Privacy notice.

This notice covers pauldrago.com and the booking and email links on it. It applies to anyone who visits the site, books a call, or writes to me. If we go on to work together, our engagement terms may say more about how client information is handled.

• You read any page on this site: collected automatically.
• You accept analytics cookies: collected automatically.
• You book a call: you give it.
• You email me: you give it.

If you only read the site and decline analytics cookies, all I get is an anonymous visit count.

• Site usage: pages viewed, links and buttons clicked, how far a page is scrolled, the site that referred you, and your device and browser.
• With analytics cookies accepted: an identifier that recognizes a return visit, your approximate location (city and country), heatmaps of where people click, and session recordings of how pages are used. Text typed into form fields is masked in recordings.
• IP addresses: PostHog uses your IP address only to work out that approximate location, then discards it. No IP address is stored with analytics data.
• Bookings: your name, email address, the time you choose, and any notes you add.
• Email: your address and whatever your message contains.

The site doesn't ask for, and I don't want, sensitive information such as account numbers or customer data from your institution.

• Measuring and improving the site. Cookie-free visit counts rely on my legitimate interest in knowing which pages are read (a lawful basis that doesn't need your consent because the data is anonymous and expected). Analytics cookies, heatmaps, and recordings rely on your consent, which you can withdraw at any time.
• Arranging meetings. I use booking details to schedule and hold the call you asked for.
• Correspondence. I use your emails to reply and to continue the conversation you started.
• Keeping the site running and secure. Cloudflare uses technical request data to deliver the site and protect it from abuse.

• Cookies: use Cookie settings (also in the footer of every page), turn on Global Privacy Control in your browser, or block cookies in your browser.
• Access, correction, and deletion: email paul@pauldrago.com and I will respond within 30 days.
• Objection and portability: depending on where you live, you may also object to processing or ask for a copy of your data in a portable format.
• Complaints: if you are in the UK or EU and are unhappy with how I handle your data, you can complain to your local data protection authority.

The site is served only over HTTPS. Analytics requests go through pauldrago.com rather than directly to a third party, IP addresses are discarded before analytics data is stored, and cookies are not set until you allow them. No system is perfectly secure. PostHog, Cal.com, Cloudflare, and Apple each run their own security programs.

PostHog stores analytics data in the United States and Cal.com processes booking data in the United States. Apple handles email. Cloudflare serves the site from data centers around the world. If you visit from the UK or EU, your information is transferred to the United States under the safeguards those providers offer, such as standard contractual clauses (EU-approved contract terms for protecting data abroad).

• Analytics: events are kept for up to seven years, the retention limit of this site's PostHog plan. They are stored without IP addresses and are never linked to your name or email. Session recordings are deleted automatically after 30 days.
• Your cookie choice: remembered for six months, then you are asked again.
• Bookings and email: kept while we're in touch and for as long as ordinary business records require, then deleted.

• PostHog measures how the site is used.
• Cal.com runs the booking scheduler and shares your booking with me. It may set its own cookies once you open the scheduler.
• Cloudflare hosts the site and processes technical request data, such as IP addresses, to deliver and protect it.
• Apple iCloud Mail receives and stores email sent to paul@pauldrago.com.

Without your consent, PostHog sets no cookies and stores nothing in your browser beyond a record of your choice. Visits are counted with an anonymous identifier calculated on PostHog's servers that changes daily and cannot recognize you over time.

• cc_cookie and __ph_opt_in_out_* (strictly necessary): remember your cookie choice.
• ph_* (analytics, only if you accept): PostHog's visitor and session identifiers.

Browser privacy signals. If your browser sends a Global Privacy Control signal, it is treated as declining analytics cookies and you are not asked. Browsers' older "Do Not Track" setting has no agreed standard, so the site relies on your cookie choice instead. The site does not allow third parties to track you across other websites.