Reviews
Part of A method for newsletter monetisation reviews
Assessing a newsletter supplier through five gates, from privacy to exit
Use five separate gates to assess a newsletter supplier: audience privacy, customer money, advertising rights, accessibility security, and contract exit.
Complete this checklist for one exact edition, contract and adult-newsletter publication. Add explicit age-verification and content-restriction checks for that edition. Record an owner, evidence file, evidence date, result, unresolved question and expiry for every line.
What to take away
- A missing answer on any checklist line is unknown, not a pass.
- Supplier plan pages show documented scope only, not suitability or performance.
- Do not average failed specialist gates into one overall score.
- Reopen the decision when the edition, terms, subprocessors or payment route changes.
- Assign accounting, tax and VAT treatment to qualified advisers, not the platform dashboard.
Before you act
- Name the supplier, entity, edition, geography and data classes.
- Record an owner, evidence file, date, result and expiry per line.
- Use synthetic content and invented addresses for controlled tests.
- Route possible financial promotions to an FCA specialist first.
- Rehearse loss of the supplier and one critical integration.
- Obtain deletion evidence and define access removal.
Workflow and evidence
- Define editorial publishing, audience acquisition, paid access, payment, sponsorship, affiliate and support as separate workflows.
- Name the supplier, contracting entity, product, edition, geography, integrations and proposed data classes.
- Record whether each statement is contractual, first-party documentation, independent evidence, observed test or assumption.
- Use synthetic content and invented addresses for controlled tests. State every untested journey.
Worked example checklist row (example only):
| Owner | Evidence file | Date | Result | Expiry |
|---|---|---|---|---|
| Privacy lead | privacy-export-test.pdf | 2026-01-15 | Pass: export returned all subscriber fields and suppressions | 2026-07-15 or next edition |
Supplier plan pages can establish documented scope. For example, Ghost's plan comparison identifies its Publisher edition, beehiiv's pricing record identifies Scale, and Buttondown's paid-subscription guide identifies its Basic-plan feature. These records do not prove suitability, availability or performance for the operator.
Public entry tiers are banded by subscriber count. The table below shows list prices to record, not a quotation for your case.
Public entry tier
- Ghost
- Starter
- beehiiv
- Launch
- Buttondown
- Free
- Substack
- Platform fee
Subscriber band
- Ghost
- Up to 500 members
- beehiiv
- Up to 2,500 subscribers
- Buttondown
- Up to 100 subscribers
- Substack
- Paid subscriptions
Published price
- Ghost
- USD 9 per month
- beehiiv
- No charge
- Buttondown
- No charge
- Substack
- 10% of subscription revenue
Audience and privacy gate
- Map collection, permission evidence, suppression, segmentation, tracking, support, export and deletion.
- Identify controller, processor and subprocessor roles from actual decisions and contracts.
- Test role access, suppression propagation, rights handling, incident cooperation and end-of-contract return or deletion.
- Assess transfers and remote access with qualified privacy advice; do not infer adequacy from server location alone.
- Pass thresholdsigned processor terms, current subprocessor list, tested suppression propagation, and export plus deletion evidence; otherwise reject or controlled test, and hold until evidence arrives.
The ICO's contract guidance lists required processor-contract concerns and is currently under DUAA review. Its electronic-mail guidance keeps message, subscriber and permission questions outside a platform feature score.
Customer and money gate
- Trace order, payment, entitlement, renewal, cancellation, refund, dispute, access ending and customer communication as distinct states.
- Confirm supported processor configuration and safe testing route; preserve processor, bank and accounting identifiers.
- Leave GBP price and tax fields blank unless exact edition, VAT status, unit, period, eligibility and date are directly evidenced.
- Assign accounting, tax and VAT treatment to qualified advisers rather than the platform dashboard.
- Pass thresholda test order shows correct entitlement, renewal, cancellation, refund, dispute and access-ending states; otherwise reject or controlled test, and hold until evidence arrives.
GOV.UK's distance-selling guidance provides a consumer-law starting point subject to scope and exceptions. The supplier's flow does not settle the legal conclusion.
Advertising, rights and FCA gate
- Separate editorial, sponsorship and affiliate material in briefs, approvals, disclosure records and reports.
- Record claim substantiation, commercial relationship, control, placement and withdrawal owner.
- Confirm licences for copy, images, data and templates and test correction or removal across every channel.
- Route possible financial promotions to an FCA specialist before publication.
- For adult content, record age-assurance method, content-restriction rules, payment-processor acceptable-use terms and ad-network limits.
- Pass thresholdevery sponsored or affiliate item has a named disclosure owner, substantiation file and rights licence; otherwise reject or controlled test, and hold until evidence arrives.
CAP's affiliate guidance explains when affiliate material may fall within the Code and the need for recognition. A built-in label cannot compensate for unsupported claims or missing rights.
Accessibility and security gate
- Test signup, preferences, reading, checkout, cancellation and support with keyboard and relevant assistive methods.
- Obtain evidence for authentication, least privilege, logs, subprocessors, vulnerability handling, incident notification, backup and restore.
- Rehearse loss of the supplier and one critical integration. Record recovery evidence and restart authority.
- Pass thresholdkeyboard test completes signup to cancellation, MFA and least privilege are evidenced, and a restore test returns representative records; otherwise reject or controlled test, and hold until evidence arrives.
NCSC's supply-chain principles support risk understanding, control, checking and improvement. They do not certify a candidate.
Contract, support and exit gate
- Review service scope, exclusions, change control, support route, liability, renewal, suspension, termination and governing law.
- Export content, audience fields, permissions, suppressions, subscription references, campaign evidence and reports.
- Restore representative records, inventory fields that cannot move and protect customer continuity.
- Obtain deletion evidence and define access removal, domain and sender-authentication transfer, archive handling and final accounting reconciliation.
- Pass thresholdcontract supports termination, export, deletion, domain and sender-authentication transfer, and a rehearsal confirms customer continuity; otherwise reject or controlled test, and hold until evidence arrives.
UK exit duties include data portability under ICO guidance, .uk domain transfer under Nominet process, and sender authentication under NCSC email security guidance. Record the ICO, Nominet or NCSC source you rely on.
The selection owner may choose reject, hold, controlled test or select for the defined case. Reopen the decision when the edition, terms, subprocessors, payment route or required workflow changes.
Common questions
What counts as evidence for a checklist line?
Each statement must be recorded as contractual, first-party documentation, independent evidence, observed test or assumption. Supplier plan pages can establish documented scope only, and do not prove suitability, availability or performance for the operator.
