I keep this simple because my data practices are simple: I collect email addresses from people who subscribe to my newsletter, and whatever you choose to tell me if you use the contact form. That’s it. This page explains the details, including the data collected automatically by the services I use to host the site, run the form, and send the newsletter.
What I collect
Your email address, if you subscribe to the newsletter. The Deliberate is hosted on Substack. When you subscribe, you provide your email address, and Substack stores it on my behalf. If you create a Substack account, you may also provide a name or profile information to Substack directly.
Newsletter engagement data. Substack reports aggregate and subscriber-level engagement information back to me — things like open rates, pageviews, subscriber counts, and how people found the publication. I use this to understand whether the writing is landing, not to build profiles of individual readers.
Basic technical logs from visiting this site. This website is hosted on GitHub Pages. GitHub automatically logs technical information about visitors, which can include IP address, browser and device type, referring site, pages viewed, and the date and time of each request. GitHub uses this to operate the service and maintain its security. I do not have access to these logs, and I cannot identify you from them.
Contact form submissions. If you use the contact form on this site, I receive your name, your email address, and the content of your message. The form is processed by Formspree, which also automatically collects technical information with each submission — including IP address, browser type, domain names, access times, and referring website addresses — which it uses to prevent fraud, keep the service secure, and operate the service.
Anything else you send me directly. If you email me or reach out through another channel, I have whatever you chose to put in that message.
What I don’t collect
I do not run analytics software on this site. I do not use advertising or tracking pixels of my own. I do not sell, rent, or trade your information to anyone. I do not collect payment information through this site.
Why I collect it
- To send you the newsletter you asked for. That’s the only reason I have your email address.
- To respond to you if you’ve contacted me.
- To understand readership in aggregate so I can write better things.
Under the GDPR, my legal basis for processing subscriber emails is your consent (which you give by subscribing, and can withdraw at any time by unsubscribing). For contact form submissions, correspondence, and general operation of the site, my basis is legitimate interest in running a small consulting business and responding to people who ask to hear from me.
Who else touches your data
Four companies, all acting as service providers to me:
- Substack Inc. hosts the newsletter and stores subscriber emails. Substack acts as a data processor on my behalf for subscriber data, and also collects reader data under its own policies. See Substack’s Privacy Policy ↗.
- GitHub, Inc. (Microsoft) hosts this website. See GitHub’s Privacy Statement ↗.
- Google LLC (Alphabet) serves the typefaces this site is set in, through Google Fonts. Your browser requests those font files from Google’s servers each time a page loads, which means Google receives your IP address and basic request information. Google logs those requests and states that it does not use them to build advertising profiles, and that Google Fonts sets no cookies. See Google’s Privacy Policy ↗ and its Google Fonts privacy FAQ ↗.
- Formspree, Inc. processes contact form submissions and delivers them to my inbox. Formspree operates as a data processor and relies on Standard Contractual Clauses for international transfers. See Formspree’s Privacy Policy ↗.
Cookies
This site does not set cookies and does not use tracking technologies. The one third-party resource a page loads is the typefaces, from Google Fonts as described above; those are served without cookies. The newsletter signup is a plain link out to Substack rather than an embedded form, so nothing loads from Substack while you’re here. Once you follow that link, you’re on Substack’s site and their cookie practices apply.
How long I keep it
I keep your email address for as long as you’re subscribed. If you unsubscribe, Substack retains a record of the unsubscribe so it doesn’t email you again. You can ask me to delete your information entirely and I will.
Contact form messages arrive in my email inbox and I keep them as long as they’re useful for the conversation or the client relationship they relate to. Formspree stores submissions in its own dashboard for 30 days, after which they are deleted from Formspree’s system. GitHub’s server logs are retained according to GitHub’s own retention schedule, which I don’t control.
Your choices and rights
You can unsubscribe from the newsletter at any time using the link at the bottom of every email. No hard feelings, no retention flow.
Depending on where you live — including the EU, UK, California, and a growing number of US states — you may have the right to request access to the personal information I hold about you, request its correction or deletion, object to certain processing, or receive a copy of it. To exercise any of these, email me at the address below. I’ll respond as quickly as I can, and within any legally required window.
I don’t discriminate against anyone for exercising these rights.
Security
Subscriber data lives inside Substack’s systems and contact form data passes through Formspree, which has completed a SOC 2 Type 2 audit by an independent third-party auditor. On my end, I limit access to my own accounts and don’t keep unnecessary copies of subscriber lists. No system is perfectly secure, but I take reasonable steps consistent with my obligations under New York’s SHIELD Act and similar laws.
Children
This site and newsletter are meant for a professional adult audience. I don’t knowingly collect information from anyone under 16. If you believe a child has subscribed, email me and I’ll remove the record.
Changes
If I change how I handle data, I’ll update this page and change the date at the top. Material changes affecting subscribers will be noted in the newsletter.
Contact
Questions, requests, or corrections:
Sam Spurlin
Deliberate Works LLC
sam@deliberateworks.com