suppression keeps a minimal record of the address for one purpose: recognising it if it appears in a data set we license later. Deleting that record outright would defeat what it exists for, so erasure is a separate request.

Erasure requests go to privacy@pressmerit.com and are honoured. Where an address is erased rather than suppressed, it can be collected again from a public page in future, at which point you can object again.

Retention

Each category has a defined period and none of them is open-ended.

Subprocessors

Published as a table so it can be checked rather than requested. Each is engaged under a data processing agreement, and each is bound to process only on our instructions.

We update this table before a new subprocessor begins processing, not after.

International transfers

Several subprocessors above are established outside the European Economic Area, chiefly in the United States. Transfers to them rest on the European Commission’s standard contractual clauses concluded with each provider, together with the supplementary measures the provider documents, and, where the provider is certified, on the EU-US Data Privacy Framework.

A copy of the transfer mechanism relied on for a particular provider is available on request to privacy@pressmerit.com.

Security

Data in transit is encrypted with TLS and data at rest is encrypted by our hosting and database providers. Access to production data is limited to the people who need it to run the service, over authenticated connections, and is logged.

Passwords are stored hashed and are never recoverable in plain text, by us or by anyone else. We do not hold card numbers at any point; Stripe does.

If a personal data breach occurs and is likely to result in a risk to your rights, we notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of it, and we notify affected people directly where the risk is high.

Your rights, and how to complain

You have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable form where the processing rests on consent or contract. The objection right is the one the opt-out form implements directly.

Requests go to privacy@pressmerit.com. We answer within one month, and where a request is complex we may extend that by two further months, telling you why within the first month. We ask for enough information to be sure the request comes from the person it concerns, and no more; we do not require an identity document for a request about an email address that can be verified by replying from it.

If you are unhappy with how we handled a request, you can complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, at aki.ee, or to the supervisory authority of the EU country where you live or work. We would rather hear from you first, and the address above reaches a person.

Children

Pressmerit is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child’s data has reached us, write to privacy@pressmerit.com and it will be deleted.

Changes to this notice

When this notice changes materially, account holders are notified by email before the change takes effect, and the change is described rather than merely announced. Corrections that do not change what we do with data, such as fixing a broken link, are made without notice.

Pressmerit is provided from an establishment in Estonia, and Estonian law governs the service and these documents. That follows the country-of-origin principle in Article 3 of Directive 2000/31/EC on electronic commerce, transposed in Estonia by § 3(1) of the Infoühiskonna teenuse seadus. Two areas sit outside that principle and are unaffected by it: consumer contracts, where the mandatory rules of your country of residence continue to protect you, and data protection, where the GDPR applies directly across the Union.