Privacy
How I handle your information
Last updated: 30 September 2026
This page explains what personal information I collect through this site, why, who helps me process it, how long I keep it and what you can ask me to do with it. I follow the standard set by the EU General Data Protection Regulation (GDPR) for everyone, because it is the stricter rule. Canadian visitors are also covered by PIPEDA, and the rights below meet or exceed it.
What I collect
- Anything you send me by email: your name, address and whatever you write. I use it only to reply and, if we work together, to run the engagement. There is no form on this site and no third party in between.
- Standard server logs kept by my host (IP address, browser type, pages requested), used to keep the site secure and working.
- Nothing else. No analytics, no advertising or tracking cookies, no consent banner, because none is needed.
Why I'm allowed to
- Replying to your email: steps taken at your request before entering a contract, and my legitimate interest in answering people who get in touch.
- Server logs: my legitimate interest in security and reliability.
- I never sell personal information, share it for advertising, or add you to a mailing list without you asking.
Who processes it
- Vercel Inc. hosts this site and keeps the server logs. Vercel is a US company; transfers are covered by Standard Contractual Clauses.
- Google Workspace holds the email correspondence between us, including anything you send through the form once it reaches my inbox.
- Each is bound by a data processing agreement and may use your information only on my instructions. Nothing else runs on this site: the fonts are served from my own domain, so no visitor data goes to Google or any other third party simply by loading a page.
Your rights
- Ask what I hold about you, get a copy, or have it corrected, deleted or restricted.
- Object to how I use it, or ask for it in a portable format.
- Enquiries that don't become projects are deleted within 24 months. Client records are kept for seven years, to meet Canadian tax requirements. Server logs are typically kept 30 days.
- Ask me by email and I'll reply within 30 days, at no charge. If you aren't satisfied, you can complain to the Office of the Privacy Commissioner of Canada, or your local data protection authority in the UK or European Economic Area.
Security
The site is served over HTTPS. Access to enquiries is limited to me, protected by a strong, unique password and two-factor authentication. If a breach affects your rights, I'll notify you and the relevant authority as the law requires.
Contact me