Privacy Policy

Contents

This is the table of contents for the policy, so you can jump straight to the section you care about. It runs from who we are, what information we collect and how we use it, through who we share it with and which third-party services are involved, then on to cookies, data retention, international transfers, your rights and data security.

1. Who we are
2. What information we collect
3. How we use your information
4. Who we share it with
5. Third-party services
6. Cookies and tracking
7. Data retention
8. International data transfers
9. Your rights (GDPR, UK GDPR, CCPA)
10. Data security
11. Children's privacy
12. Changes to this policy
13. Contact us

1. Who we are

This privacy policy applies to the website danhnolan.com and all subdomains, the WordPress plugin Danh Nolan Outline DLN, and related services operated by Danh Nolan (the "Company", "we", "us", "our").

2. What information we collect

2.1 Information you provide directly

This is the data you hand over yourself, as opposed to anything collected in the background. Topic text is the first item: when you use the outline generator, the topic you type is processed to produce your outline. Purchase email is the second: when you buy a PDF or subscribe, you give an email address to Lemon Squeezy, our payment processor.

• Topic text: when you use the outline generator tool, the topic you type is processed to produce your outline.
• Purchase email: when you buy a PDF or subscribe, you provide an email address to Lemon Squeezy (our payment processor) to receive your receipt and download link.
• Support correspondence: emails you send to contact@danhnolan.com for support or inquiries.

2.2 Information collected automatically

This is what the service records without you typing anything. The visitor cookie UID is a random UUIDv4 stored in a cookie named dnl_og_uid, valid for 1 year, used only to count your free-tier usage across browser sessions, and it contains no personal information. Your IP address is the second item recorded automatically.

• Visitor cookie UID: a random UUIDv4 stored in a cookie named dnl_og_uid, valid for 1 year. Used only to count your free-tier usage across browser sessions. Contains no personal information.
• IP address: your IP is recorded against your UID for rate-limiting and abuse prevention. Stored only as long as the UID record exists.
• User-agent string: your browser identification, stored alongside the UID record for diagnostics.
• Usage counters: how many outlines you have generated, used to enforce the free quota.

2.3 Information from third parties

Only one third party sends us information about you, and only after a payment. When you complete a purchase, Lemon Squeezy notifies us through a webhook carrying your order ID, your paid status, and the email address you gave them. Nothing else reaches us from outside, and nothing arrives unless you have actually bought something.

• Payment confirmation from Lemon Squeezy: when you complete a purchase, Lemon Squeezy notifies us via webhook with your order ID, paid status, and the email you provided to them.

3. How we use your information

This table pairs every purpose with the exact data used and the legal basis under GDPR. Running the outline generator uses your topic text and industry selection, on the basis of performance of contract. Enforcing the free-tier quota uses the cookie UID and usage counter, on the basis of legitimate interest in preventing abuse. Rate-limiting is the third purpose listed.

4. Who we share your information with

We do not sell, rent, or trade your personal information. We share data with a small number of vetted service providers strictly to deliver the service you requested:

• Anthropic, PBC: when our AI fallback runs (only for industries not yet in our template library), we send your topic text and the list of existing industry slugs to Anthropic's Claude API for processing. Anthropic processes this data per its own privacy policy and does not retain it for model training.
• Lemon Squeezy, Inc.: handles all payment processing as our Merchant of Record. They collect your billing details, payment method, and email directly on their hosted checkout page. We never see your full card number. See Lemon Squeezy's privacy policy.
• Hosting provider: our website and plugin services are hosted on commercial infrastructure providers (cloud servers). Standard server logs may include IP addresses for security purposes.

We may also disclose information if required by law, court order, or to protect the rights, property, or safety of Danh Nolan, our users, or others.

5. Third-party services, what they receive

This table names each third-party service, the data we send it, why we send it, and where to read their own privacy policy. The Anthropic Claude API receives your topic text, a list of industry slugs and labels, and the output language, and it is used to generate outline templates for industries not yet in our library.

6. Cookies and tracking

We use exactly one first-party cookie, and nothing else tracks you here. It is named dnl_og_uid, classed as essential or functional because it is required for free-tier quota tracking, and it lasts 1 year. Its value is a randomly generated UUIDv4, which contains no personal information. One cookie, one purpose, no advertising trackers.

We use a single first-party cookie:

• Name: dnl_og_uid
• Type: Essential / functional (required for free-tier quota tracking)
• Lifetime: 1 year
• Value: A randomly generated UUIDv4. Contains no personal information.
• SameSite: Lax. Secure: set when site is served over HTTPS.

We do not use Google Analytics, Facebook Pixel, or any other third-party tracking script on the outline generator tool. The marketing pages of danhnolan.com may use standard analytics, see the cookie banner there.

If you delete the dnl_og_uid cookie, your free quota resets, but our IP-level rate limit still applies to prevent abuse.

7. Data retention

This table sets out how long each category of data is kept before it goes. The cookie UID and usage counter are held for 1 year after your last activity, then purged automatically. Purchase records, meaning order ID, paid amount and paid_until, are retained for accounting and tax purposes for a legally required minimum period.

8. International data transfers

Danh Nolan is based in Vietnam. Our third-party processors (Anthropic, Lemon Squeezy) are located in the United States. Data sent to them is transferred internationally under:

• The respective processor's own data transfer mechanisms (Standard Contractual Clauses, Data Processing Agreements);
• Your consent when you choose to use a paid feature or AI fallback.

If you are located in the EU, UK, or other jurisdictions with data protection laws, we comply with the transfer rules of those jurisdictions to the extent required.

9. Your rights

9.1 General rights (all users)

These rights apply to every user, regardless of where you live. Access lets you request a copy of the data we hold about you. Rectification lets you correct inaccurate information. Erasure lets you request deletion of your data. Portability lets you receive your data in a machine-readable format. Restriction is the fifth right listed.

• Access: request a copy of the data we hold about you
• Rectification: correct inaccurate information
• Erasure: request deletion of your data
• Portability: receive your data in a machine-readable format
• Restriction: limit how we use your data
• Objection: object to processing based on legitimate interest

9.2 EU / UK GDPR specific rights

If you are in the European Economic Area or the United Kingdom, you have the rights above plus the right to lodge a complaint with your local data protection authority. We do not have a designated EU representative because we process EU personal data only in limited circumstances and on a small scale.

9.3 California (CCPA / CPRA) specific rights

California residents get a further set of rights on top of the general ones. You have the right to know what personal information we collect and how we use it, which is what this policy sets out. You have the right to request deletion of your personal information. And you have the right to opt out of any sale or sharing of it.

If you are a California resident, you have the right to:

• Know what personal information we collect and how we use it (this policy)
• Request deletion of your personal information
• Opt out of the "sale" or "sharing" of personal information, we do not sell or share personal information for advertising
• Non-discrimination for exercising your rights

9.4 How to exercise your rights

Email contact@danhnolan.com with your request. To prevent unauthorised access, we may ask you to verify your identity (for example, by sending the request from the same email used for purchase). We respond within 30 days as required by GDPR.

10. Data security

We implement reasonable technical and organisational measures to protect your information:

• All data transmitted over HTTPS (TLS 1.2+)
• Webhook authentication via HMAC-SHA256 signature verification
• API keys stored encrypted at rest in the WordPress database
• Capability-based access control on all admin functions
• Nonce-based CSRF protection on all state-changing actions
• Rate-limiting on public endpoints to prevent abuse

No system is ever 100% secure. If you become aware of any security issue, please contact us immediately.

11. Children's privacy

Our services are not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Changes to this policy

We may update this privacy policy from time to time. When we do, we update the "Last updated" date at the top. For material changes, we will provide additional notice (for example, a banner on the site or an email to recent purchasers). Continued use of our services after a change indicates acceptance of the updated policy.

13. Contact us

This section tells you where to send any privacy-related question or request. You can reach us by email, through the website, or by post at our address in Ho Chi Minh City, Vietnam. The policy itself is published under CC BY 4.0, so you are free to adapt it for your own project.

For any privacy-related questions or requests:

• Email: contact@danhnolan.com
• Website: https://danhnolan.com/en/contact/
• Postal: Danh Nolan, Ho Chi Minh City, Vietnam

© 2026 Danh Nolan. This privacy policy is made available under CC BY 4.0, feel free to adapt it for your own project.