Contracting party
The Terms of Use are an agreement with beehiiv Inc., a US company.
beehiiv is quick to set up, and that is exactly the problem: the newsletter is running before anyone has checked how the data gets to the US and whether sign-ups were confirmed.
The Terms of Use are an agreement with beehiiv Inc., a US company.
According to the Trust Center, publication and subscriber data sit in AWS regions in the United States. No EU option is described there.
On 3 October 2026 the official list had no entry for beehiiv, neither active nor inactive.
For transfers, the privacy policy names regulator-approved Standard Contractual Clauses. The Data Privacy Framework appears neither there nor in the data protection addendum.
The Data Protection Addendum forms part of the terms between you and beehiiv and applies without a separate signature.
Double opt-in is built in but optional. Once switched on, a new sign-up stays 'Pending' until the confirmation is clicked; Smart Nudge sends one reminder after 48 hours.
The subscriber profile shows 'Subscribed on' with the date and time of sign-up.
With your own domain, beehiiv handles SPF and DKIM through CNAME records. Since February 2024 every custom domain also needs a DMARC record.
Before every import you confirm that everyone on the list knowingly consented. beehiiv does not create any proof in the process.
This page is not legal advice and we are not a law firm. We report what the vendor itself documents, with a date. Vendors change their terms; the linked source in its current version always prevails.
Because beehiiv is not listed under the Data Privacy Framework, transfers rest on Standard Contractual Clauses. That is permitted but means more paperwork: a documented transfer impact assessment next to the entry in your records of processing is the usual practice.
Double opt-in applies at sign-up. Imported contacts get in on nothing more than your tick in the import dialogue. You have to bring the proof for them from the old system; otherwise they need a re-opt-in.
Switch on double opt-in, write the confirmation email in the right language, check embedded forms and Smart Nudge. New subscribers only count after the click.
Your own sending domain with SPF, DKIM and DMARC, so emails come from your domain and stay out of spam.
Split the existing list into documented, re-opt-in and delete. Document the transfer on Standard Contractual Clauses and write the paragraph for your privacy notice.
No tool is compliant on its own; it depends on the setup. beehiiv provides built-in double opt-in and a data protection addendum. The data sits in the US, though, and beehiiv relies on Standard Contractual Clauses rather than the Data Privacy Framework for transfers. You need to document that.
Not on 3 October 2026: the official list had no entry for beehiiv. The privacy policy names Standard Contractual Clauses as the basis for transfers.
Yes, as an optional setting. Once on, every new sign-up stays 'Pending' until the confirmation is clicked, and Smart Nudge sends a reminder after 48 hours. It does not apply to imported contacts.
According to its Trust Center, in AWS regions in the United States. beehiiv describes no EU option.
The setup costs € 890 for your whole stack. The other tools we have checked the same way:
Tell us which tools you use and where your contacts come from. In the first call we will tell you whether € 890 covers it or whether more needs fixing, honestly either way.
Request the setup