Privacy Policy

I collect what you put in the application form plus basic technical data. I use it to decide whether we are a fit and to get in touch. I do not sell it.

Application data: name, email, brand name, lane, social handles and website, audience size, whether you currently sell something, what is currently broken, what you can put behind a launch, timing, and your terms acknowledgement.

Technical data: referring URL and UTM parameters, timestamp, and IP address used for rate limiting and spam prevention.

Booking data: if you book a call, handled by Cal.com, including the time of the booking which is recorded against your application.

Correspondence: any correspondence you send.

To read and assess your application, to contact you if I think we are a fit, to schedule and track calls, to prevent spam and abuse, and to keep records of engagements.

Legitimate interest in assessing and responding to business enquiries, and taking steps at your request before entering a contract. Where consent applies you can withdraw it at any time.

Supabase for the primary lead database, Google Sheets for a working copy used to track applications through to booked calls, Resend for transactional email, Cal.com for booking and calendar data, and Vercel for hosting and server logs. Each has its own privacy policy.

Applications are kept up to 24 months so I can revisit brands that were not a fit at the time. Client engagement records are kept as long as tax and accounting law requires. You can ask for earlier deletion.

For clients I may keep administrative access to systems built during an engagement, including after it ends, as described in section 8 of the Terms. Where those hold your customers' personal data the client remains the data controller and I act as a processor, and clients can request revocation or deletion in writing at any time.

Access, correction, deletion, objection, restriction, withdrawal of consent and portability. Email Email coming soon and I will respond within 30 days. UK and EU visitors can complain to their local data protection authority. California residents have CCPA rights including the right to know and to delete, and I do not sell personal information.

Data may be processed in the United States and elsewhere by the subprocessors named above under their own safeguards.

HTTPS in transit, database access restricted to server side service role credentials, row level security enabled. No system is perfectly secure and I cannot guarantee absolute security.

Not directed at anyone under 18 and I do not knowingly collect their data.

This policy may be updated and the last updated date will change. Questions: Email coming soon.