Privacy Policy

01What we collect from this website

What you type into a form, plus limited usage and advertising-measurement data from Google Analytics (GA4) and the Meta Pixel so we can understand traffic and measure campaigns. We do not sell your case-review form contents to advertising networks.

• Engagement enquiries: name, work email, organisation, role, phone if supplied, approximate team size, area of interest and your message.
• Account recovery case reviews: name, contact email, platform, account URL, issue type, incident date if supplied, description, prior attempts, ownership evidence as text, urgency and consent. We do not collect passwords, one-time codes, backup codes or private keys through the website.
• Newsletter subscriptions: email address only (legacy; the site no longer offers a public subscribe form).
• Google Analytics 4 (measurement ID G-09DGFC3VZV): page views, approximate location from IP, device/browser signals, and first-party conversion events that never include passwords, OTP, case free text, or form field contents.
• Meta Pixel (pixel ID 1796076398384347): page views and conversion events for Meta ads measurement and remarketing. Event payloads never include passwords, OTP, case free text, or form field contents.
• Server logs held by our hosting provider: IP address, user agent and requested path, retained briefly for abuse prevention and availability.

02Why we hold it

Enquiry and recovery-case data is used to reply to you, qualify the request, and keep a record of the conversation. Newsletter data (if any remains) is used only to send the newsletter. That is the entire purpose list.

We do not sell data, share it with advertising networks, or add enquirers to a marketing list without an explicit request. Recovery submissions are never used to attempt platform logins with credentials. We do not ask for those credentials on the site.

03How long we keep it

Engagement enquiries that do not become engagements are deleted within twenty-four months. Recovery case submissions that are not accepted or completed are deleted within twenty-four months unless a longer period is required for fraud, dispute or legal reasons. Newsletter records are kept until you unsubscribe, after which we retain only a suppression record so we do not accidentally contact you again.

Engagement records are retained per the retention period agreed in the relevant contract.

04Processors we use

Form submissions are stored in a managed Postgres database provided by Supabase. Email is handled by a standard business email provider. The site is served from a commercial hosting platform. Aggregate site analytics are processed by Google Analytics (Google Ireland / Google LLC). Advertising measurement and remarketing signals are processed by Meta Platforms via the Meta Pixel. Each of these processes data under their disclosed terms or as a processor for analytics and ads measurement.

05Engagement data and confidentiality

Findings, simulation results and any client material gathered during an engagement are treated as confidential by default, encrypted at rest, restricted to the named engagement team, and destroyed or returned at the end of the agreed retention period.

Simulation results identifying individual employees are shared with that individual and with the named client contact only. We do not publish, resell or reuse client data for research without written permission and full anonymisation.

06Your rights

You can request access to, correction of, or deletion of your personal data, object to processing, or ask for a copy in a portable format. Email [email protected] and we will respond within thirty days.

If you are in a jurisdiction with a supervisory authority for data protection, you have the right to complain to it.

07Children

This site is aimed at organisations and is not directed at children. We do not knowingly collect personal data from anyone under sixteen.

08Contact

Privacy questions, requests and complaints: [email protected].