Privacy Policy
Your words, your information, your trust. Here's how we protect them.
Last updated: 21 October 2026At Gray Matter Edits, privacy and confidentiality are fundamental to the relationship between an editor and a client. Whether you are sharing an academic manuscript, an unpublished novel, a personal story, or a simple enquiry, your information deserves careful handling.
This Privacy Policy explains what personal data Gray Matter Edits collects, why it is processed, how it is protected, when it may be shared, and the rights you have over your information.
We aim to collect only what is necessary, use it responsibly, and respect the confidentiality of your work.
Jump to a section
Who We Are
Gray Matter Edits is an independent editorial, writing, and creative-development business operated by Jodie Gray, based in Sauvo, Finland, and serving clients internationally.
The business operates under the Gray Matter Edits name, including its fiction-services identity, The Writer's Spellbook.
For personal data processed in connection with the business's own website, enquiries, administration, and direct client relationships, Jodie Gray, trading as Gray Matter Edits, is the data controller.
Gray Matter Edits
Jodie Gray
Urheilukentätie 8
Sauvo 21570
Finland
Business ID: 3554010-3
Email:
jodie@graymatteredits.com
In certain commissioned projects, particularly those involving information supplied by universities, organisations, or other professional clients, the allocation of data-controller and data-processor responsibilities may differ.
Where required, these responsibilities will be addressed in the relevant project agreement or data-processing arrangement.
Scope of This Policy
This policy applies to personal information processed through Gray Matter Edits' business activities, including:
- Visiting and interacting with this website
- Submitting enquiries or requesting quotations
- Communicating by email or contact forms
- Commissioning editorial or writing services
- Submitting manuscripts or project materials
- Purchasing digital products where available
- Managing invoices, payments, and contracts
- Providing testimonials or other voluntary feedback
The policy covers both academic and fiction-related services.
It should be read alongside our Terms of Service , which govern the contractual relationship between Gray Matter Edits and its clients.
This policy is prepared with reference to the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act, and other applicable privacy and electronic-communications requirements.
Personal Information We Collect
The information processed depends on how you interact with Gray Matter Edits.
Contact and identification information
This may include:
- Your name and email address
- Your business, institution, or professional affiliation
- Postal or billing address, where necessary
- Telephone number, if provided or required for a transaction
Project and service information
This may include:
- Manuscripts, research documents, story outlines, and creative briefs
- Project instructions, preferences, and requested deadlines
- Style guides, reference lists, planning documents, and research materials
- Editorial correspondence, feedback, comments, and revision requests
- Relevant contractual records and project histories
Transaction information
Where you purchase a service or product, information may include invoice details, amounts charged, payment status, transaction references, and records necessary for financial administration.
Complete payment-card details are ordinarily handled by the relevant payment provider rather than sent directly to Gray Matter Edits.
Website and technical information
When you visit the website, the hosting platform and any enabled analytics services may process technical information such as:
- IP address and approximate location
- Browser type and device information
- Pages visited and referral sources
- Session information and cookie preferences
- Technical information required for security and site operation
The precise information collected depends on the website's enabled features, analytics configuration, and your consent choices.
Information received from others
In some cases, a client or prospective client may be referred by another editor, colleague, organisation, or freelance platform.
Information received may include contact details, professional affiliation, project requirements, and other details supplied in connection with the referral.
Where required by data-protection law, individuals will be given appropriate information about the source and use of their personal data.
How and Why We Use Personal Data
Personal data is processed only where there is an appropriate legal basis under the GDPR or other applicable law.
Responding to enquiries and quotations
To respond to questions, assess service suitability, prepare quotations, and discuss prospective projects.
Legal basis: Steps requested before entering into a contract, or legitimate interests in handling general correspondence.
Providing commissioned services
To communicate with clients, review and process supplied materials, perform agreed editorial or writing work, deliver completed projects, and manage revisions.
Legal basis: Performance of a contract or steps necessary before concluding one. Where a business client supplies information about other individuals, additional legal bases may apply.
Invoices, payments, and accounting
To issue invoices, record transactions, administer payments, and meet legal, tax, and accounting obligations.
Legal basis: Performance of a contract and compliance with legal obligations.
Business administration and security
To maintain accurate business records, manage projects, respond to disputes, protect confidential materials, and prevent misuse of the website and associated systems.
Legal basis: Legitimate interests in operating and protecting the business, or compliance with legal obligations.
Website analytics
Where enabled, analytics may help understand visitor activity, website performance, and the effectiveness of its content.
Legal basis: Consent where required for non-essential cookies or similar tracking technologies, together with an applicable GDPR processing basis.
Marketing and updates
If marketing communications are offered, contact information may be used to send updates where valid permission or another applicable legal basis exists.
Legal basis: Consent or another lawful basis permitted by applicable direct-marketing rules.
Information needed to provide services
Certain details, such as contact information and the materials needed to perform a commissioned service, are necessary to enter into or fulfil a contract.
If required information is not provided, Gray Matter Edits may be unable to prepare an accurate quotation or complete the requested service.
Information requested for optional activities, including consent-based marketing, is not a condition of purchasing editorial services.
Manuscripts, Research and Sensitive Information
Editorial and creative-development work can involve information considerably more personal than an ordinary commercial transaction.
Manuscripts and supporting materials may contain unpublished creative work, identifiable individuals, private correspondence, personal experiences, or sensitive research information.
Academic and research materials
Academic manuscripts may contain research-participant information, interview extracts, case studies, or material subject to institutional confidentiality or research-ethics requirements.
Clients should anonymise or pseudonymise personal data wherever reasonably possible, particularly where identifiable information is not necessary for the agreed editorial work.
Where identifiable research data is necessary, the client and Gray Matter Edits should establish appropriate instructions, responsibilities, and safeguards before the material is transferred.
Autobiographical and personal writing
Ghostwriting and fictionalised-life-story commissions may involve personal memories, relationships, family histories, correspondence, photographs, or information about other individuals.
Such material is treated as confidential project information and used for the agreed service or another lawful purpose.
Special categories of personal data
Certain personal information, including information concerning health, racial or ethnic origin, religious beliefs, political opinions, and sexual orientation, receives additional protection under the GDPR.
Where processing these categories is necessary, an applicable legal basis and an additional condition under Article 9 of the GDPR must be established.
Depending on the circumstances, this may require explicit consent from the relevant individual or another legally available condition.
Please avoid including unnecessary personal identifiers, confidential research data, or sensitive information about third parties in an initial enquiry. If your project requires special handling, this can be discussed before materials are submitted.
AI-assisted and external processing tools
Where external text-analysis, language-assistance, or generative AI tools are used in a project, their use must comply with applicable confidentiality arrangements, data-protection requirements, and the agreed project scope.
Any proposed processing of identifiable or confidential client material through an external service must be assessed for an appropriate legal basis, contractual safeguards, and any required authorisation.
Clients may raise particular confidentiality or AI-processing requirements before commissioning work.
Enquiries, Forms and Communication
Contact forms and quotation requests
Information submitted through website forms is used to respond to the request, consider project requirements, prepare quotations, and arrange potential services.
Form information may be processed through the website platform and associated communication or administrative services.
Email correspondence
Business email communications are managed through Google Workspace. Correspondence may be retained where necessary for ongoing projects, administration, contractual records, or legitimate follow-up.
Freelance-platform communication
Where clients communicate or contract through Upwork or another freelance platform, personal data may also be processed under that platform's independent privacy arrangements.
Gray Matter Edits processes the information it receives through those platforms for the purposes of managing enquiries, contracts, project delivery, and payments.
Unsolicited material
Please do not submit full manuscripts, confidential records, or other extensive personal data through a general enquiry unless the material has been requested or an appropriate transfer arrangement has been agreed.
Cookies, Analytics and Website Technology
This website is built using Squarespace, which uses cookies and similar technologies to support website operation, security, visitor preferences, and certain optional features.
Cookies are small pieces of information stored on or accessed through your device when you visit a website.
Essential cookies
Essential cookies support functions required to operate the website and provide services specifically requested by visitors.
These may include security functions, session management, form functionality, and remembering cookie preferences.
Where a cookie is strictly necessary under applicable law, separate consent is not required.
Analytics and performance cookies
Where enabled, Squarespace analytics cookies can help measure website visits, understand traffic sources, and analyse visitor interactions.
Squarespace documents the following analytics cookies, which may be applicable if those features are enabled and consented to:
| Cookie | Purpose | Duration |
|---|---|---|
| ss_cid | Visitor identification and sessions | 2 years |
| ss_cpvisit | Visitor identification and sessions | 2 years |
| ss_cvisit | Visitor identification and sessions | 30 minutes |
| ss_cvr | Visitor identification and sessions | 2 years |
| ss_cvt | Visitor identification and sessions | 30 minutes |
These are Squarespace's documented analytics cookies, not confirmation that every cookie listed is active on this website. The final cookie inventory must reflect the site's actual configuration.
Third-party cookies and integrations
Additional cookies or similar tracking technologies may be used where third-party services are integrated into the website, including optional media, analytics, payment, or marketing features.
Such technologies must be disclosed and, where legally required, activated only after appropriate consent.
Managing your cookie choices
Visitors must be able to accept or reject non-essential cookies through the website's consent controls.
Consent for non-essential cookies is voluntary and can be withdrawn or changed using the website's cookie-preferences controls.
Refusing optional cookies should not prevent access to ordinary website content, although some optional features may be unavailable.
You may also manage or delete cookies through your browser settings. Browser controls do not replace any consent mechanism legally required on the website.
Further technical information about Squarespace's cookies is available in its cookie documentation .
Payments, Purchases and Digital Products
Commissioned services
Payment and billing information is processed to administer contracts, issue invoices, maintain transaction records, and comply with financial reporting obligations.
Depending on the agreed payment method, a bank, freelance platform, or payment service provider may process transaction information.
Those providers may act as independent data controllers for parts of their payment and compliance operations.
Digital products
Where digital resources, templates, courses, or other products are available for purchase, information necessary to process the transaction and provide the purchased content may be collected.
Such information may include purchaser contact details, order details, billing information, and access or delivery records.
Any additional platform used for digital product delivery will need to be reflected in this policy where it processes customers' personal data.
Financial record-keeping
Transaction records may be retained for the periods required by Finnish accounting and tax law, even where other information associated with a completed project has been deleted.
Marketing, Updates and Testimonials
Marketing communications
If Gray Matter Edits offers email newsletters, service updates, or promotional communications, these will be sent only where permitted by applicable law.
Where consent is required, it will be requested separately and will not be assumed merely because someone submits an enquiry or purchases a service.
Recipients may withdraw consent or object to direct marketing at any time, including through an unsubscribe mechanism where provided.
Withdrawal will not affect the lawfulness of processing that occurred before consent was withdrawn.
Service correspondence
Administrative messages concerning enquiries, quotations, contracts, deadlines, invoices, and project delivery are not treated as optional marketing.
Testimonials and portfolio examples
Testimonials, identifiable client feedback, manuscript excerpts, and project case studies may be published with appropriate permission or another applicable legal basis.
Unpublished client manuscripts and confidential creative materials are not made publicly available merely because editorial services have been provided.
Permission may be withdrawn where applicable, subject to lawful limits and any rights already exercised.
Sharing Information and Service Providers
Gray Matter Edits does not sell personal information to data brokers or advertisers.
Personal data may be made available to service providers or other recipients where necessary for the purposes described in this policy.
Website and communications
Squarespace provides website-hosting and website-management functionality.
Google Workspace is used for business email and associated communications.
Project management and professional tools
Editing, document-processing, reference-management, storage, and administrative software may be used to produce and manage agreed deliverables.
Where a tool receives personal data, its use must be appropriate for the information involved and supported by relevant safeguards.
Freelance and payment platforms
Upwork or other platforms may process information for contracts, communications, identity checks, transaction handling, or platform administration.
Banks and payment processors may receive the information necessary to complete payments.
Professional and legal obligations
Information may be disclosed where necessary to accountants, professional advisers, public authorities, or other authorised recipients, subject to applicable legal requirements and confidentiality obligations.
Confidentiality and access
Access to personal data is limited to persons and providers who require it for a legitimate business or legal purpose.
Appropriate contractual protections, including data-processing agreements, are used where required.
Personal data is not shared with unrelated third parties for their independent advertising purposes without an appropriate legal basis.
International Data Transfers
Gray Matter Edits operates from Finland and serves clients in different countries.
Some website, email, payment, and professional service providers may store, access, or otherwise process personal information outside the European Economic Area (EEA).
Where personal data is transferred to a country outside the EEA, the transfer must be supported by an appropriate legal mechanism under the GDPR.
Depending on the recipient and destination, safeguards may include:
- An applicable European Commission adequacy decision
- The EU-US Data Privacy Framework, where the recipient is eligible and certified
- European Commission Standard Contractual Clauses, with supplementary measures where required
- Another lawful transfer mechanism where applicable
Information about the relevant transfer safeguards, including how to obtain further details or a copy where applicable, may be requested using the contact details below.
The safeguards used for any particular service depend on that provider's current arrangements and the processing involved.
How Long We Keep Information
Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, or for another lawful purpose.
Retention periods depend on the nature of the information, ongoing contractual requirements, relevant limitation periods, and applicable legal obligations.
General enquiries
Enquiries that do not result in a commission are retained for up to 12 months after the last relevant contact, unless a longer period is necessary for an identified lawful purpose.
Client and project records
Contractual records and project correspondence may be retained where necessary to administer the client relationship, document agreed work, respond to subsequent queries, or resolve disputes.
Manuscripts and working files
Manuscripts, annotations, working documents, and completed deliverables are normally retained for 12 months after final delivery, unless an alternative arrangement is agreed or a longer period is lawfully required.
Files may be deleted earlier where appropriate, including following a valid request and where no conflicting legal or contractual obligation requires further retention.
Financial and accounting records
Records subject to Finnish accounting requirements are retained for the applicable statutory periods.
These may include retention of supporting accounting documents for at least six years and certain core accounting records for at least ten years, depending on the record type.
Marketing information
Where marketing subscriptions are offered, relevant information is retained while the subscription remains valid and as necessary to document or honour unsubscribe and consent choices.
Deletion and anonymisation
When information is no longer needed and no lawful retention requirement remains, it will be deleted or anonymised using appropriate methods.
Information held in routine system backups may remain until the relevant backup expires under the provider's retention arrangements.
Data Security and Confidentiality
Reasonable technical and organisational measures are used to protect personal information from unauthorised access, accidental loss, alteration, or disclosure.
Such measures may include appropriate access controls, account security, secure communication methods, software maintenance, and responsible handling of project files.
Confidential editorial work
Client manuscripts, research, unpublished ideas, and personal creative materials are treated as confidential.
Project materials are used for the agreed purpose and disclosed only where authorised or otherwise legally permitted.
Non-disclosure agreements
Additional confidentiality arrangements, including non-disclosure agreements, may be agreed where suitable for the project.
Security limitations
No method of internet transmission or electronic storage can be guaranteed completely secure.
If a personal-data breach occurs, Gray Matter Edits will assess the incident and make any notifications required by applicable data-protection law.
Clients should communicate any exceptional security requirements before transferring especially sensitive materials.
Your Data Protection Rights
Under the GDPR, individuals have rights in relation to their personal data. The rights available in a particular situation depend on the relevant processing and legal basis.
Right of access
Request confirmation of whether personal data is being processed and receive access to that information where applicable.
Right to rectification
Request correction of inaccurate or incomplete personal data.
Right to erasure
Request deletion of personal information where the legal conditions for erasure are met.
Right to restrict processing
Request that processing is limited in certain circumstances.
Right to data portability
Receive eligible personal data in a structured, commonly used, machine-readable format and request its transmission where legally applicable.
Right to object
Object to processing based on legitimate interests where applicable, and object to direct marketing.
Right to withdraw consent
Withdraw consent at any time where processing relies on that consent, without affecting prior lawful processing.
Automated decision-making rights
Exercise applicable rights in relation to qualifying solely automated decisions with legal or similarly significant effects.
Automated decision-making
Gray Matter Edits does not ordinarily use solely automated decision-making or profiling that produces legal or similarly significant effects on clients.
Making a request
To exercise a data-protection right, email jodie@graymatteredits.com with a description of your request.
Reasonable information may be requested to verify your identity before disclosing or modifying personal data.
Requests will be addressed without undue delay and normally within one month, subject to extensions permitted by law where necessary.
Requests are generally handled without charge, except where applicable law permits a fee or refusal in particular circumstances.
A request to delete personal information does not always require immediate deletion of every associated record. Information may need to be retained where legally required, including for accounting or the establishment, exercise, or defence of legal claims.
Children and Information About Other People
Children's personal information
Gray Matter Edits' website and services are primarily intended for adult clients and professional users.
The business does not intentionally solicit personal information directly from children for independent marketing purposes.
Some commissioned projects may nevertheless contain information about children or young people, particularly within autobiographical materials, family histories, or research documents.
Such information must be handled in accordance with applicable data-protection requirements and any additional safeguards appropriate to the circumstances.
Third-party personal information
Clients should ensure that they have an appropriate legal basis and authority to provide personal information relating to other individuals.
Where possible, identifying information should be removed if it is not necessary for the commissioned work.
Additional arrangements may be necessary for projects involving substantial amounts of identifiable personal data.
External Services and Policy Updates
External websites
This website may contain links to external websites, freelance platforms, payment services, or other third-party resources.
Those organisations may operate under their own privacy policies and data-processing arrangements.
Visitors are encouraged to review the privacy information provided by external services before submitting personal data.
Changes to this policy
This Privacy Policy may be updated to reflect changes in business practices, website functionality, service providers, or legal requirements.
The latest version will be published on this page, together with its most recent update date.
Where a change requires further notice or new consent under applicable law, appropriate steps will be taken before the relevant processing begins.
Contact and Privacy Complaints
If you have questions about how your personal information is handled, wish to exercise a data protection right, or have a concern about privacy, please contact Gray Matter Edits.
Gray Matter Edits
Jodie Gray
Sauvo, Finland
Please use "Privacy Enquiry" in the email subject line where possible.
Finnish supervisory authority
If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent data-protection supervisory authority.
In Finland, the relevant supervisory authority is:
Where applicable, individuals may also contact a supervisory authority in the country where they live or work, or where an alleged infringement occurred.
We welcome the opportunity to address privacy concerns directly, although doing so is not a condition of exercising your right to make a complaint.