CANDY MINK SPRINGS MEDIA LLC Kituwah Press · Kituwah Punk PRIVACY POLICY Effective Date: April 25, 2025

1. Scope and Data Controller

This Privacy Policy describes how Candy Mink Springs Media LLC (”CMSM,” “we,” “us,” or “our”), an Oklahoma limited liability company based in Stilwell, Adair County, Oklahoma, collects, uses, and discloses information in connection with kituwahpress.com and any affiliated newsletters, sites, and social media accounts operated under the Kituwah Press and Kituwah Punk mastheads (collectively, the “Site”). This Policy applies in addition to, not in place of, the Terms of Service.

Where the Site is hosted on Substack or a comparable third-party publishing platform, that platform processes certain information (including payment and hosting data) on CMSM’s behalf. As between CMSM and the platform, CMSM is the data controller for its subscriber list and original content, consistent with the platform’s own publisher agreement. Use of the platform itself, including any cookies or analytics the platform sets independent of CMSM, is separately governed by that platform’s own privacy policy, which we encourage you to review.

2. Information We Collect

Information you provide directly: your name, email address, and any other information you choose to provide when subscribing to a newsletter, submitting a comment, sending a story tip, requesting a correction, or otherwise contacting CMSM.

Payment information: if you purchase a paid subscription or make a donation, your payment card and billing details are collected and stored by our payment processor (currently Stripe, where the Site is on Substack) or by Apple, where you subscribe through Apple’s in-app purchase system. CMSM does not directly receive or store full payment card numbers.

Information from platform and technical sources: the hosting platform may provide CMSM with information such as your email address, subscription status, open and click activity on emails, and general engagement statistics. The platform and its infrastructure providers may also collect technical information such as IP address, browser type, device type, and pages visited, as described in the platform’s own privacy policy.

User Content: any comments, tips, photographs, letters to the editor, or other material you submit to the Site, as described in the Terms of Service.

3. How We Use Information

CMSM uses the information described above to: deliver newsletters and requested communications; process and manage paid subscriptions and donations; respond to inquiries, tips, and correction requests; maintain and improve the Site; enforce the Terms of Service; and comply with applicable legal obligations. CMSM does not use subscriber information to build advertising profiles for sale to third parties.

4. How We Share Information

CMSM does not sell subscriber personal information. We share information only in the following circumstances: with service providers who process it on our behalf (such as the hosting platform, payment processor, and email delivery infrastructure) and only as needed to provide the Site’s services; when required by law, subpoena, court order, or other valid legal process; to protect the rights, property, or safety of CMSM, our contributors, or others; or with your consent.

CMSM takes seriously its obligation to protect confidential sources and the integrity of its reporting. Information submitted through a public comment form or general contact address is not treated as a confidential source communication solely by virtue of the submission channel; where CMSM has agreed to protect a source’s confidentiality, that protection is governed by CMSM’s separate source-protection practices and not solely by this Policy.

5. Cookies and Analytics

The hosting platform may use cookies, pixels, or similar technologies to operate the Site, remember your preferences, and measure engagement, as described in that platform’s own privacy policy. CMSM does not currently operate any analytics tool of its own beyond the hosting platform’s built-in analytics. If CMSM begins using an additional analytics or advertising tool, this Policy will be updated to identify it before that tool is deployed.

6. Newsletters and Email Communications

If you subscribe to a CMSM newsletter, we use your email address to send the content and communications you signed up for. Every commercial email includes a functioning unsubscribe mechanism consistent with the CAN-SPAM Act, 15 U.S.C. § 7701 et seq. You may unsubscribe at any time using that link. CMSM does not sell or rent subscriber email addresses.

7. Children’s Privacy

The Site is not directed to children and is intended for users who meet the age requirement in the Terms of Service (currently 16 under the hosting platform’s own terms where applicable, and in no case under 13). CMSM does not knowingly collect personal information from children under 13, consistent with the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501-6506. If we learn that a child under 13 has provided personal information without parental consent, we will take reasonable steps to delete it.

8. Data Retention

CMSM retains subscriber and User Content information for as long as reasonably necessary to provide the Site’s services, comply with legal obligations, resolve disputes, and enforce the Terms of Service. You may request deletion of your information as described in Section 10, subject to CMSM’s legitimate journalistic, legal, and record-keeping needs, including the preservation of the published factual record.

9. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, or request deletion of your personal information, or to opt out of certain uses. California residents may have rights under the California Consumer Privacy Act, as amended, and residents of the European Economic Area, United Kingdom, or other jurisdictions with comparable laws may have rights under those laws. CMSM will honor requests to the extent required by applicable law. To make a request, contact CMSM using the information in Section 12, identify the specific right you are exercising, and provide the email address associated with your subscription or communication with CMSM so that CMSM can locate and verify your information. CMSM will verify a request by confirming it originates from that same email address, or by requesting reasonably necessary additional information where the request cannot otherwise be verified, and will respond within 30 days absent circumstances that reasonably require additional time, in which case CMSM will notify you of the delay.

10. Data Deletion Requests

You may request that CMSM delete personal information we hold about you by contacting us at the address in Section 12. We will honor such requests except where retention is required by law, necessary to complete a transaction, needed to resolve a dispute or enforce our agreements, or necessary to preserve the accuracy and integrity of the published journalistic record.

11. Security

CMSM relies on the security measures maintained by its hosting platform and payment processor for information those parties process, and takes reasonable administrative measures to protect information CMSM directly controls. No method of transmission or storage is completely secure, and CMSM cannot guarantee absolute security.

12. Contact

Questions about this Privacy Policy, or requests concerning your personal information, may be directed to:

Candy Mink Springs Media LLC Stilwell, Adair County, Oklahoma troylittledeer@gmail.com

13. Governing Law and Applicable Tribal Law

This Policy is governed by the laws of the State of Oklahoma and applicable federal law. CMSM is based in Stilwell, Adair County, Oklahoma, within the jurisdictional area of the United Keetoowah Band of Cherokee Indians in Oklahoma (UKB) and the Cherokee Nation. Nothing in this Policy is intended to waive, diminish, expand, or otherwise characterize the sovereignty or jurisdiction of the UKB, the Cherokee Nation, or any other tribal nation. Where CMSM’s data-handling practices occurring within tribal jurisdiction are independently subject to applicable tribal law, this Policy does not supersede that law.

14. Changes to This Policy

CMSM may revise this Privacy Policy from time to time by posting an updated version on the Site with a new effective date. Continued use of the Site after a revision takes effect constitutes acceptance of the revised Policy.

Both documents are now placeholder-free and internally consistent — same effective date, same eligibility age, same merchant-of-record framing, same tribal-jurisdiction carve-out architecture. Nothing left open on my end unless your actual setup changes (a new analytics tool, a CRM outside Substack, an actual privacy-request volume that makes the 30-day/email-verification process impractical).