Privacy policy.

Elliot Thomas, a sole trader trading as Product with Elliot, based in the United Kingdom. I am the data controller, which means I decide what is collected and why. There is no one else in the business.

The quickest way to reach me about anything on this page is [email protected]. If you need a postal address to make a formal request, email me and I will give you one.

Nothing that identifies you is collected simply for reading this site. Google Analytics records anonymous usage data: which pages get read, roughly where in the world you are, and whether you came from a search or a link. It is never linked to your name or email. Everything below is data you give me directly.

If you book a call

Your name, email address, your answer to "what is making you look for product help right now", and optionally your company website, any notes you add and the email addresses of any guests you invite. The booking runs on Cal.com.

If you email me

Your email address and whatever you put in the message.

Hosting records

This site is served by Cloudflare, which logs request data including IP addresses to deliver pages and block attacks. I do not use those logs for anything else and I cannot identify you from them.

To reply to you

Legitimate interests. You contacted me about my services and it is reasonable to expect a reply. Where the conversation is heading toward working together, this is also taking steps before entering a contract at your request.

To run an engagement

Performance of a contract, once there is one.

To keep my books straight

Legal obligation. HMRC requires a sole trader to keep business records, and invoices have names on them.

To keep the site up

Legitimate interests in serving pages and defending against attacks.

To see which pages get read

Legitimate interests. This is Google Analytics, and the interest is knowing which pages are worth keeping on a site I write myself. It is aggregate and anonymous, and it is never joined to anything you send me. You can object, and the cookies section below lists the ways to stop being counted.

I do not use your data for advertising, I do not profile you, and there is no automated decision-making anywhere in this. I will not add you to a mailing list because you booked a call.

I do not sell data and I do not share it for anyone else’s marketing. These are the only companies that process it on my behalf, and they process it only to provide the service named.

Cal.com, Inc.

Runs the booking on the Let’s talk page and holds what you type into it.

Google

Three separate things. Email and calendar, so anything you send me lands in a Google Workspace inbox and confirmed bookings appear in Google Calendar. And Google Analytics, if you allowed it, which receives anonymous usage data about this site.

Cloudflare, Inc.

Hosts and serves this site.

All three are US companies, so your data is transferred outside the UK. Those transfers rely on the UK’s approved safeguards: the UK Extension to the EU–US Data Privacy Framework where the provider is certified, and the International Data Transfer Agreement where it is not.

I will also hand over data if the law requires it, which for a business this size means essentially never.

This site uses Google Analytics. I use it to see which pages get read and which do not, so I can cut the ones nobody wants. There is no advertising here, no advertising pixels, no session recording and no heat-mapping, and I do not run remarketing.

Google Analytics loads on every page and sets two cookies:

_ga

Tells Google Analytics whether you are a returning visitor. Expires after 2 years.

_ga_ZYZMZKM80Z

Keeps a set of page views together as one visit rather than several. Expires after 2 years.

What it records is aggregate and anonymous: pages viewed, roughly which country you are in, and whether you arrived from a search, a link or directly. It is never joined up with your name or your email, even if you later book a call or send me a message.

If you would rather not be counted, any of these work and none of them affect the site: install Google’s official Analytics opt-out browser add-on, turn on your browser’s tracking protection, or block cookies for this domain in your browser settings. You can also email me and I will ask Google to delete the data associated with your visit.

Separately from analytics, the Let’s talk page embeds the Cal.com booking widget. Loading it places three more cookies, all from cal.com, and these are the ones without which the booking cannot run or stay secure:

__cf_bm

Cloudflare bot protection for the booking widget. Expires after 30 minutes.

__Secure-next-auth.csrf-token

Stops forged booking submissions. Deleted when you close the browser.

__Secure-next-auth.callback-url

Keeps the booking flow on track between steps. Deleted when you close the browser.

None of those three profile you or follow you anywhere else. The widget also sends error reports to Sentry, Cal.com’s monitoring provider, when something breaks. If you would rather not load any of it, do not open the Let’s talk page. Email me instead and I will send you a few times that work.

Enquiries that do not turn into work

Deleted within 12 months of our last exchange.

Client records

Invoices and the records behind them are kept for at least five years after the filing deadline for the relevant tax year, because HMRC requires it. Working material is deleted or returned at the end of the engagement.

Email

Kept while the conversation is live, then deleted in line with the two periods above.

Analytics

Held by Google rather than by me, and deleted on Google Analytics’ own retention schedule. It is anonymous usage data, so there is nothing in it that points back to you.

If you want your data gone sooner, ask. Unless HMRC requires me to keep it, I will delete it.

Under UK data protection law you can ask me to do any of the following, free of charge. I will respond within one month.

• Tell you what I hold about you, and give you a copy
• Correct anything that is wrong
• Delete it
• Restrict what I do with it while a dispute is sorted out
• Give you a portable copy, or send it to someone else
• Stop processing it where I am relying on legitimate interests
• Withdraw consent, where consent was the basis, without affecting anything done before

Email [email protected] and say what you want. You do not need to use any particular form of words. To stop analytics counting you, the cookies section above lists ways to do that yourself without emailing anyone.

If you think I have handled your data badly, tell me first and I will try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, and you do not have to raise it with me before going to them.

If the site starts collecting something new, or I add a tool that sets a cookie, this page changes before that goes live and the date at the top changes with it. There is no archive of previous versions, so if you need one, ask.