Privacy Policy

1. Who we are

NewsUSA Inc. ("NewsUSA", "we", "us") operates the NewsUSA Media Catalogue (the "Service"), where approved agency partners browse media placements and order them. We are located at 1104 West Broad St. #1024, Falls Church, VA 22046, United States. Questions about this policy go to rsmith@newsusa.com or +1 (703) 508-8700.

2. Information we collect

Information you give us

• Agency application: to be approved for access you tell us your name, job title, company name and website, business email and phone, the type of company, how many active clients you have, whether and how many placements you buy each month, the placement types you are interested in, whether you white-label or resell, how you heard about us, and a referral code if you have one. Our team reviews it and may add internal notes.
• Account details: your name, work email address, phone number with country code, company name (optional) and a password, which we store only as a salted bcrypt hash. Accounts are created from an approved agency application, through an invitation emailed to the business address, so we also keep the invitation and when it was accepted.
• Team and referrals: if you are on an agency team, the team's members and their roles, the team's agreed pricing, and, where a team refers a client or another agency, the referral and any Marketplace Credit earned.
• Orders: the publications and quantities you order, the notes you write for your specialist, any Volume Pricing Code you apply, and the contact details on the order.
• Correspondence: anything you send us by email or through the Service.

Information collected automatically

• Security and usage data: your IP address, browser type, the pages and API calls you make, sign-in attempts and their outcome, and the time of each. We use this to keep accounts safe and to operate rate limits.
• Cookies and browser storage: a signed session cookie (HttpOnly, so no script on the page can read it) keeps you signed in; your cart and a Volume Pricing Code you have typed are kept in browser storage; a "remembered" browse position lets "Back to results" work. We do not run advertising cookies; the only third-party analytics cookie is Google Analytics, below.
• Google Analytics: we use Google Analytics 4 to understand how the catalogue is used - which pages are viewed, what is searched for, and how orders progress. Google sets its own cookies (_ga) and receives your IP address (which Google does not log or store), device details, the pages you visit and the events on them. Where you are signed in, an opaque account number lets us count one person once; no name or email address is sent. You can opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout. See Google's privacy policy for what it collects.
• Cloudflare Turnstile: sign-in, sign-up and password-reset forms include Cloudflare's Turnstile check, which sends limited technical data to Cloudflare to tell people from bots. See Cloudflare's privacy policy for what it collects.
• Publication icons: the catalogue shows each outlet's icon fetched by your browser from DuckDuckGo's icon service (icons.duckduckgo.com), so that service sees the domains of the outlets you view, without a referrer and without anything that identifies you to us.
• "Use my location": only if you press that button on an address form, and only with your browser's permission, your approximate coordinates (rounded to about ten metres) are sent by your browser to OpenStreetMap's Nominatim service to suggest an address. Nothing about your location reaches our servers unless you save the address.
• Address maps: when you type an address, your browser sends it to Nominatim to place a pin on a map, and fetches the map itself from OpenStreetMap's tile server (tile.openstreetmap.org), which sees your IP address and the area shown. The pin's position is saved with the address so we can show it again. See the OpenStreetMap Foundation's privacy policy for what it keeps.
• Marketplace activity: the searches you run and the ones that find nothing, publications you view or save, filters you use, your visits, and any volume pricing request. Where you are signed in it is linked to your account and team, and it helps us decide what to build next.

People who write to us about a listing

If a site owner, publisher or other third party contacts us about an outlet we list, we keep their message, their contact details and what we did about it, so that we can act on the request, show that we did, and make sure a removed outlet is not listed again.

3. How we use it

• To review agency applications, decide who may access the catalogue, set a team's pricing and keep the catalogue available only to approved partners.
• To create and secure your account, verify your email address and sign you in.
• To price, record and fulfil your orders, and to have a NewsUSA specialist confirm availability, timings and the final price with you before anything is booked.
• To send you service emails: verification codes, password-reset links, order confirmations and status updates. We do not send marketing email from the Service without your consent.
• To prevent fraud and abuse, including rate limiting and temporary lockouts after repeated failed attempts.
• To improve the catalogue, for example which filters and placements are used.
• To meet legal obligations and enforce our Terms.

4. Who we share it with

We do not sell or rent your personal information. We share it only as follows:

• Catalogue suppliers. We do not send your personal information to the networks and platforms that supply our catalogue when we refresh it; only an order for a placement leads us to share details, as set out next.
• Media partners and publishers. To fulfil an order, we pass the placement details and the editorial brief to the publication or the media network that supplies it. We do not pass your password or your account's security data. Where a publisher needs a contact for approval, we share the contact details on the order.
• Service providers that host and run the Service under contract with us: cloud and database hosting, Cloudflare (security and Turnstile), an email delivery provider for service messages, and Stripe for card payments. When you pay, your card details go directly to Stripe and are governed by Stripe's privacy policy; we receive only a payment reference, the amount, the card brand and last four digits.
• Legal. When required by law, a court order, or to protect NewsUSA, our customers or the public.
• Business transfers. If NewsUSA is acquired or merges, your information may transfer with it; this policy continues to apply.

5. How long we keep it

6. How we protect it

Traffic between your browser and the Service is encrypted with TLS. Card payments are handled entirely on Stripe's hosted checkout, so card numbers never reach our systems. Passwords are stored as bcrypt hashes and are never visible to staff. Sessions use signed, expiring tokens. Sign-in, sign-up and password reset are protected by Cloudflare Turnstile and by per-address, per-account and per-email attempt limits that lock out repeated failures for escalating periods. Staff access to the internal console requires separate staff accounts. No system is perfectly secure; if you believe your account has been compromised, contact us at once.

7. Your choices and rights

• Approved partners can view and update their name, company, phone number and password from My account at any time.
• If you had an account before access became partner-only and can no longer sign in, your rights are unchanged. Email rsmith@newsusa.com and we will send you a copy of what we hold (including your orders and invoices), correct it, or delete it, within 30 days of verifying who you are. Order records may be kept where the law requires.
• You can ask us to access, correct, export or delete the personal information we hold about you, to restrict or object to its processing, or to withdraw consent, by emailing rsmith@newsusa.com. We respond within 30 days and may ask you to verify your identity first. Order records may be retained where the law requires.
• California residents (CCPA/CPRA): you have the right to know the categories of personal information we collect, to delete it, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising these rights.
• EEA and UK residents (GDPR): we process your data to perform our contract with you, for our legitimate interests in running and securing the Service, and to comply with law. You may lodge a complaint with your supervisory authority.

8. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children.

9. International transfers

We are based in the United States and process data there. If you use the Service from elsewhere, your information is transferred to the United States and protected as described in this policy.

10. Changes

We will post any changes here and update the date above. If a change is material, we will email account holders. Continued use of the Service after a change means you accept the updated policy.

11. Contact

NewsUSA Inc., 1104 West Broad St. #1024, Falls Church, VA 22046, United States. rsmith@newsusa.com, +1 (703) 508-8700.