Privacy Policy

You agree to the privacy policy below, and the Privacy Policy for Substack, the technology provider.

Tzveta Iordanova - Privacy Policy

Custom publication privacy notice

Effective date: 18 August 2026

Publication Tzveta Iordanova

Publisher / trader Tzveta Iordanova, trading as Alpha Combinator (sole proprietorship)

Country The Netherlands

KVK number 74507761

Visiting address Shielded in the Dutch Business Register

Contact contact@tzvetaiordanova.com | +31 6 2421 7804

Scope

This Privacy Policy explains how Tzveta Iordanova, trading as Alpha Combinator, handles personal data in connection with this publication. Substack also processes personal data for its own platform purposes under its separate Privacy Policy.

1. Who is responsible for your personal data?

For personal data processed for the purposes of the Tzveta Iordanova publication and its subscriber relationship, the data controller is Tzveta Iordanova, trading as Alpha Combinator, a sole proprietorship registered in the Netherlands under KVK number 74507761.

Contact: contact@tzvetaiordanova.com | +31 6 2421 7804. The visiting address is shielded in the Dutch Business Register.

Because the Publication is operated on Substack, responsibility is divided depending on the processing activity. The Publisher is the controller of the subscriber relationship and subscriber list. Substack may act as a processor when it handles personal data on the Publisher’s instructions, and may act as an independent controller for its own platform purposes.

2. What this Privacy Policy covers

This Privacy Policy covers personal data the Publisher processes in connection with subscriptions, paid access, publication communications, community participation, support, moderation, and administration of the Publication.

It does not govern personal data that Substack processes independently for Substack’s own purposes, such as account administration, platform security, recommendations, or other platform-wide functions. For those activities, review Substack’s Privacy Policy.

3. Personal data the Publisher may process

The Publisher currently uses Substack as the publication and subscriber-management platform and does not maintain a separate off-platform subscriber CRM or mailing list.

• Identity and contact data: name, email address, Substack username, and profile information that you provide or that Substack makes available to the Publisher.

• Subscription data: whether you are a free, paid, founding, trial, gifted, cancelled, or former subscriber; subscription dates; plan information; status changes; and similar subscription-management information.

• Payment and transaction metadata: information needed to identify and administer a paid subscription, payment, cancellation, refund, or charge issue. The Publisher does not receive your full payment-card number.

• Engagement and publication analytics: information Substack makes available about engagement with the Publication, which may include delivery, opens, clicks, page views, referrals, subscriber counts, reactions, or similar publication-performance information.

• Community and contribution data: comments, likes, restacks, chat messages, poll or survey responses, reports, media attachments, or other material you submit through Publication features that are enabled.

• Communications: emails, support requests, complaints, privacy requests, refund requests, and other messages you send to the Publisher.

• Administrative and compliance data: records reasonably needed for tax, accounting, fraud prevention, legal claims, or compliance obligations.

The exact data available to the Publisher depends on the Substack features you use and the information you choose to provide.

4. Special-category and sensitive information

The Publication discusses health, medicine, oncology, longevity, science, and related topics, but the Publisher does not ask subscribers to provide medical records, diagnoses, genetic information, biometric data, or other special-category personal data in order to subscribe.

Please do not submit confidential medical records, detailed health histories, identification documents, or other highly sensitive personal information through comments, chat, or ordinary email unless it is genuinely necessary and you understand the privacy implications.

If a reader voluntarily discloses sensitive information in a public or community feature, that information may become visible to others according to the feature’s settings and Substack’s functionality.

5. Why personal data is used and the legal bases

5.1 Delivering free subscriptions

When you voluntarily subscribe to receive the Publication for free, your email address and related subscription data are used to send the content and communications you requested. The legal basis is your request and, where legally required for electronic communications, your consent. You may unsubscribe at any time.

5.2 Paid subscriptions and contract administration

For paid subscriptions, personal data is processed as necessary to enter into and perform the subscription contract, provide paid access, administer billing status, handle cancellations and refunds, and respond to subscription-related requests.

5.3 Community features and moderation

If comments, chat, polls, surveys, reports, or other community functions are enabled, related data is processed to provide those features, moderate discussions, prevent abuse, enforce rules, and protect readers and the Publication. Depending on the activity, the legal basis may be performance of the requested service, compliance with legal obligations, or the Publisher’s legitimate interests in operating a safe and useful community.

5.4 Publication analytics and improvement

The Publisher may use publication-level engagement and analytics information supplied by Substack to understand how the Publication is used, improve editorial decisions, assess subscription performance, and maintain the service. The legal basis is the Publisher’s legitimate interest in operating and improving the Publication, except where applicable law requires consent for a specific tracking technology.

5.5 Support, complaints and legal compliance

Personal data may be used to answer messages, handle complaints and privacy requests, prevent fraud or misuse, maintain business records, comply with legal obligations, and establish, exercise, or defend legal claims. The legal bases may include contractual necessity, legal obligation, and legitimate interests.

5.6 Future books, tools and services

The Publisher may develop or offer books, tools, services, ventures, or other products in the future. References to those offerings may appear within the Publication. Separate direct marketing outside the scope of the subscription will only use personal data where permitted by law and, where required, with consent.

The Publisher does not sell subscriber personal data and does not provide subscriber personal data to advertisers for their independent direct marketing.

6. Substack and payment processing

Substack provides the hosting, email distribution, subscription management, community tools, analytics, and related infrastructure used by the Publication. When Substack processes personal data on the Publisher’s behalf, it does so under the applicable Publisher Agreement and data-processing terms.

For paid subscriptions, payment information is processed through the payment arrangements supported by Substack, including its payment processor or, where relevant, an app-store provider. The Publisher generally receives subscription and transaction information needed to administer the relationship, not full payment-card details.

Substack and payment providers may also process information for their own legal, security, fraud-prevention, payment, or platform purposes under their own privacy notices.

7. Cookies, analytics and tracking technologies

As of the effective date of this Privacy Policy, the Publisher has not added a separate Google Analytics measurement ID, Google Tag Manager, Meta/Facebook Pixel, X/Twitter Pixel, Parse.ly Pixel, or another publisher-controlled third-party advertising or analytics tracker to the Publication.

Substack may use cookies, pixels, local storage, or similar technologies as part of operating its platform. Those technologies and the choices available to you are described in Substack’s own Privacy Policy and cookie controls.

If the Publisher later adds a separate analytics, advertising, survey, scheduling, CRM, or similar service that receives subscriber or visitor data, this Privacy Policy will be updated and consent will be requested where required by applicable law.

8. Who receives personal data?

Personal data may be disclosed only as reasonably necessary to:

• Substack and its authorized subprocessors when they provide the Publication platform and process data on the Publisher’s behalf.

• Payment processors or app-store providers involved in a paid subscription, to the extent necessary to process or administer the transaction.

• Public authorities, courts, regulators, law-enforcement bodies, or professional advisers where disclosure is required by law or reasonably necessary to establish, exercise, or defend legal rights.

• A successor or purchaser in connection with a genuine business transfer, subject to applicable data-protection requirements.

The Publisher does not sell subscriber personal data and does not share it with third parties for cross-context behavioural advertising or their independent advertising lists.

9. International data transfers

The Publisher is established in the Netherlands, but Substack is established in the United States and may use service providers in other countries. As a result, personal data processed through the Publication may be transferred outside the European Economic Area.

Under Substack’s current Publisher Agreement, transfers processed by Substack on behalf of EEA-based creators are covered by Substack’s data-processing terms, which refer to the EU-U.S. Data Privacy Framework where applicable and Standard Contractual Clauses as safeguards for certain other transfers.

Transfer mechanisms and subprocessors can change. For current information, review Substack’s Publisher Agreement and Privacy Policy.

10. How long personal data is kept

Personal data is kept only for as long as reasonably necessary for the purpose for which it is processed, unless a longer period is required by law.

• Active subscriber data is generally kept for the duration of the subscription relationship and as needed to operate the Publication.

• After you unsubscribe, your address is removed from active Publication email distribution. Limited records may remain where necessary to document subscription history, opt-out status, disputes, fraud prevention, or legal compliance.

• Transaction, invoice, refund, and accounting information that forms part of the Publisher’s mandatory business administration may be kept for at least 7 years, or longer where a specific tax rule requires it.

• Comments, chat messages, reports, and other contributions may remain for as long as the relevant discussion or Publication feature remains available, unless removed under applicable platform functionality, moderation rules, or a valid legal request.

• Privacy requests, complaints, and legal correspondence may be retained for as long as reasonably necessary to handle the matter and demonstrate compliance or protect legal rights.

Substack may retain information for different periods when it acts as an independent controller. Its retention practices are described in its own Privacy Policy.

11. Your privacy rights

If the GDPR applies to you, you may have the right to:

• receive information about the processing of your personal data;

• request access to your personal data;

• request correction of inaccurate or incomplete personal data;

• request deletion of personal data where the legal conditions are met;

• request restriction of processing in certain circumstances;

• object to processing based on legitimate interests in certain circumstances;

• receive or transmit certain personal data in a portable format where the data-portability right applies; and

• withdraw consent at any time where processing is based on consent, without affecting processing already carried out lawfully before withdrawal.

To exercise a right relating to the Publisher’s processing, contact contact@tzvetaiordanova.com. The Publisher may need to verify your identity and may ask for information necessary to locate the relevant data.

Requests will be handled within the time required by applicable law. Under the GDPR, this is normally within one month, subject to lawful extensions for complex or multiple requests.

Some requests may be limited or refused where an exception applies, for example where data must be retained to comply with a legal obligation or to establish, exercise, or defend legal claims.

12. Unsubscribing from publication emails

You can stop Publication emails by using the unsubscribe link or communication controls provided by Substack. Cancelling a paid subscription and unsubscribing from free emails are separate actions and may need to be completed separately through your Substack settings.

The Publisher may retain a minimal suppression or opt-out record where necessary to respect your request not to receive further emails.

13. Security

The Publisher limits subscriber-data handling to what is needed for the Publication and currently relies primarily on Substack’s platform rather than maintaining a separate subscriber database.

Reasonable organizational and technical measures are used to protect personal data, but no online service, email system, or storage environment can be guaranteed to be completely secure.

You are responsible for protecting your own Substack account credentials and for considering whether information you post in public or community features is appropriate to make visible to other users.

14. Children

The Publication is intended for people aged 16 or older. The Publisher does not knowingly seek to collect subscriber personal data from children under 16. If you believe a child under 16 has provided personal data to the Publication, contact the Publisher so the issue can be reviewed.

15. Automated decision-making

The Publisher does not use subscriber personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on an individual.

Substack may use automated systems for its own platform functions, safety, recommendations, or content analysis. Those activities are governed by Substack’s own terms and privacy disclosures.

16. Public content and reader contributions

If you post a public comment, profile information, restack, chat contribution, or other material in a feature visible to others, that information can be viewed, copied, quoted, indexed, or shared by other users depending on the feature and your settings.

Do not post another person’s personal data unless you have a lawful basis and the right to do so. If you ask the Publisher to remove personal data from Publication content, the request will be considered under applicable law, including any relevant freedom-of-expression or journalistic considerations.

17. Rights in other jurisdictions

Readers outside the EEA may have privacy rights under the law of their state or country. The Publisher will honor additional rights where they legally apply. You may contact the Publisher using the details below to make a request.

The Publisher does not currently sell subscriber personal data. If applicable law uses a broader definition of “sale” or “sharing,” requests will be assessed under the law that applies to the relevant person and processing activity.

18. Complaints to the Dutch Data Protection Authority

If you are not satisfied with how a privacy matter is handled, you have the right to lodge a complaint with a competent data-protection authority where applicable. In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

Autoriteit Persoonsgegevens: https://autoriteitpersoonsgegevens.nl/en

19. Changes to this Privacy Policy

This Privacy Policy may be updated when the Publication’s features, service providers, commercial activities, data practices, platform arrangements, or legal obligations change. The current version will show an updated date.

If a change materially affects how existing subscriber personal data is used, additional notice or consent will be provided where required by law.

20. Contact

Data controller: Tzveta Iordanova, trading as Alpha Combinator

Publication: Tzveta Iordanova

KVK number: 74507761

Country: The Netherlands

Visiting address: shielded in the Dutch Business Register

Email: contact@tzvetaiordanova.com

Telephone: +31 6 2421 7804

Nth Order Insights