PUBLISHER PRIVACY POLICY

Last updated: September 16, 2026

1) Publisher, succession, and scope

This Policy describes how PAG PROJECT, a Florida limited liability company (Florida document L26000442232) (“PAG,” “we,” “us”), handles personal information it receives or controls for the Private Attorney General Project / PAG Project publication, pagproject.com, newsletters, comments, Chat, Notes, and official social, podcast and community channels.

Operator update. Effective August 21, 2026, the Florida company acquired the publication assets and associated subscriber information from PAG PROJECT LLC, a separate Texas company, through an assignment and contribution. The author remains Jeremy Roseberry. The successor continues the privacy commitments applicable to information when collected. This update does not authorize new uses, a sale of subscriber information, or retroactive expansion of sharing.

Platform privacy. Substack and other platforms have their own policies for processing they control. This Policy covers PAG’s processing; it does not replace their policies.

Privacy requests: contact@pagproject.com. Formal notices: PAG PROJECT, c/o Registered Agents Inc., 7901 4th St N, Suite 300, St. Petersburg, FL 33702 (registered-agent address, not an editorial office). Email is preferred for prompt handling.

We do not sell personal information for money. Where applicable law requires consent, opt-outs, recognized universal opt-out signals, or other safeguards for data processing, we will comply. This revision does not introduce targeted advertising or new data uses.

2) Journalism and freedom of expression

We gather, analyze, retain and publish material for journalism, commentary, petitioning and public-interest documentation. Applicable constitutional protections and statutory journalistic, expressive or public-information exceptions may limit particular privacy obligations. Their scope depends on the law and facts; being a publisher does not create a blanket exemption for all information or all processing.

We preserve lawful reporting, source protection, archives and legal-defense records while applying the privacy duties that govern them. This Policy does not promise removal of accurate public-interest reporting on request, and it does not authorize unlawful disclosure. Subscriber and operational data remain subject to the commitments in this Policy.

3) Information we collect

• You provide: name, email; messages and user content you submit (comments, posts, uploads, DMs); forms you complete (tips, support); referral details when you invite others.

• Automatically (Sites & Publication): IP address, device/browser info, pages viewed, timestamps, referral/UTM data, coarse location inferred from IP, and cookie/SDK events via analytics (e.g., Google Analytics 4) or Substack metrics.

• Platform/social data: When you interact on Substack (Chat, Notes, comments, payments) or on our social pages, Discord, or podcast platforms, those services may share limited analytics, engagement, or account metadata with us under their terms.

• Payments/contributions (if enabled): If you contribute funds or buy paid access, payment processors (e.g., Substack/Stripe) collect payment details; we do not store full card numbers.

• Sensitive data: We do not seek sensitive personal data and ask that you not submit it. We will not sell sensitive data without consent where required by law. (Tipsters/sources: see Section 13.)

4) How we use information

We use information for any of the following purposes, and for any other purpose disclosed at collection or reasonably compatible with these purposes:

• Operate, secure, and improve the Sites & Channels (including moderation, anti-abuse, spam prevention, and debugging);

• Communications: send newsletters and updates you request and transactional messages (receipts, account notices);

• Analytics and measurement: measure reach and performance and improve features and content;

• Community & growth features: run referrals, recommendations, attribution, and discovery within Substack’s ecosystem;

• Develop new and existing products, services, features, and offerings, and conduct internal research and analysis;

• Journalistic, editorial, expressive, archival, and public-interest purposes, including reporting, commentary, petitioning, fact-checking, source verification, and maintaining our archives;

• Establish, exercise, and defend legal claims, and protect our rights, our sources, our personnel, and the public;

• Enforcement & compliance: enforce our Terms, comply with legal obligations, and respond to lawful requests.

Aggregated and de-identified data. We may create and use aggregated, anonymized, or de-identified data — which is not personal information — for any lawful purpose without restriction, including research, analytics, benchmarking, product development, training and improving analytical systems, and publication, and we may retain and share such data indefinitely. We will maintain de-identified data as de-identified and not attempt to re-identify it except to test our de-identification.

Notice and consent. This Policy describes our practices; it is not a substitute for legally required consent. We obtain consent where required and honor applicable withdrawal and objection rights.

5) Legal bases / lawful grounds (where applicable)

• Contract (to provide requested services);

• Legitimate interests (security, analytics, fraud/abuse prevention, service improvement, and journalism/public-interest documentation);

• Consent (newsletters and certain cookies/analytics);

• Freedom of expression and information (journalistic and expressive processing, including under GDPR Art. 85 and analogous exemptions where applicable);

• Legal obligations (records/tax compliance and lawful requests).

6) Cookies, ads & analytics; your choices

We use cookies/SDKs for essential functions and Google Analytics 4 for analytics; Substack also performs its own analytics and email instrumentation. If we ever run targeted advertising, that may constitute “sharing” under some state laws, and we will present “Your Privacy Choices / Do Not Sell or Share” controls and honor GPC and other recognized universal opt-out signals where required.

Your controls:

• Use any cookie banner/controls we provide to disable non-essential cookies/analytics;

• Enable GPC in your browser to send a universal opt-out signal we honor where required;

• Unsubscribe from emails using the link in any message;

• Configure your browser to block or clear cookies.

7) Privacy rights where applicable

Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of personal information, object to processing, or opt out of specified advertising, sales or profiling. We honor rights and deadlines where required, subject to lawful exceptions for journalism, expression, legal claims and other purposes. State laws, including Florida or Texas privacy laws, apply according to their scope and thresholds, not simply the publisher’s formation state.

Email contact@pagproject.com with the subject Privacy Request and describe your request. We may reasonably verify identity. Where an appeal right applies, reply Appeal and we will explain the available process and regulator contact. EU/UK rights and expression-related exemptions apply where the relevant law governs our processing. You may contact the competent supervisory authority where applicable.

We do not use personal data for automated decisions producing legal or similarly significant effects about you.

8) Sharing with service providers & transfers

We share personal information with service providers under contracts limiting their use to our instructions (hosting/CDN, email/newsletter tools, analytics, community platforms, anti-abuse/security providers, and, if enabled, payment processors). We may also disclose information to comply with law, to respond to lawful requests, to protect rights, safety, our sources, or the public, to enforce our Terms, or in connection with a corporate transaction (e.g., merger, financing, reorganization, or asset transfer), in which case we will continue to honor the commitments applicable when the information was collected and provide notice and obtain consent where required before any materially inconsistent use.

We are U.S.-based. Data may be processed in the U.S. or other countries by our providers, with appropriate safeguards.

9) Data retention

• Accounts & user content: retained until you request deletion or we remove it under our moderation policies; minimal residual copies may persist in backups for a limited period.

• Email lists: retained until you unsubscribe or your address bounces.

• Logs/analytics: retained up to 24 months, then aggregated or deleted.

• Payment/transaction records (if enabled): retained 7 years for tax/recordkeeping.

• Journalistic, source, and archival materials: retained indefinitely as part of our reporting record and archives, consistent with Section 2.

• We may retain any data longer when necessary for legal, security, fraud-prevention, abuse-prevention, or public-interest reasons.

10) Security & breach notification

We use reasonable technical and organizational measures (HTTPS, access controls, and provider encryption at rest where supported). No system is 100% secure. Where a security incident affects personal information, we will notify affected individuals and authorities as and to the extent required by applicable law, including the Florida Information Protection Act (Fla. Stat. § 501.171) and other breach-notification laws.

11) Children

The Sites & Channels are not directed to persons under 16, and we do not knowingly collect data from persons under 16. We do not sell the personal data of a known minor or the precise geolocation of a child without consent where required. If you believe a child provided data, contact us and we will delete it.

12) Community spaces & public posting

Community posts, comments, Chat, and voice/text channels may be public or visible to other members. Moderators may review reported content for safety and compliance. Do not post sensitive personal data. Content you make public may be seen, copied, and re-shared by others, and we may quote, retain, or describe it consistent with Section 2 and our Terms.

13) Source submissions / tipline

Unsolicited tips or documents you send are non-confidential unless we expressly agree otherwise in a signed writing. Do not send materials you are not legally permitted to share or that were illegally obtained. You represent you have the right to share what you send. We may publish, investigate, summarize, archive, or decline to act on any submission. Where legally permitted, we may notify you of legal requests for your data; we require lawful process to disclose records and will assert reporter’s privilege and other defenses when applicable.

14) Corrections and content concerns

Send accuracy, defamation or other non-copyright concerns to Review@pagproject.com. Please identify the URL, precise statement and supporting information. Our Terms, Section 11, and Legal & Disclaimers explain editorial review and applicable statutory notice rights. Our preferred submission details do not add statutory conditions or displace valid service. For copyright concerns, see Terms Section 9 and Substack’s Copyright Dispute Policy.

15) Applicable law and rights

Our publisher Terms describe Florida governing law and dispute provisions for persons who validly agree to them, subject to mandatory law. This Privacy Policy is a description of data practices, not an independent agreement to arbitration or waiver of privacy rights. It does not limit rights to contact regulators, exercise non-waivable rights, or invoke applicable data-protection law.

16) Changes and contact

We date updates and provide reasonably prominent notice of material changes. We continue to honor privacy commitments made when information was collected. Before using previously collected personal information in a materially inconsistent way, we will obtain consent where required; notification or continued use is not a substitute for legally required consent. This September 16, 2026 revision updates the operator, notice address and legal explanations without expanding collection, use, sharing or retention permissions.

Privacy/general: contact@pagproject.com. Corrections: Review@pagproject.com. Formal notices: PAG PROJECT, c/o Registered Agents Inc., 7901 4th St N, Suite 300, St. Petersburg, FL 33702. Available in alternative format on request.