Privacy Policy

Summary of Key Points

• We collect names, email addresses, and billing information when you make a purchase or sign up to our mailing list.
• We do not process sensitive personal information.
• We do not collect information from third parties.
• We process your information to provide our services, communicate with you, and for security and fraud prevention.
• We share information with Lemon Squeezy (payments), Kit/ConvertKit (email), Umami (analytics), and Vercel (hosting).
• We keep your information only as long as necessary or as required by law.

1. What Information Do We Collect?

Personal information you provide directly: We collect personal information that you voluntarily provide when you express interest in our products, make a purchase, or contact us. This includes:

• Names
• Email addresses
• Billing addresses
• Debit/credit card numbers (handled and stored by Lemon Squeezy — see their privacy policy at lemonsqueezy.com/privacy)

Sensitive information: We do not process sensitive personal information.

Information collected automatically: When you visit our site, we automatically collect certain information including your IP address, browser type, device characteristics, operating system, language preferences, referring URLs, and location data. This is collected via Umami Analytics and is used for internal analytics only.

All personal information you provide must be true, complete, and accurate.

2. How Do We Process Your Information?

We process your personal information to:

• Deliver and facilitate delivery of services to you
• Fulfil and manage your orders and payments
• Respond to your enquiries and provide support
• Send administrative information such as order confirmations and download links
• Send marketing and promotional communications (with your consent)
• Request feedback about your experience
• Protect our services through fraud monitoring and prevention
• Identify usage trends to improve the site

3. What Legal Bases Do We Rely On?

The UK GDPR requires us to explain the valid legal bases we rely on when processing your personal information:

• Consent — where you have given permission for a specific purpose, such as subscribing to our mailing list. You can withdraw consent at any time.
• Performance of a contract — where processing is necessary to fulfil our contractual obligations, such as delivering your purchase.
• Legitimate interests — where processing is reasonably necessary for our business interests, including sending information about new editions, analysing how our site is used, and fraud prevention.
• Legal obligations — where processing is necessary for compliance with applicable law.

4. When and With Whom Do We Share Your Information?

We share your data with the following third-party service providers:

• Lemon Squeezy — payment processing and digital product delivery
• Kit (ConvertKit) — email marketing and subscriber management
• Umami — privacy-first web analytics (self-hosted)
• Vercel — website hosting and infrastructure

We have contracts in place with all third parties designed to safeguard your personal information. We may also share information in connection with a business transfer, merger, or acquisition.

5. Is Your Information Transferred Internationally?

Our servers and those of our third-party providers are located in the United States. If you are based in the UK or EEA, your information may be transferred to and processed in the US. We rely on the European Commission's Standard Contractual Clauses to ensure your information is protected in accordance with applicable data protection law. Further details are available upon request.

6. How Long Do We Keep Your Information?

We retain your personal information only as long as necessary for the purposes set out in this notice, or as required by law:

• Transaction records: 7 years (HMRC requirement)
• Email subscribers: until unsubscribed, plus 30 days
• Analytics data: 2 years

When we have no ongoing legitimate need to process your information, we will delete or anonymise it.

7. How Do We Keep Your Information Safe?

We have implemented appropriate technical and organisational security measures to protect your personal information, including HTTPS encryption and secure third-party payment processing. However, no electronic transmission over the internet can be guaranteed 100% secure. You access our services at your own risk.

8. Do We Collect Information from Minors?

We do not knowingly collect data from or market to children under 18 years of age. If you become aware of any such data we may have collected, please contact us at hello@platformengineeringguide.com.

9. What Are Your Privacy Rights?

Under UK GDPR you have the right to:

• Request access to and a copy of your personal information
• Request rectification or erasure of your personal information
• Restrict the processing of your personal information
• Request data portability
• Object to the processing of your personal information
• Withdraw consent at any time
• Unsubscribe from marketing emails at any time via the unsubscribe link

To exercise any of these rights, contact us at hello@platformengineeringguide.com.

If you believe we are unlawfully processing your information, you have the right to complain to the UK Information Commissioner's Office (ICO).

10. Controls for Do-Not-Track Features

We do not currently respond to Do-Not-Track browser signals as no uniform technology standard has been finalised. If a standard is adopted that we must follow, we will update this notice accordingly.

11. Do We Make Updates to This Notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated date at the top of this notice. We encourage you to review this notice periodically.

12. How Can You Contact Us?

If you have questions or comments about this notice, please contact us at:

13. How Can You Review, Update, or Delete Your Data?

To request access to, correction of, or deletion of your personal information, please contact us at hello@platformengineeringguide.com. We will respond in accordance with applicable data protection laws.