Privacy policy

Starter copy — requires professional review.This is starter copy written to be sensible and complete. Have qualified counsel review it before the site goes live commercially, and before enabling any third-party analytics or email provider.

What we collect

Newsletter subscribers — email address, consent text, subscription status, an unsubscribe token, and the date of subscription.
Contact form submissions — name, email, topic and message.
Analytics — page views, topic-hub visits, search usage, product-link clicks and affiliate-link clicks. No name, email or other personal data is stored.
Editorial users — email, display name, password hash and role for staff and contributors who log in.

How we use it

To send the newsletter brief, where you have consented.
To respond to contact and partnership enquiries.
To improve the site — understanding what content is read, searched and clicked.
For editorial operations — content management, research library and workflow.

Who we share it with

Subscriber and contact data is stored locally in our own database and is not sold, rented or shared with third parties for marketing. If we enable a third-party newsletter or analytics provider in the future, we will update this policy and require a data-processing agreement.

How long we keep it

Newsletter subscribers remain until they unsubscribe or are removed. Contact messages are kept as long as needed to respond and to maintain an editorial record. Analytics events are retained for a limited period and are not personally identifiable.

Your rights

Depending on where you are, you may have the right to:

access the personal data we hold about you;
correct inaccurate data;
delete your data, subject to legitimate editorial and legal retention needs;
object to or restrict processing; and
withdraw consent at any time.

To unsubscribe from the newsletter, use the unsubscribe link in any email or visit the unsubscribe endpoint directly. To exercise any other right, contact us using the details on the contact page.

Cookies

We use a single session cookie for editorial staff who log in. It is HttpOnly and SameSite=Lax. No third-party tracking cookies are enabled by default.

Security

Passwords are hashed with scrypt and sessions are stored hashed in our database. Editorial access is role-restricted and logged. We do not store secrets in the database.

Changes

We will update this policy when our data practices change materially, and we will note the date of the most recent update at the top of this page.