Privacy Policy

The promise this policy exists to keep

The things you write in the audit are never published, quoted, sold, or used as marketing material. Not anonymised into a blog post, not screenshotted, not turned into a social media graphic, not sold to anyone for any price. They are used to build your result, to send it to you, and to send it back to you once six months later. That is the entire list.

That sentence is in the audit itself, and it is the promise the whole thing rests on. Everything below is the detail behind it.

What we collect

Three things happen on this site, and each collects something different.

If you take the Default Script Audit

• Your email address. Asked for on the last screen, so we can send you your result.
• Six short descriptions of parts of your life — your job, your city, what you studied, your evenings, what you're saving toward, and the goal you say out loud. You write these in your own words.
• Eighteen multiple-choice answers — for each of those six, when you decided it, whose voice it was, and whether you'd choose it again.
• One multiple-choice answer about how Sunday evenings feel.
• Up to three longer written answers. The first is required; the other two you can skip, and skipping stores nothing.
• Your result — the number, the pattern, the contradiction and the pressure point. This is calculated from your answers and stored with them. It quotes your own words back to you, so it counts as your writing too.

If you subscribe to the weekly note

Your email address, the date, which form you used, and which version of the wording above the form you agreed to. That last part is the record of your consent — we keep it so we can show you agreed, and to what.

If you join the waitlist

Your email address and a reference to the audit you'd just finished. Nothing else.

If you buy The Redesign

• Your email address, which is also how we find the audit it's built on.
• A record of the purchase — when, how much, in what currency, and the reference numbers our payment processor gives us so a refund can be matched to a payment. Never your card number: see "Who else touches it".
• Everything you write in the workbook, saved as you go, and your Personal Policy once you've dated it. These are your words and they get the same promise as your audit answers.
• Where you've got to — which session you last saved, and when — so the link reopens where you left off and so we know when to send the next-session email, and when not to.

What we deliberately don't collect

We don't store your IP address, your browser's user agent, a referrer, or any copy of your request. We set no analytics cookies and run no advertising trackers. There are no hidden fields on any form, and our error logs record the reason a thing failed, never the contents of what you sent.

We do use Cloudflare Web Analytics, which counts page views without cookies, without storing anything on your device, and without any identifier that could be tied back to you or followed to another site. It tells us a page was read; it cannot tell us who read it.

Cloudflare, who serve this site, necessarily see the connection your browser makes — that is what serving a website is. We don't keep any of it, and we can't associate it with your answers.

Why we're allowed to — the lawful basis for each thing

Under the UK and EU GDPR, every use of your data needs a specific legal basis. Here are ours. There are six bases available; we rely on three, and listing the other three would be decoration.

• Producing your result and emailing it to you — performance of a contract, Article 6(1)(b). You asked for a result; this is us providing it. Without your email we can't deliver the thing you came for.
• The Redesign — performance of a contract, Article 6(1)(b), for everything it needs: taking the payment, sending your link, saving what you write, the emails that tell you the next session is ready, and returning your Policy with the Six-Month Letter. Keeping the purchase record afterwards is a legal obligation, Article 6(1)(c).
• The Six-Month Letter — also Article 6(1)(b). It's part of the service described on the screen where you give us your email, not an afterthought bolted on later. You can stop it in one click from any email we send, without affecting anything else.
• The weekly note — consent, Article 6(1)(a). Separate form, separate decision, and it only starts once you click the link in a confirmation email. Taking the audit does not subscribe you to anything.
• The waitlist — consent, Article 6(1)(a). You press a button that says what it does.
• Keeping the site up and keeping spam out — legitimate interests, Article 6(1)(f). This covers the anti-spam check on our forms and Cloudflare's protection of the site. Our interest is in a site that works and a database that isn't full of junk; the effect on you is a checkbox you usually never see.

Who else touches it

Four companies, and no others. We use no advertising networks, no data brokers, no email marketing platform, no analytics company, and no social media pixels.

• Cloudflare, Inc. — hosts the site, runs the database your answers are stored in, routes mail sent to hello@, provides the anti-spam check on our forms, and counts page views through its cookieless Web Analytics. They hold everything. Cloudflare's privacy policy.
• Resend (Plus Five Five, Inc.) — sends our email. To send you your result, they receive your email address and the text of the message, which includes your six short answers and your result. They send through Amazon SES, so Amazon Web Services processes the message in transit. Resend's privacy policy.
• Google LLC — mail sent to hello@thepersonalpolicy.com is delivered into a Google Workspace mailbox. If you email us, Google processes that email. Google's privacy policy.
• Stripe, Inc. — takes payment if you buy something. When you pay, you're on a page Stripe hosts: your card number, expiry and security code go to Stripe and never touch our systems. Stripe tells us that a payment succeeded, the amount, your email address, and the reference numbers needed to refund it; that is everything we receive. Stripe also sends the receipt. Stripe is a controller of the payment data it holds for its own legal obligations, such as fraud prevention. Stripe's privacy policy.

None of them is permitted to use your data for their own purposes. If we ever add a fourth, this list changes before it happens, not after.

How long we keep it

• Audit answers: 24 months from the day you take it. Then an automatic job overwrites your email address and every word you wrote, keeping only the number, so it still counts in a total. Twenty-four months is six months to send the letter, plus room to re-send a result you lost, plus a margin. After that there's no purpose left that would justify keeping what you wrote, so we stop keeping it.
• Newsletter: until you unsubscribe. Then the record goes.
• Waitlist: until the product it's for launches, or until you ask us to remove you.
• The Redesign: the same 24 months as the audit it's built on. The purchase record, what you wrote, and your Personal Policy are kept while your audit is, so the link keeps working and the six-month letter can carry your Policy back to you. The purchase record itself — date, amount, and the processor's reference numbers, with your email overwritten — is kept for as long as tax and accounting law requires, which is longer; it holds nothing you wrote.
• Email you send us stays in the mailbox until it's dealt with and cleared out.

Ask us to delete any of it sooner and we will. You don't have to wait for the clock.

Your rights

If the UK or EU GDPR applies to you, you have all of these. If you're in California, Colorado, Connecticut or a similar state, you have close equivalents. We apply them to everyone regardless of where they live, because operating two standards would be more work than operating the better one.

• Access. Ask what we hold about you and we'll send you all of it.
• Rectification. Something wrong? Tell us and we'll fix it.
• Erasure. Ask us to delete your data and we will. For audit answers this means your email and every word you wrote is overwritten, permanently, and any waitlist or newsletter record is deleted outright. If you bought The Redesign, the same request erases your email, everything you wrote in it and your Personal Policy, and ends access; the bare purchase record stays for accounting, as described above. What that reaches and doesn't is set out just below — we'd rather tell you than let you assume.
• Portability. Ask for your answers in a machine-readable file and we'll send you JSON.
• Objection. Object to anything we do on the basis of legitimate interests, and we'll stop unless we can show a compelling reason not to.
• Withdrawing consent. Where consent is the basis — the newsletter, the waitlist — you can withdraw it at any time. That doesn't undo anything we did lawfully before you withdrew it.
• No automated decisions. Your result is calculated by a formula, but it decides nothing about you. It produces a number and some text for you to read. Nothing is denied, granted or scored against you.

How to use any of them: email hello@thepersonalpolicy.com and say what you want. You don't need a template, a reason, or a formal tone. We'll respond within 30 days, and we may ask you to confirm you control the address, because handing someone's answers to whoever asks would be its own privacy failure.

To stop email without writing to anyone, use the unsubscribe link at the bottom of any message we send. It works in one click and needs no login.

The three long answers never leave our database

The Invisible Year, the Permission question and the Future Me question are the most personal things on this site. They are stored in our database, they are used to shape your result, and they go nowhere else — they are not included in any email we send, so our email provider never receives them and never stores a copy. Only your six one-line descriptions and your result are in the message that reaches your inbox.

What erasure reaches, and what it can't

Deleting your data removes it from our database. Three things it cannot undo, and it would be dishonest to imply otherwise:

• Emails already sent. Your result email is in your inbox and we can't reach into it. Nor can we unsend it.
• Our email provider's own logs. Resend keeps message content and delivery logs for 30 days before deleting them automatically. That copy is on their systems, not ours. If you need it gone sooner, tell us and we'll ask them to remove it.
• Database backups, for 7 days. Cloudflare's database service keeps a rolling 7-day point-in-time history so a database can be restored after a mistake. It is always on and cannot be turned off. Your erased data sits in that history for 7 days before ageing out, and we would only ever restore from it to recover from a failure — never to bring back something someone asked us to delete.

After those windows pass, it's gone.

Children

This site is for adults. The audit asks people to examine their job, their relationships and the decisions running their life, which isn't material for children, and we ask on the entry screen that under-16s don't use it.

We don't knowingly collect data from anyone under 16, and nothing here is designed, written or promoted to appeal to children. If you believe a child has given us their data, email hello@thepersonalpolicy.com and we'll delete it without asking you to prove anything.

Cookies and analytics

Short version: we don't set any, and the only thing we measure is cookieless. The cookie policy has the detail, including the one exception — Cloudflare's security cookies, which are strictly necessary and which no site behind Cloudflare can turn off.

When this changes

We'll change the date at the top and post the new version here. If a change actually affects you — a new company handling your data, a new use for your answers, a shorter or longer retention period — we'll email everyone we have an address for before it takes effect, not after.

We won't quietly widen what we do with your writing. That's the one thing this document exists to prevent.

Questions

hello@thepersonalpolicy.com. A real person reads it.