Effective 20 August 2026
THE SHORT VERSION
- This is a small operation. I collect as little as possible.
- I never see or store your card number. Stripe handles payments and card data end to end.
- This site uses Google Analytics to count visits. You can opt out, and how is explained below.
- I do not sell or share your personal information, and never have.
- You can ask me to show you, correct, or delete what I hold, and I will.
1. WHO IS RESPONSIBLE
The data controller is Henry Finn, an individual doing business as a sole proprietor in California, United States. Contact details are on the contact page. Privacy questions and requests go to henry@henryfinn.com.
2. WHAT IS COLLECTED
Information you give me
- Contact details when you email or fill in a form: name, email address, and anything you choose to write.
- Purchase details when you buy: name, email, billing address, the items bought, and the amount. Card numbers go to Stripe, not to me. I can see the card brand, the last four digits, and the expiry date, which Stripe passes back so receipts and refunds work.
- Account details if you hold a membership: login email and your subscription status.
- Engagement material if you become a client: whatever you send me for the work, which is handled as confidential under the terms of service.
Information collected automatically
- Analytics data through Google Analytics 4 (measurement ID G-P7T8JTP1NN): pages viewed, approximate location derived from a truncated IP address, referring site, device and browser type, and time on page. This is aggregated traffic measurement. It is not used to build advertising profiles, and no advertising or remarketing features are enabled.
- Server logs kept by the hosting provider: IP address, timestamp, and the page requested, for security and reliability.
What is never collected
No full card numbers, no CVV codes, no bank credentials, no government ID numbers, no biometric data, and no health data. I do not knowingly collect sensitive personal information as defined by California law, and I do not use or disclose any for purposes requiring a right to limit.
3. WHY IT IS COLLECTED, AND THE LEGAL BASIS
| Purpose | Data used | Legal basis (UK/EU) |
|---|---|---|
| Taking payment, delivering what you bought | Purchase and contact details | Performance of a contract |
| Support, refunds, and replying to you | Contact and purchase details | Performance of a contract |
| Receipts, renewal notices, service emails | Email, purchase details | Performance of a contract |
| Tax, accounting, and legal records | Transaction records | Legal obligation |
| Fraud prevention and site security | Log and transaction data | Legitimate interests |
| Understanding site traffic | Analytics data | Consent, or legitimate interests where consent is not required |
| Marketing emails, if you asked for them | Email address | Consent |
Marketing email only ever goes out if you opted in, and every one of them has a one-click unsubscribe. Service emails such as receipts, renewal notices, and security notices are part of the transaction and are sent regardless, because you need them.
4. WHO IT IS SHARED WITH
Your personal information is not sold, rented, or traded. Ever. It is shared only with the service providers needed to run this business, each bound to use it solely to provide their service:
| Provider | What for | Their policy |
|---|---|---|
| Stripe, Inc. | Payment processing, fraud checks, receipts | stripe.com/privacy |
| Google (Analytics) | Aggregate traffic measurement | policies.google.com/privacy |
| Vercel Inc. | Website hosting and delivery | vercel.com/legal/privacy-policy |
| Email provider | Sending and receiving mail | Per that provider's policy |
| Accountant / tax adviser | Bookkeeping and tax filing | Under professional confidentiality |
Information may also be disclosed where legally required by valid legal process, where necessary to establish or defend legal claims, or to a successor if the business is transferred, in which case you will be told first.
5. COOKIES AND TRACKING
This site sets Google Analytics cookies (_ga and related), which last up to 24 months and count visits. Stripe sets cookies on its own checkout pages for fraud prevention and to make payment work. No advertising, remarketing, or cross-site tracking cookies are used, and there are no third-party ad networks on this site.
How to opt out
- Install the Google Analytics opt-out browser add-on, which blocks it everywhere.
- Turn on Global Privacy Control in a supporting browser or extension. This site treats a GPC signal as a valid opt-out request under California law.
- Block or delete cookies in your browser settings. The site works fine without them.
6. HOW LONG IT IS KEPT
- Transaction and tax records: 7 years, as required by US tax law.
- Client engagement material: for the engagement plus 3 years, then deleted, unless you ask for it sooner.
- Email correspondence: up to 3 years.
- Marketing list: until you unsubscribe, then your address is suppressed so you are not re-added.
- Analytics data: 14 months, then automatically deleted by Google.
- Server logs: 30 days.
7. YOUR RIGHTS
Everyone
Whoever and wherever you are, you can ask me to tell you what I hold about you, give you a copy, correct it, or delete it. Email henry@henryfinn.com. I will respond within 30 days, free of charge, and I will not treat you any differently for asking. I may need to confirm your identity first, usually just by replying from the address on file.
California residents (CCPA/CPRA)
You have the right to know what is collected and why, to access and port it, to correct it, to delete it, to limit the use of sensitive personal information, and to opt out of sale or sharing. I do not sell or share personal information, and have not in the preceding 12 months, including the personal information of anyone under 16. There is therefore no "Do Not Sell or Share" link to click, but a Global Privacy Control signal is honoured anyway. You may use an authorized agent, and you will never be discriminated against for exercising a right.
UK and EU residents (UK GDPR / GDPR)
You additionally have the right to restrict processing, to object to processing based on legitimate interests, to data portability, to withdraw consent at any time without affecting prior processing, and to lodge a complaint with your supervisory authority (in the UK, the ICO). No automated decision-making with legal or similarly significant effects is carried out.
International transfers
This business is in the United States, and its providers are US-based, so data is processed in the US. Where personal data is transferred from the UK or EU, the providers named above rely on Standard Contractual Clauses or an equivalent approved mechanism.
8. SECURITY
The site is served over HTTPS. Payment pages are hosted by Stripe, which is certified to PCI Service Provider Level 1, the highest level in the payments industry. Accounts use multi-factor authentication where the provider supports it, and access to client material is limited to what is needed to do the work. No system is perfectly secure, but if a breach ever affects your personal information you will be notified without undue delay and as required by law.
9. CHILDREN
Nothing here is directed at children under 16, and information is not knowingly collected from them. If you believe a child has provided personal information, email me and it will be deleted promptly.
10. LINKS TO OTHER SITES
This site links out to other sites, including social profiles and portfolio companies. Their privacy practices are their own, and this policy does not cover them.
11. CHANGES
This policy can be updated. The effective date at the top shows the current version. Material changes will be announced on this page and, where I hold your email address, emailed to you.
12. CONTACT
Privacy questions, requests, and complaints: henry@henryfinn.com, or by post to the address on the contact page. A reply comes within 30 days, and usually within 2 business days.