Privacy
What this site collects, what happens to it, and what never happens to it.
Effective September 20, 2026.
The short version.
This site exists to send you my writing. To do that it needs your first name, your email address, and your two survey answers. It keeps them private, it never sells them, and you can leave with one click.
There are no cookies on any page you can read, no advertising trackers, and no analytics scripts of any kind. Nobody is following you around the internet because you came here.
That is the whole arrangement. Everything below is the detail, written out properly, because a privacy policy that only says the reassuring part is not worth reading.
Who is responsible for your information.
Lorenzo Ayres. This is a personal site and I run it myself. Under the European and United Kingdom rules I am the data controller, which means I am the person who decides what gets collected and why, and I am the person you complain to.
You can reach me at the address at the bottom of this page. It is a real mailbox and I read it.
What you give me, and only when you choose to.
Nothing on this site asks you for anything until you decide to join the newsletter. Reading every page, downloading the book list, and watching the videos all happen without you handing over a single thing.
When you do join, the form asks for four things. Your first name. Your email address. Which of three descriptions fits you, which is the first survey question. And a short answer to a follow up question about what you are working on, building, or investing in.
That is the entire list. I do not ask for your last name, your phone number, your company, your postal address, your job title, or your income, and there is nowhere on this site to give me any of them.
What the site records on its own.
Two categories, and both are narrower than you are probably expecting.
The first is how you arrived. If you reach this site from a link carrying campaign tags, the site reads those tags, the page you landed on, and the address of the site that referred you. This is how I know whether a video or a post is what brought you here. It contains nothing about you personally. It sits in your browser, and it reaches me only if you join the newsletter, attached to your signup. If you never join, it never leaves your browser, and your browser throws it away when you close the tab.
The second is the ordinary technical record that any web server keeps: the IP address a request came from, which browser made it, and when. My hosting provider keeps these to serve the site and keep it standing up. I do not use them to work out who you are, I do not combine them with the newsletter list, and I do not look at them except when something is broken or under attack.
The signup form also holds your IP address in memory for sixty seconds, for one purpose only, which is to stop a script submitting the form hundreds of times. It is never written to disk, never stored, and never attached to your record.
What I deliberately do not collect.
Nothing here counts as sensitive information under the California rules or as a special category under the European ones. No racial or ethnic origin, no political opinions, no religious beliefs, no trade union membership, no genetic or biometric data, no health information, no sex life or sexual orientation, no precise geolocation, no government identifiers, no financial account numbers, no login credentials.
There is no form anywhere on this site that could collect any of it, which is a stronger guarantee than a promise not to.
Why I use what I have, and what entitles me to.
Your name and email are used to send you the newsletter, which is the thing you signed up for. Your two survey answers are used to decide which version of what I write reaches you, so that an investor and an operator do not get an identical email. The arrival information is used to understand which of my own posts and videos actually bring people here.
If you are in the European Economic Area or the United Kingdom, the law asks me to name a legal basis for each of those. Sending you the newsletter runs on your consent, which you gave by filling in the form and can withdraw at any time. Tailoring what I send, and measuring which of my own channels works, run on my legitimate interests in communicating relevantly and understanding my own audience, balanced against your interests, and I can explain that balance if you ask. Keeping the site secure and keeping a record of consent run on my legitimate interests and, where it applies, on my legal obligations.
Withdrawing consent does not undo what already happened and does not affect the emails you already received, but it stops the next one.
What never happens.
I do not sell your information. I do not rent it. I do not trade it, barter it, or hand it to anyone for their own marketing. I have never done any of those things, and there is no arrangement anywhere under which I could.
Under the California rules, selling and sharing have specific technical meanings that catch some advertising arrangements which do not look like a sale in ordinary language. I do not do those either, because there is no advertising technology on this site at all.
This site loads no advertising trackers, no remarketing pixels, no conversion tags, no social media widgets that phone home, and no analytics package. Not one third party script runs on any page you can read. If that ever changes, this page changes before it happens, and the effective date at the top moves.
Cookies, and the two small notes in your browser.
This site sets no cookies on any page a visitor can read. That is why you have not been asked to accept any. There is nothing to accept.
It does keep two small notes in your browser's session storage, which is a store your browser empties the moment you close the tab. Neither is a cookie and neither is sent anywhere as you browse.
The first note remembers how you arrived, as described above. The second is a single flag recording that you have already seen the opening animation, so the site does not play it at you again on every page. That one is the word yes and nothing else.
The administrative area of this site, which only I can sign into, does set a session cookie, because signing in requires one. No visitor ever reaches it, and no page on the public site sets it.
Who else touches your information.
Three companies, each described by the job it does rather than by name, so that changing provider does not silently make this page wrong. I will name any of them if you ask.
An email and contact platform stores the newsletter list and sends the emails. Your name, your email address, your survey answers and your arrival information live there. It processes them only on my instructions and may not use them for anything of its own.
A hosting provider serves this site and keeps the technical request logs described above.
A database provider stores the writing, the book shelf and the site's own content, and handles the sign in for the administrative area. No newsletter subscriber is held in it.
Nobody else. There is no advertising network, no data broker, no enrichment service, no list rental, and no affiliate anywhere in the chain.
One exception, and it is the ordinary one. If a court order, a subpoena, or a law requires disclosure, I comply with the law. If I am allowed to tell you it happened, I will.
Where your information is held.
All three providers are United States companies, and your information is processed in the United States. If you are writing from the European Economic Area or the United Kingdom, that is an international transfer, and the protection for it is the standard contractual clauses in my agreements with those providers, which is the mechanism the European Commission and the United Kingdom have approved for exactly this situation.
If you want to know which mechanism applies to a particular provider, ask and I will tell you.
How long I keep it.
Your subscriber record stays for as long as you are on the list, and for as long afterwards as I need it to prove you consented and to make sure I do not accidentally email you again after you asked me not to.
Unsubscribing stops the email immediately and leaves a suppressed record behind, which exists only so that a later import cannot resurrect you. If you would rather be erased entirely than suppressed, say so, and I will delete the record and its backups within thirty days.
The arrival information lives as long as the subscriber record it is attached to. The technical server logs are kept by the hosting provider on its own short rolling schedule, and it is not something I extend.
Your rights, wherever you live.
Every email I send has a one click unsubscribe, and it works the first time.
Beyond that, you can ask me what information I hold about you, ask for a copy of it, ask me to correct it, ask me to delete it, ask me to stop using it for a particular purpose, and ask me to send it to you or to somebody else in a portable form.
I will do all of that for anyone who asks, whoever you are and wherever you live, rather than checking first whether your jurisdiction obliges me to. It is a short list and one person maintains it.
If you are in California.
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what is collected and why, the right to a copy, the right to correction, the right to deletion, the right to opt out of sale or sharing, and the right to limit the use of sensitive personal information.
Two of those need no action here. I have never sold or shared personal information as that law defines it, so there is nothing to opt out of, and I collect no sensitive personal information, so there is nothing to limit.
I will not discriminate against you for exercising any right. There is no worse version of this newsletter for people who ask questions about it.
You may use an authorised agent to make a request. I will ask for reasonable proof that you authorised them.
If you are in the European Economic Area or the United Kingdom.
The General Data Protection Regulation and its United Kingdom equivalent give you the rights listed above, and two more worth naming. You can object to processing that runs on legitimate interests, and where you object to direct marketing I have to stop, with no balancing test and no argument. And you can complain to your national supervisory authority, or in the United Kingdom to the Information Commissioner's Office, without asking me first.
I would rather you asked me first. But it is your right and I am not going to bury it.
How to exercise any of this.
Email the address at the bottom of this page and say what you want. Plain language is fine and you do not need to cite a statute at me.
I will confirm I have your request quickly and answer it within thirty days. If a request is genuinely complicated I may take longer, and if so I will tell you before the thirty days are up rather than after.
I may have to check that you are who you say you are, and for a list like this one that normally means replying from the email address the record is under. If I cannot verify a request I will say so rather than quietly doing nothing.
If I refuse a request, I will tell you why, and you can ask me to look again.
Automated decisions and profiling.
There are none. Nothing here scores you, ranks you, or makes a decision about you without a person involved. Your two survey answers decide which version of an email you get, and that is the whole of it.
Do Not Track and Global Privacy Control.
This site does not track you across other websites, so there is nothing for either signal to switch off. It honours them in the only way available to it, which is by never having built the thing they exist to stop.
Security.
The site is served only over an encrypted connection. The newsletter list sits behind the email platform's own access controls and my account on it. The database enforces its rules at the database rather than trusting the website to behave, and there is deliberately no master key anywhere in this project's code.
Nobody can honestly promise that a system cannot be broken into. What I can tell you is what is actually held here, which is a first name, an email address, two sentences and some campaign tags. If the worst happened, that is the whole of what there is to lose, and on a list this size I would tell the people on it directly.
Children.
This site is written for people who run, build and fund businesses. It is not directed at children and I do not knowingly collect information from anyone under sixteen. If you think a child has joined the list, email me and I will delete the record without asking you to prove anything.
Changes to this policy.
If this policy changes, the new version is posted here with a new effective date. If a change affects what happens to information you have already given me, I will email the list before it takes effect rather than after.
Nothing on this page changes quietly.
Contact.
Lorenzo Ayres