4 details are still missing from this page, marked in amber below. Fill them in and delete this strip before the site goes live. Nothing else on the page is waiting on anything.
The Ghost · Legal
What I collect, why I've got it, who else can see it, and how to make me delete it. Written to be read rather than survived.
I'm the data controller for everything described on this page. That means the decisions about your information are mine, and so is the responsibility.
5 situations. That's the lot.
The 12 questions, your answers, your score and your band all live in your own browser and never leave it. Nothing is sent anywhere. I don't know you took it, I don't know what you scored, and there's nothing for me to store.
The only way I find out anything is if you type your email address into the box afterwards, which is a separate decision and an obvious one.
Close the tab and it's gone. That isn't a privacy feature I bolted on. It's just how the page is built.
I'm 1 person. There's no team, no agency, no contractor, and nobody junior. Your information isn't passed to anyone for their own purposes and it's never sold, rented or traded. It does pass through the companies whose tools I run the business on, and here they all are.
Beyond that, the only time I'd hand anything over is if a court or a regulator required it, and I'd tell you unless I were legally prevented from doing so.
4 of the companies above are in the United States, so your information goes there. That's allowed, and it's covered by the UK extension to the EU-US Data Privacy Framework, or by the UK's International Data Transfer Addendum where a supplier isn't certified under it.
In plain terms: they're contractually bound to protect it to the standard UK law requires, and if they don't, that's on them and on me.
If you want to see the specific mechanism for a specific supplier, email me and I'll send it.
UK GDPR gives you these. Email [email protected] and use any of them. I have to answer within 1 month and I don't charge for it.
I don't do automated decision-making or profiling. No scoring, no segmentation by behaviour, no lead grading. If you're on the list you get the same letter as everybody else on the list.
Encrypted devices, a password manager, 2-factor authentication on every account that offers it, and no shared logins because there's nobody to share them with.
I keep the least I can get away with. The list holds an email address and sometimes a first name, and that's the entire profile.
If something did go wrong in a way that put you at risk, I'd tell the ICO within 72 hours and I'd tell you without dressing it up.
Email me first. I'd rather fix it than have it escalate, and I'm not going to be defensive about it.
You don't have to come to me first though, and you can complain to the regulator whether or not you do.
Last updated 10 September 2026