Effective date: 2026-05-19
Last updated: 2026-05-19

This Privacy Policy describes how The Checklist Compounder (the "Publication"), published by Lavel Tiwana ("we", "us"), handles personal information collected from readers and subscribers. The Publication is hosted on the Substack platform, which also processes personal information independently.

1. What we collect

When you subscribe or interact with the Publication, the following information may be collected by us, by Substack, or by integrated third-party processors:

• Email address — required for delivery of issues and subscription management.

• Optional profile information — a display name or first name if you choose to provide one when commenting or subscribing.

• Subscription status and billing data — tier (Free / Paid / Founding), start date, plan, renewal date. Payment-card information is collected and processed by Stripe; we never see your full card number, only billing metadata.

• Engagement data — issue opens, link clicks, post views, comment activity, like / restack activity. This is collected and aggregated by Substack.

• Technical data — IP address, browser user-agent, device type, referrer URL. Collected by Substack and, if integrated, by Google Analytics or similar analytics providers.

• Communications you send to us — replies to issues, direct emails, comments, Notes, or chat messages.

We do not knowingly collect personal information from anyone under the age of majority in their jurisdiction. If you believe a minor has subscribed, contact us.

2. Why we collect it

• Delivery — sending the issues you subscribed to receive.

• Subscription management — onboarding, renewal, cancellation, paid-tier access control.

• Editorial improvement — understanding which issues land, which links are followed, what topics resonate.

• Compliance — anti-spam, anti-abuse, audit trails, tax / billing records.

• Communication — answering reader questions sent by reply email.

3. Legal bases (for EEA / UK readers, GDPR)

• Contract performance — fulfilling your subscription.

• Legitimate interest — running an editorial business, improving content, securing the service.

• Consent — where you have given consent (e.g., optional analytics, marketing).

• Legal obligation — billing records, anti-abuse, dispute resolution.

You may withdraw consent at any time; doing so will not affect the lawfulness of processing already carried out.

4. Who else receives your information

We share personal information only with third parties that help us deliver the Publication, and only as needed:

• Substack Inc. — the platform that hosts the Publication, sends emails, stores subscription state, and processes engagement data. See substack.com/privacy.

• Stripe — processes payment-card transactions for paid subscriptions. See stripe.com/privacy.

• Google Analytics (if connected) — collects aggregated traffic data via a measurement ID configured in Substack's analytics settings. See policies.google.com.

• Email and reply infrastructure — replies you send arrive at the email address linked to the Publication; we use standard Google / Microsoft email infrastructure to read and respond.

We do not sell your personal information. We do not share your email address or subscription data with advertisers, brokers, or unrelated third parties for their own marketing.

5. Marketing and other communications

You will receive issues of the Publication as you've subscribed. We may occasionally send subscription-related notices (price changes, plan changes, important editorial announcements). You can unsubscribe from the Publication at any time using the unsubscribe link in any issue.

6. Data retention

• Subscription and billing records: kept as long as your subscription is active, plus the period required for tax, accounting, and dispute-resolution purposes (typically seven years under Canadian recordkeeping rules).

• Email engagement logs: retained according to Substack's own retention schedule.

• Replies and direct emails: retained as part of correspondence records; can be deleted on request.

7. Your rights

• Access the personal information we hold about you.

• Correct inaccurate information.

• Delete your data (subject to legal-retention exceptions).

• Restrict or object to certain processing.

• Receive your data in a portable format.

• Withdraw consent at any time.

• Lodge a complaint with a supervisory authority — in Canada, the Office of the Privacy Commissioner of Canada; in the EU, your national data protection authority; in California, the California Attorney General.

To exercise any right, send a request by reply email to any issue of the Publication, or directly to laveltiwana@gmail.com. We will respond within the timeframe required by applicable law.

8. Cookies and similar technologies

The Substack-hosted publication site uses cookies and similar technologies for session management, analytics, and platform functionality. The default Substack cookie behavior applies — see substack.com/privacy. If we connect Google Analytics, GA4 cookies will also be set on the publication site (you can opt out via browser controls or GA opt-out tools).

The Publication does not set third-party advertising cookies.

9. International data transfers

Substack and Stripe are based in the United States and may store and process data in the U.S. and other jurisdictions. By subscribing, you understand that your data may be transferred outside Canada and the EEA. Substack and Stripe use industry-standard safeguards (e.g., standard contractual clauses) for international transfers.

10. Security

We rely on the security practices of Substack, Stripe, and our email-infrastructure providers, all of which use encryption in transit and at rest. No system is fully impenetrable; in the event of a material data breach involving the Publication, we will notify affected subscribers as required by applicable law.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be announced in an issue of the Publication or by email. Continued subscription after a change constitutes acceptance of the updated Policy.

12. Contact

Privacy questions, data-rights requests, and complaints can be sent by reply email to any issue of the Publication, or directly to laveltiwana@gmail.com.

The Checklist Compounder is an independent editorial publication. It is not affiliated with, endorsed by, or representative of Anzar Group, eXp Realty, any brokerage, any registered dealer, any exchange, or any issuer mentioned.