Privacy & Data

1. What I Collect

I collect your name, work email, company details, role, and the specific "data friction" you describe in the contact form. I do not use tracking cookies or third-party advertising pixels.

I run a privacy-first, self-hosted analytics layer to count pageviews and referrers. No cookies, no localStorage, no personal identifiers, no fingerprinting. Your IP address is truncated (last octet zeroed) and then hashed together with the day before storage, producing a rotating identifier that cannot be linked back to you and resets every 24 hours. Your browser's user-agent string is never stored; I derive only two coarse buckets from it (device type: mobile/tablet/desktop, browser family: chrome/safari/firefox/edge/other) for traffic shape analysis. All analytics rows are automatically deleted after 90 days. Lawful basis: legitimate interest (Art. 6(1)(f) GDPR), measuring traffic without identifying anyone is necessary to maintain and improve this site.

2. Where It Goes

Contact form submissions are stored in a managed Postgres database (EU region) and a notification email is sent to me via Resend, a transactional email provider with GDPR-compliant data processing agreements in place. Anonymous analytics data stays inside the same EU database and is never sent to any third party. I do not use any advertising network, analytics SaaS, or tracking pixel.

3. Why I Have It

To respond to your enquiry about the FTE Debt Audit or the Impact Operations engagement, and to send you a confirmation when you book a call. I may send one follow-up email if I think there is something specific to your situation worth sharing. I will never sell, rent, or share your data with third parties.

4. Legal Basis (GDPR Art. 6)

Legitimate interest (Art. 6(1)(f)). You contacted me for consulting advice, and processing your data is necessary to deliver that service. For follow-up emails, consent (Art. 6(1)(a)). You can withdraw at any time.

5. Your Control

I am the Data Controller: Lior Barak.

• Access: Reply to any email with "What do you know?" and I'll send you a full export within 72 hours.
• Deletion: Reply with "Liquidate" and I'll purge your record within 24 hours. No questions asked.
• Rectification: Reply with corrected information anytime.
• Portability: I can export your data in JSON format on request.

6. Data Retention

I retain your contact data for as long as our professional relationship is active, or 24 months after our last interaction, whichever comes first. After that, it's automatically purged. Email addresses collected via booking forms are deleted within 48 hours of confirmed delivery to me. After that, only an anonymised hash is retained for suppression purposes.

7. Tool Accounts and Saved Worksheets

The Data Hours Worksheet works without an account. If you want the sharper version, the one that splits salary by department, market and seniority, you sign in with an email link. No password is stored.

• What the account stores: your email address, and one saved worksheet holding the department names, headcounts, hours and salary figures you typed.
• Who can see it: only you. Access rules on the database scope every read and write to your own account.
• Legal basis: performance of a contract for the saved worksheet and the sign-in, consent for any marketing email. Marketing is a separate tick and is never bundled with signing in.
• Your controls: download your worksheet as a file, delete the saved worksheet, or delete the account and everything attached to it. All three sit on the tool page and take effect immediately.
• Retention: a worksheet untouched for 24 months is deleted. An account with no worksheet and no marketing consent is removed after 12 months of inactivity.
• Benchmark contributions: if you tick the benchmark box, rounded figures are stored with no name, no email, no company and no account identifier. They cannot be traced back to you, which also means they cannot be deleted individually.

8. Contact

For any privacy-related questions: contact me by email