Privacy policy

What we collect

From the contact form: your name, work email, company name and, if you add it, a note. It’s emailed to our team so we can reply, and the site doesn’t store it. The server that sends it keeps your name and company in its logs. No accounts, and we set no cookies of our own. Cloudflare, in front of our analytics, may set a security cookie (__cf_bm) that expires after 30 minutes.

Visits. Our analytics tool records each page you open: its address, the time, your IP address, browser, device and language. It recognizes a returning visitor by IP address and browser language, and stores nothing in your browser.

Standard request data. When a page loads, our host records the IP address, browser, page and time, as every web server does. We don’t use it to identify or follow you; it keeps the site running and protected.

If you write to us. We use your letter only to reply.

Who else sees a page load

• Amazon Web Services hosts the site and keeps its standard request logs. Privacy policy
• Google Fonts serves one of our typefaces, so Google receives your IP address and browser when a page loads. Privacy policy
• ComplyEdge serves the trust seal in the footer, so it receives the same request data. Privacy policy
• DigitalOcean runs our analytics tool, which receives the visit data above. Privacy policy
• Cloudflare passes requests to our analytics tool, so it receives the same request data. Privacy policy

When you send the contact form, it also passes through:

• Cloudflare checks that the form is being sent by a person, so it receives your IP address and browser details when you open the form. Privacy policy
• DigitalOcean runs the server that turns your message into an email to our team. Privacy policy
• Brevo sends that email. Privacy policy
• Google Workspace holds our team's inboxes, where the email arrives. Privacy policy

No one else. We share nothing further, unless the law requires it.

What we don’t do

No ad pixels, no session recording, no outside analytics. No selling: we don’t sell or rent personal information, or share it for advertising.

Do Not Track. We don’t respond to Do Not Track. Our analytics tool also runs on other sites our founder runs, so it can recognize the same browser there. It runs on no one else’s sites, and none of it is used for ads.

If you’re a client

One piece at a time. We ask for access as each step of the work needs it, and only for that step. You decide what we see, and you can take access back.

Used only for your service. What you share is used to run your Second Look and nothing else.

Your agreement governs. Client data is covered by your agreement with us. Where it differs from this page, the agreement wins.

How long it’s kept

• Request data: for our host’s standard log period.
• Visit data: in our analytics tool until we delete it, and in its server logs for DigitalOcean’s standard log period.
• Letters you send us: as long as the conversation needs them.
• Client data: as your agreement sets out.

Your choices

Ask what we hold about you, have it corrected, or have it deleted, wherever you live. Write to us at the address below. For visit data, include the IP address you visited from; our analytics files visits by IP address and browser language, not by name.

To turn off our analytics, turn off JavaScript for this site in your browser.

We protect what we hold with reasonable measures. No system is perfectly secure.

The site is for businesses and not meant for children under 13. We don’t knowingly collect their information.

Changes to this policy

When this policy changes, the date at the top changes. If a change affects how we use client data, we tell clients directly before it applies.

Contact