// Privacy

What this site knows about you, in plain English.

Last updated 5 October 2026

Who's responsible

This site is run by Digital Artizans Ltd (Company No. 16550910, England & Wales) — that's me, Andrei Achim. Digital Artizans Ltd is the controller of the personal data described here. For anything about your data, email andrei@andreiachim.com and a person, not a process, answers.

What I collect, why, and on what basis

Data protection law asks me to name the legal basis for each thing. Each one is in brackets.

• Booking a call or a session (the discovery call, a paid session, a catch-up) — your name, email, the time you pick and anything you write about what you want to fix. Used to hold the slot, send the calendar invite and Google Meet link, and run the session. For a paid session, I also keep the payment reference, the amount and whether it's paid, and send up to two reminder emails while the slot is held. Payment is by bank transfer, so no card details ever touch this site. (To deliver the session you asked for. Payment records: because the law requires me to keep accounts.)
• Free guides and checklists — the AI Admin Audit checklist (your email, and your first name if you give it), and the guides on /lead-engine and The Board (your email and which guide you asked for). Used to send you what you asked for. You're not added to a newsletter unless you ask to be. (Your consent, given by asking.)
• The CMO Circle sign-up (an unlisted page built with CMO Circle) — your name, email, LinkedIn profile link and the topics you pick. Saved so you can be matched for 1:1 rounds. (Your consent, the box you tick.)
• Emails you send me — your message and address, to reply. (My legitimate interest in answering you.)
• Meta pixel — only if you accept the cookie banner. It tells me which pages bring people here and lets me measure ads. Decline and it never loads, never sets a cookie, and the site works exactly the same. (Your consent, which you can withdraw any time below.)
• Visit counts, with no cookie and nothing that identifies you. Each page you open sends one line to my database: the page, the name of the site that linked you here (say, linkedin.com, never the full address), any campaign tags in the link, whether you're on a phone, tablet or desktop, and your country as the hosting platform sees it. Your IP address is looked at in passing, to slow down anyone hammering the site and to leave my own visits out, and never stored. There's no ID, so two page views can't be joined up or traced back to you. It's how I see which posts bring people here without asking you for a cookie. (My legitimate interest in knowing what's useful, with as little data as it takes.)
• Server logs — the hosting platform (Vercel) keeps standard technical logs, which include IP addresses, to keep the site running and secure. (Legitimate interest in a working, secure site.)

Nothing on this site makes automated decisions about you, and none of it profiles you.

Cookies and browser storage

• da_consent — remembers your cookie choice, kept in your browser's local storage rather than a cookie. Essential, first-party, no tracking.
• da_projects — a cookie set only if you sign in to the private project workspace. Essential.
• da_owner — exists only in my own browsers. The visit counter checks for it so my own visits aren't counted. Nothing is written to your device.
• Demo pages — some interactive demos (BuildFlow, for one) save your edits in your own browser so they're still there when you come back. That stays on your device and is never sent anywhere.
• Meta pixel cookies (such as _fbp, and Meta's own cookies on facebook.com) — set only after you accept the banner.

Who else touches the data

Nothing is sold, rented or swapped. These companies process data for me to make the site work:

• Vercel — hosting. The site's server code runs in Frankfurt, and pages are served from whichever of Vercel's locations is nearest you. Vercel is a US company.
• Supabase — the database, stored in Frankfurt.
• Google — calendar invites, Google Meet links and the emails I send.
• Meta — the pixel, only after you consent.

Data leaving the UK. Vercel, Google and Meta are US companies, so some data may be handled in the US. Those transfers are covered by the UK–US data bridge where the company is certified under it, and otherwise by the standard contractual clauses with the UK Addendum in their data processing terms.

How long I keep it

• Paid sessions and payment records — six years after the end of the financial year they fall in, because HMRC requires company records to be kept that long.
• Other bookings — the discovery call, catch-ups, or a paid booking that was never paid — 12 months after the date of the call.
• Guide and checklist emails — until you ask me to remove them, and at most two years after you signed up.
• CMO Circle sign-ups — while the rounds run, or until you ask me to delete them.
• Emails — as long as the conversation is useful, and two years at most after it ends, unless they relate to paid work.
• Visit counts — kept as a running tally, since they hold nothing about you.
• Server logs — for the short period Vercel's own retention allows.

Want something gone sooner? One email and it's deleted, unless the law makes me keep it.

Your rights

Under UK GDPR — and EU GDPR, if you're in the EU — you can ask me to:

• Show you what I hold on you, and give you a copy.
• Correct anything that's wrong.
• Delete it.
• Limit what I do with it while something is sorted out.
• Stop using it where I rely on legitimate interest, such as the visit counts or server logs.
• Hand it over in a format you can take elsewhere, for what you gave me to book or by consent.
• Withdraw consent any time, for the pixel (the button above) or for anything you signed up to. It doesn't undo what happened before.

Email andrei@andreiachim.com. I answer by hand, within a month at the latest and usually much sooner. If you're unhappy with an answer, you can complain to the ICO, the UK regulator, or, in the EU, the data protection authority where you live.