Privacy & Data

1. What I Collect

I collect your name, work email, company details, role, and the specific "data friction" you describe in the contact form. I do not use tracking cookies or third-party advertising pixels.

I run a privacy-first, self-hosted analytics layer to count pageviews and referrers. No cookies, no localStorage, no personal identifiers, no fingerprinting. Your IP address is truncated (last octet zeroed) and then hashed together with the day before storage, producing a rotating identifier that cannot be linked back to you and resets every 24 hours. Your browser's user-agent string is never stored; I derive only two coarse buckets from it (device type: mobile/tablet/desktop, browser family: chrome/safari/firefox/edge/other) for traffic shape analysis. All analytics rows are automatically deleted after 90 days. Lawful basis: legitimate interest (Art. 6(1)(f) GDPR), measuring traffic without identifying anyone is necessary to maintain and improve this site.

2. Where It Goes

Contact form submissions are stored in a managed Postgres database (EU region) and a notification email is sent to me via Resend, a transactional email provider with GDPR-compliant data processing agreements in place. Anonymous analytics data stays inside the same EU database and is never sent to any third party. I do not use any advertising network, analytics SaaS, or tracking pixel.

3. Why I Have It

To respond to your enquiry about the FTE Debt Audit or the Impact Operations engagement, and to send you a confirmation when you book a call. I may send one follow-up email if I think there is something specific to your situation worth sharing. I will never sell, rent, or share your data with third parties.

4. Legal Basis (GDPR Art. 6)

Legitimate interest (Art. 6(1)(f)). You contacted me for consulting advice, and processing your data is necessary to deliver that service. For follow-up emails, consent (Art. 6(1)(a)). You can withdraw at any time.

5. Your Control

I am the Data Controller: Lior Barak.

• Access: Reply to any email with "What do you know?" and I'll send you a full export within 72 hours.
• Deletion: Reply with "Liquidate" and I'll purge your record within 24 hours. No questions asked.
• Rectification: Reply with corrected information anytime.
• Portability: I can export your data in JSON format on request.

6. Data Retention

I retain your contact data for as long as our professional relationship is active, or 24 months after our last interaction, whichever comes first. After that, it's automatically purged. Email addresses collected via booking forms are deleted within 48 hours of confirmed delivery to me. After that, only an anonymised hash is retained for suppression purposes.

7. Tool Accounts and Saved Worksheets

The Data Hours Worksheet works without an account. If you want the sharper version, the one that splits salary by department, market and seniority, you sign in with an email link. No password is stored.

• What the account stores: your email address, and one saved worksheet holding the department names, headcounts, hours and salary figures you typed.
• Who can see it: only you. Access rules on the database scope every read and write to your own account.
• Legal basis: performance of a contract for the saved worksheet and the sign-in, consent for any marketing email. Marketing is a separate tick and is never bundled with signing in.
• Your controls: download your worksheet as a file, delete the saved worksheet, or delete the account and everything attached to it. All three sit on the tool page and take effect immediately.
• Retention: a worksheet untouched for 24 months is deleted. An account with no worksheet and no marketing consent is removed after 12 months of inactivity.
• Benchmark contributions: if you tick the benchmark box, rounded figures are stored with no name, no email, no company and no account identifier. They cannot be traced back to you, which also means they cannot be deleted individually.

8. Weekly Hours Tool and Team Rounds

• Solo use: your hours are calculated in your browser and nothing is sent. If you click "Add my week anonymously", only the six hour figures are stored, with no name, email, role or IP, and deleted three months after the quarter starts. Only aggregate statistics are kept after that.
• Team leads: I store your email (for sign-in and the "round ready" email), your team name, headcount and round dates. Legal basis: performance of a contract (Art. 6(1)(b)). Delete your team at any time by asking me, and it goes with all its rounds.
• Team members: only your usual weekly hours and the six hour figures are stored. No name, email, IP address or account. Your lead never sees your answer, only team totals once at least 70% of the team has answered and never fewer than three people. Legal basis: legitimate interest (Art. 6(1)(f)) in running the team check your lead asked for.
• Retention: individual answers are deleted after 90 days. The team totals stay on the lead's history until the team is deleted.
• Benchmark use: anonymous, aggregated totals (never single answers) may be used in my research, writing and talks about data teams. Groups smaller than five are never published.
• Where it lives: the same EU-hosted database as the rest of this site. Emails are sent through my transactional email provider. Nothing is sold or shared.

Processing terms for team leads

By opening a team, you (or your employer) and I agree to the following. Because answers are anonymous and you only receive aggregates, I act as an independent controller for the stored data, not as your processor. If your organisation needs a signed data processing agreement, ask and I'll send one.

1. You tell your team, before sharing the link, that taking part is voluntary and anonymous, and link them to this section.
2. You don't ask anyone to show you their individual answer or use the round to assess a single person.
3. You only share the link with the people counted in the round.
4. I process the data only to run the round, show you team totals, send the summary email and build anonymous aggregate benchmarks.
5. Access is limited to you (aggregates only) and me (administration). Data is encrypted in transit and at rest.
6. If there is a data breach affecting your team, I'll tell you without undue delay and within 72 hours of becoming aware.
7. You can ask me to delete your team and all its rounds at any time. I'll do it within 30 days.
8. The service is free and provided as is during the pilot. These terms may change; I'll email active leads before material changes.

9. Contact

For any privacy-related questions: contact me by email