Newsify Privacy Policy

Newsify (newsify.site) is a platform that builds and hosts news websites for Iranian news agencies. A newsroom signs up, configures a site, pays from a wallet, and we run and update the site on our own infrastructure inside Iran. This policy explains what we know about you and your newsroom, why, for how long, and what control you have. “We” means Newsify; “you” means a person using the services or invited to a newsroom account.

1. Scope

This policy covers the marketing website (newsify.site), the customer panel (app.newsify.site), NewsCockpit (https://cockpit.newsify.site, an editorial dashboard that can connect to your Google Search Console and Google Analytics), and, to the extent we act as a processor, the news sites that run on our infrastructure (section 5). Our operator console is only used by our own staff.

2. What we collect

• Account: mobile number (used for sign-in with an SMS code), name and email if you provide them, when the number was verified, and your role in each newsroom (owner, finance or technical). SMS codes are stored only as one-way hashes and expire in minutes. Our own staff also use TOTP two-factor sign-in.
• Newsroom details: name, legal or natural person, legal name, national ID, economic code, address, postal code, landline, and the media licence (number, issuer, holder, date, scanned image). We need these to verify the newsroom, issue official invoices and follow the law.
• Financial: wallet transactions, top-ups, daily charges, invoices, discount codes and payment status. Card payments happen on the bank gateway’s own page; we never see or store card numbers, PINs or CVV2, only the result and a reference number.
• Sites and settings: site names and addresses, domains and DNS records you create, plan and features, theme, software version, panel address, protection settings.
• Support: messages and attachments you send to us.
• Technical records: important actions (sign-in, plan changes, suspension, top-ups, domain changes) are written to a tamper-resistant audit log with time, IP address and browser user-agent. Hourly usage (storage, bandwidth, panel users, AI calls) is measured to compute charges.
• Backups of each site’s database and media, which contain whatever is in your site, including your site’s own user data.
• NewsCockpit: workspace and site details and, if you connect Google, the data described in section 6.

3. What we do not collect

• Card numbers, second passwords or CVV2.
• Your Google password. Connecting Google happens on Google’s own consent screen.
• Advertising trackers, social pixels or third-party analytics on newsify.site or the panels. Fonts and scripts are self-hosted; your browser makes no requests to third-party services to render our pages.
• Sensitive categories such as health, religious or political beliefs, or biometrics.

4. How we use it

• To build, run, update, back up and, when needed, suspend or archive your site.
• To sign you in securely and prevent abuse (SMS rate limits, lockouts, audit log).
• To compute charges, top up the wallet, issue invoices and warn you before your balance runs out.
• To send service SMS and notifications (sign-in codes, balance, updates, incidents). We do not send marketing SMS without your consent.
• To answer support requests and complaints, and to comply with the law.
• To improve the product with aggregate, non-identifying statistics.

We do not sell your data and do not share it for targeted advertising.

5. Customers’ sites and their readers

A site you build on Newsify is yours: articles, images, panel users and any data your readers or staff enter. You decide what is collected and why and you are responsible for complying with the law regarding your readers. We only host, back up and technically access that data as your processor, on your instruction or to run the service. We do not use it for any other purpose or transfer it to anyone else.

If you switch on our “under attack” browser check, visitors get a short-lived cookie to avoid repeating the check. It is used only to pass the check, not to track.

6. Google user data in NewsCockpit

NewsCockpit is an editorial dashboard. A workspace owner or manager may optionally connect their Google account so the dashboard can show Search Console and Analytics data of the news site they select. Everything else works without it. Alternatively, a customer can upload a Google “service account” key, in which case no personal Google account is connected.

Scopes we request and why

• https://www.googleapis.com/auth/webmasters.readonly — read-only access to Google Search Console: to show clicks, impressions, position, search queries and top pages of the site you choose, and to suggest content opportunities.
• https://www.googleapis.com/auth/analytics.readonly — read-only access to Google Analytics (GA4): to show visits, users, traffic sources and top pages of the properties you choose.
• openid and email — only to learn the email address of the connected account so we can show which account is connected.

Both data scopes are read-only: Newsify cannot change, delete or add anything in your Search Console or Analytics. We do not access Gmail, Calendar, Drive or any other Google service.

What we receive and where it is stored

• From Google: the list of sites/properties you can access (so you can pick one), and for the ones you choose, aggregate statistics: clicks, impressions, position, search queries, page URLs and titles, visits and users. These do not contain personal information about your site’s visitors.
• The refresh token Google issues after your consent is stored encrypted in our database, is never written to logs and is never shown in full in the interface.
• Data is stored on our own servers in Iran, not with a third party.

How we use it

We use Google user data only to provide and improve the user-facing features you use in NewsCockpit: charts and reports of your own site, spotting queries and pages worth improving, matching trending topics with what your readers search for, and alerts for your own newsroom. We:

• do not sell or rent it, and do not use it for advertising, ad profiling or marketing, by us or anyone else;
• do not transfer it to data brokers or advertising services;
• do not use it to develop, improve or train generalized AI/ML models;
• do not let our staff read it unless you ask for support, it is needed for security or abuse investigation, or the law requires it;
• do not transfer it to third parties except as needed to provide the features below.

AI features. When you yourself ask NewsCockpit to draft a story for a trending topic, a short list of titles and URLs of your own site’s public pages (for internal-link suggestions) is sent to a language-model API together with the text of the source news. Click/impression statistics and your Google account details are not sent. The data is sent via API only for that request; we do not provide it for model training and we use a provider that does not use API data for training.

Outbound traffic. Google rejects connections from Iranian addresses, so NewsCockpit’s requests to Google leave through trusted proxies we operate. The connection stays TLS-encrypted end to end to Google; the proxy cannot read its content.

Ending the connection

• Remove the Google account in NewsCockpit’s connections page at any time: the stored token is deleted from our database and we stop reading new data from Google.
• You can also revoke access directly at myaccount.google.com/permissions.
• Statistics already synced remain in NewsCockpit while the workspace exists, so your earlier reports are not lost. They are deleted when the workspace is deleted or when you ask us to (section 11).

7. Who we share it with

We do not sell personal data. We share only what is needed to run the service:

• An Iranian SMS provider (currently Kavenegar): mobile number and the message text.
• Iranian bank payment gateways: amount, payment reference and result.
• Domain and TLS certificate services: domain names and DNS records you create (which may be public).
• A language-model provider: only if you use AI features, and only the text needed for that request.
• Telegram: only if you enable the newsroom bot or Telegram notifications; the text of those notifications.
• Google: the data you authorize by connecting your account (section 6).
• Technical and legal advisers under confidentiality, for a specific task.
• Authorities when a law or a competent authority’s order requires it, limited to what is required; we notify you where the law allows.

Members of your newsroom see only what their role permits.

8. Where data is kept

Our servers, databases and backups are in a data centre inside Iran. Data leaves Iran only through requests you start with a foreign service (Google, a language model, Telegram), limited to what that request needs.

9. Retention

• Account and newsroom data: while your account is active; deleted after a deletion request except for items the law requires us to keep.
• SMS codes: valid for minutes; a hashed trace stays briefly to prevent abuse.
• Invoices and financial records: as long as tax and commercial law require.
• Audit log: kept for accountability and security; on account deletion it is detached from the person but the event remains.
• Nightly backups: for the period of your plan.
• Archived sites: a final backup is kept for 90 days, after which data is deleted.
• Google token: until you remove the connection. Synced statistics: while the workspace exists or until you ask for deletion.
• Support conversations: as long as needed to resolve and evidence the matter.

Backup copies of data deleted earlier remain until their own retention cycle ends.

10. Security

• All pages are served over HTTPS with secure cookies (__Host-, HttpOnly, SameSite).
• Connection secrets (Google token, API keys, proxy passwords) are stored encrypted.
• Staff access is role-based, console sign-in requires TOTP, and important actions are logged.
• Each site runs in its own Kubernetes namespace with a storage key limited to it; per-site DDoS protection and rate limits are available.
• No system is perfectly secure. If a breach affects your data we will tell you without undue delay by SMS or email and say what to do.

To report a vulnerability, write to the address in section 15; we welcome responsible disclosure.

11. Your rights and deletion

You may at any time: see and get a copy of the data we hold about you (the owner or technical member can also download the site backup: database, media, settings); correct inaccurate data; ask us to delete your account, newsroom, site or Google-derived data; object to unnecessary processing or messages; and disconnect Google (section 6).

How: open a request in the panel’s support section or email support@newsify.site. To prevent abuse we verify the requester (for example with an SMS code to the account’s mobile number). We usually reply within 30 days. Where the law or a financial dispute requires it we may keep some data, only as far as and as long as needed for that purpose.

12. Cookies

We use only the cookies and local storage that the services need, with no advertising or tracking cookies, so there is no cookie banner.

13. Under 18

The services are for businesses and newsrooms, not for people under 18. We do not knowingly register them and will close such accounts.

14. Changes

If the services or the law change we will update this policy and its date. For material changes (such as a new Google scope or a new recipient of data) we will notify you in the panel or by SMS before they apply, and ask for your consent again for any new Google access.

15. Contact

Questions, complaints and requests about this policy and personal data: support@newsify.site, or the support section of the panel. Our terms of service are at /en/terms/.