Privacy policy

Last updated 20 October 2026

Introduction

What’s brewing in AI is published by Chincha Consulting AS (“we”, “us” or “our”), a company registered in Norway (organisation number 925 782 092). The same company runs Context Windows (contextwindows.ai). This policy explains how we collect, use, share and protect information about you when you subscribe to and read the newsletter What’s brewing in AI, when you visit this website (www.whatplugin.ai), and when you ask for the free overview offered on Context Windows’ pages, which subscribes you to the newsletter.

In short: we collect your email address and what you choose to tell us, we see which of our emails you open and which links you click, we never sell your information, and sponsors only ever see totals. Every email has an unsubscribe link. The rest of this page gives the details.

Information we collect

We collect information that you provide directly to us, information that is collected automatically when you read our emails or visit this website, and some information from other services.

Information you provide

Your email address: when you subscribe on this website, on Context Windows’ pages, on Substack, or through another newsletter’s recommendation. We need it to send you the newsletter.
Your name: if you gave it to us.
Your answers to the welcome questions: questions about your work and your use of AI, such as your role, your level, your industry and whether you choose your team’s tools. We ask them after you subscribe and in some of our emails. They are optional.
Replies, poll votes and feedback: if you reply to one of our emails, write to us, vote or comment in a poll, or tell us why you unsubscribed, we keep what you send.
If you sponsor or work with us: your business contact details, our correspondence and our invoices.

Information collected automatically

Where your signup came from: the page and form you used, the website that sent you, campaign tags in the link, a referral code, the date, your country (worked out from your IP address) and whether you were on a phone or a computer. If you came from one of our ads, also the ad’s identifiers.
How you read our emails: which of our emails we sent you, which you open and which links you click, with the time, your email app or browser, and an approximate location worked out from your IP address (see cookies and tracking).
Delivery reports: whether an email was delivered, bounced or was marked as spam.
Spam and address checks: when you sign up on this website or on Context Windows’ pages, Cloudflare Turnstile checks that you are a person, using your IP address and browser details. On this website’s form we also check your address for typos and for throwaway or non-existent domains, by looking up the part after the @.
Usage data on this website: our own count of visits, made without cookies: which issues are read, which links in them are clicked, the website that sent you, your country and your type of device. To count a visitor once a day, we keep a scrambled code made from your IP address and browser with a key that changes every day, so visits can’t be linked across days. When you arrive from one of our ads, we count that visit with the ad’s identifiers.
Device information: our hosting provider processes your IP address and browser details to deliver this website and the links in our emails, and to keep them secure.
Analytics and advertising tools: Google Analytics, Google Tag Manager and the Meta pixel measure how the site is used and whether our ads work. In Europe they only load if you accept them (see cookies and tracking).

Information from other sources

Substack: if you subscribe to our edition on Substack, Substack tells us your address and how you found it, and we add you to the newsletter, unless that address unsubscribed from it before.
Recommendation services: if you subscribe through another newsletter’s recommendation or a recommendation service, such as beehiiv’s Boosts, SparkLoop or Refind, that service tells us your address and who recommended us.
Context Windows: what newsletter readers do on contextwindows.ai, and purchases made there (see cookies and tracking).
Public company information: if your address is at a company domain, we may work out the company behind it, for example its size, from public company data, with the help of AI tools. We use only the part of your address after the @.

How we use your information

We use the information we collect to:

Send you the newsletter and the emails that come with a subscription, such as a welcome, reminders to finish the welcome questions and the link to your personalized overview
Personalize parts of the newsletter, and your overview on Context Windows
Understand what readers find useful, from opens, clicks and visits
Keep our emails out of spam folders: we stop emailing addresses that bounce for good and readers who mark our emails as spam, pause addresses that keep bouncing, leave out addresses whose domain no longer accepts email, and stop sending issues to readers who joined more than six months ago and have never opened or clicked one of our emails (they stay subscribed)
Learn which channels and ads bring readers, and measure and improve our advertising
Settle referrals with the services and newsletters that recommend us
Describe our readers to sponsors and on this website in totals, for example the share in a given role or industry, or the companies our readers work at, never naming a reader
Respond to your replies, questions and requests
Detect and prevent fake signups and abuse
Keep the records Norwegian law requires

Our legal grounds

Your consent: sending you the newsletter and the emails that come with it, your answers to the welcome questions, and, in Europe, the cookies described below. You can take your consent back at any time by unsubscribing or changing your cookie choice. This doesn’t affect what happened before.
Our legitimate interests in running, improving and growing the newsletter: measuring how our emails and this website are used, keeping our emails deliverable, the spam and address checks, learning which channels and ads bring readers, settling referrals, connecting what readers do on Context Windows, describing our readers to sponsors in totals, backups and security. You can object to any of these (see your rights).
Contract and law: our agreements with sponsors, and Norwegian bookkeeping law for invoices and accounts.

Data sharing and third parties

We do not sell or rent out your personal information. We share your information only in the following circumstances:

Service providers: companies that run parts of the newsletter and this website for us, listed below.
Sponsors: sponsors and the marketplaces we sell sponsorships through receive totals, such as how many readers opened an issue or clicked their link, never names or addresses. A link to a sponsor may pass through the sponsor’s or the marketplace’s own click counter on its way to their website.
Recommendation services: a service that sent you to us may learn whether you confirmed your subscription, stayed subscribed, and opened or clicked our emails, so the newsletter that recommended us can be paid. If you choose to subscribe to another newsletter through one of our recommendations, that newsletter receives your email address.
Meta: the Meta pixel and the ad measurement described under cookies and tracking.
Context Windows: run by the same company, so information moves between the two, as described under cookies and tracking.
People who work with us: contractors who help run the newsletter, for example with sponsorship sales, can see some subscriber information in our shared working files.
Legal requirements: we may disclose information if required by law or in response to valid requests by public authorities.
Business transfers: if the newsletter or our company is sold or merged, your information may be transferred as part of that transaction.

Our service providers

These companies handle information for us or with us:

beehiiv (USA): our newsletter platform until our own system takes over. For as long as we use it, it stores subscriber records, sends the newsletter and counts opens and clicks. We keep a copy of what it holds for us in our own database.
Amazon Web Services (USA): delivers the emails our own system sends, reports deliveries, bounces and spam complaints back to us, and keeps its own record of addresses that bounced or complained, so it never sends to them again.
Supabase (USA; our databases are hosted in Stockholm, Sweden): our databases, including subscriber records and our own measurements.
Vercel (USA): hosts this website and its forms, and the links and tracking image in the emails our own system sends.
Hetzner (Germany; our server is in Virginia, USA): runs our sending system and scheduled jobs, and keeps encrypted backups.
GitHub (USA): stores our code and encrypted backups of subscriber records.
Cloudflare (USA): runs our domain’s name service and the spam check on signup forms.
Google (USA): our email and spreadsheets (Google Workspace), where your replies and some of our reporting live; Google Analytics and Tag Manager on this website; and the fonts in our emails.
Meta (Ireland and USA): the Meta pixel and the ad measurement described under cookies and tracking.
SparkLoop (USA): a referral service. Its script loads on this website (see cookies and tracking).
Substack (USA): publishes some of our essays. If you subscribe there, Substack tells us your address.
X and YouTube (USA): posts and videos embedded in some issues.
Resend (USA): sends us alerts from our own systems.
AI service providers (USA): AI tools that help us run the newsletter and its systems. They can see subscriber data while they work. The specific providers may change over time; if you want to know which ones we use, ask us.
Stripe, Fiken, Passionfroot and Paved: payments, accounting and bookings with sponsors.

Some services we work with, such as our sponsorship marketplaces and services that send us readers, connect to our newsletter platform with a key of their own, to read our audience figures or to add and check on the readers they send.

Cookies and tracking

We use cookies and similar technologies on this website, and tracking in our emails.

If your device’s time zone or your IP address places you in the EU, the EEA, the UK or Switzerland, a banner asks first, and none of the tools under “Cookies we use” loads unless you accept. Your answer is kept for six months, and if you take back a yes, we delete the Google and Meta cookies on this website. Everywhere else the tools load when you visit, and you can block them in your browser’s settings or with a content blocker.

Cookies we use

Google Analytics (_ga and _ga_…, up to two years): tells visits apart, so we can see how the site is used.
Google Tag Manager: loads some of our measurement tags. Google’s tags can also set cookies of their own, such as _gcl_au for ads (90 days).
Meta pixel (_fbp and _fbc, 90 days): reports your visits and the buttons you click to Meta, and lets Meta connect visits to our ads.
X: turns posts quoted in some issues into cards, and may set cookies of its own.
SparkLoop: Google Tag Manager also loads SparkLoop’s referral script. When we use SparkLoop for referrals, it can set cookies of its own (__sl-…, 30 days) to recognize your browser and credit the newsletter that sent you.

This website sets no cookies of its own; our hosting provider may set a short-lived security cookie if it has to check that a visitor isn’t a bot. The site keeps a few things in your browser’s storage: your light or dark theme, your cookie answer, whether the banner applies where you are, where your visit came from, your signup details while you answer the welcome questions (these last three until you close the tab), when the signup popup was last shown, and a referral code if you came through one (used for 30 days). They leave your browser only with a form you send, apart from the ad identifiers counted when you arrive from one of our ads.

Videos in some issues are embedded from YouTube in its privacy-enhanced mode. They load without asking first; YouTube says it stores no information about visitors in this mode unless they play the video.

Tracking in our emails

Our emails contain a tiny image and links that pass through our website, or our newsletter platform while we use it, on their way. When you open an email or click a link, we record that you did, when, which email app or browser you used, and an approximate location (country, region and city) worked out from your IP address. Our own system keeps only the network part of your IP address, not the full address. We flag opens and clicks that look automated, for example those made by email security scanners. You can stop opens being recorded by turning off images in your email app.

Some links in our emails carry a code that identifies your subscription, so the page they open knows it’s you, for example your personalized overview or the unsubscribe page. Anyone you forward an email to can use those links too. Our emails also load fonts from Google Fonts, so your email app may contact Google when it shows them.

Measuring our ads on Meta

We advertise on Facebook and Instagram. To learn which ads bring readers, and to help Meta show our ads to people likely to read the newsletter, our server tells Meta when someone subscribes on this website, when a new subscriber finishes the welcome questions, and when someone who arrived from one of our ads first clicks a link in our emails within a week. Each event carries a scrambled (hashed) version of the email address and the ad’s click identifiers when there are any, and, except for the email click, the page, the IP address and the browser. When a new subscriber who finishes the welcome questions is a founder, an executive, a director or someone who decides which tools their team buys, a separate event says so. Meta matches this with its own users to report results to us and to decide who sees our ads. We never do this when your IP address is in the EU, the EEA, the UK or Switzerland, or when we can’t tell where it is.

Readers who visit Context Windows

Context Windows (contextwindows.ai) is run by the same company. The link to your personalized overview there carries your answers to the welcome questions as short codes, and that link and some other links in our emails carry a pseudonymous reader key that comes from your subscription. The key contains no name or email address. Against that key, Context Windows’ pages record the pages you view there and what you click, how long you stay and how far you scroll, and whether you start or complete a purchase, including on later visits from the same browser. We store these records with Vercel and Supabase. We use them to understand what is useful to our readers and which parts of the newsletter lead them to Context Windows, and we can connect them, and any purchase you make there, with your subscription. We also note when you first open your overview, so we don’t remind you about it again.

If you ask for the free overview on Context Windows’ pages, you subscribe to this newsletter there. Your email address and answers come to us, with the page you were on, the first page of your visit, the website that sent you and how you first found Context Windows. Context Windows’ own privacy policy covers what it does on its side. To have these records deleted, email us at d@whatplugin.ai.

International data transfers

Your information may be transferred to and processed in countries other than Norway, including the United States, where several of our service providers operate. Our emails are sent from the United States, and our sending system runs on a server in Virginia. These countries may have different data protection laws than your country of residence.

When we transfer personal data outside the European Economic Area (EEA), we rely on appropriate safeguards: the European Commission’s Standard Contractual Clauses in our providers’ data processing terms, or the EU-US Data Privacy Framework where the provider is certified under it.

Data security

We use technical and organizational measures to protect your information against unauthorized access, alteration, disclosure or destruction. For example, access to our databases is limited to what each part of our system needs, and our backups are encrypted. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Data retention

While you’re subscribed, we keep your subscription details, your answers and your reading history.
When you unsubscribe or mark our email as spam, or your address bounces for good, we stop emailing it and keep the address on a do-not-email record, so it is never added back by mistake.
We don’t delete subscriber records on a schedule. After you unsubscribe, your record stays, marked as unsubscribed, until you ask us to delete it.
Our records of website visits, signups, steps through the welcome questions and activity on Context Windows have no set end date either. They hold no email addresses: the signup record keeps only a scrambled version of the address.
Ask us to delete your data and we will, apart from the do-not-email record and anything the law requires us to keep.
Our nightly database backups are encrypted and kept for 14 days. Encrypted copies of our subscriber records are also kept in our backup history, which we don’t prune. Backups are used only to restore our systems.
Google Analytics keeps visit-level data for at most 14 months. Meta, Google and the other companies above keep what their own tools collect under their own policies.
Sponsor invoices and accounting records are kept for five years, as Norwegian bookkeeping law requires.

Your rights

Under the General Data Protection Regulation (GDPR) and Norwegian data protection law, you have the following rights regarding your personal data, wherever you live:

Right of access: you can request a copy of the personal data we hold about you.
Right to rectification: you can ask us to correct inaccurate or incomplete data.
Right to erasure: you can request that we delete your personal data in certain circumstances.
Right to restriction: you can ask us to restrict the processing of your data in certain circumstances.
Right to data portability: you can request a copy of your data in a structured, machine-readable format.
Right to object: you can object to processing based on our legitimate interests, including the measurement of your reading and our ad measurement described above.
Right to withdraw consent: where processing is based on consent, you can withdraw that consent at any time. Unsubscribing withdraws your consent to receive the newsletter.

To exercise any of these rights, email us at d@whatplugin.ai. We will respond to your request within 30 days. You can unsubscribe at any time with the link at the bottom of every email.

Children

The newsletter is written for working adults. We don’t knowingly collect personal data from anyone under 16.

Contact us

If you have any questions about this privacy policy or our data practices, please contact us:

Chincha Consulting AS
Trading as What’s brewing in AI
Norway
Email: d@whatplugin.ai

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or with the supervisory authority where you live.

Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or for other operational, legal or regulatory reasons. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date. We encourage you to review this policy periodically.