LEGAL · DRAFT
Privacy policy
Who we are
This site (https://edtrackai.github.io) is run by Stack & Ship, the trading name of Shah L, a sole trader based in East Anglia, England. We are the "controller" of the personal data described below under UK GDPR and the Data Protection Act 2018. Contact: Edtrackai@gmail.com. Postal address: [SHAH TO FILL: correspondence address, or a service/virtual address]. ICO registration: [SHAH TO FILL: ICO data protection fee reference number, or "exempt" after completing the ICO self-assessment].
Analytics on this site
We use our own small analytics script (not Google Analytics or ad trackers). It sets no cookies and does not store your IP address. It stores two kinds of item in your browser: - A random session ID in sessionStorage, deleted when you close the tab. - Campaign source tags (utm_source, utm_medium, utm_campaign, utm_content, or ref) from the link you arrived by, also in sessionStorage and cleared when you close the tab, so that we can count which campaigns and pages lead to visits and sales.
For each page view or marked click we record: the event type and which link was clicked, the page path, the referring page, the campaign tags, the session ID, a rough country (if our host supplies it) and whether the device looks like a mobile. Events go to our own endpoint and database hosted by Neon (Neon Postgres, EU – Frankfurt region), which processes the data for us.
Why: only to produce aggregate statistics about how the site is used (which pages and campaigns work) so we can improve the site and our products. We do not use this to identify you, build profiles, advertise, or sell data. We rely on the "statistical purposes" exception in PECR (as amended by the Data (Use and Access) Act 2025), so we don't ask for consent, but you can object.
Lawful basis (UK GDPR): legitimate interests (understanding and improving our site). The data is pseudonymous: no name, email or IP address.
How to object (free, one click): use the Turn off analytics on this browser link in the footer of every page and on this page. It stops the script storing or sending anything and clears the session ID and tags. To remember your choice we store one small "analytics off" flag in your browser; clearing your browser storage removes it. If your browser sends the Global Privacy Control (GPC) signal, we treat that as an objection automatically and the script does not run.
Retention: raw analytics events are deleted after 13 months; only aggregated counts are kept after that.
Links to Gumroad
When you click through to Gumroad, we add campaign tags (utm_*) to the link so a later sale can be attributed to the page or campaign. No session ID is added.
Buying a product
Purchases happen on Gumroad (Gumroad, Inc.), which is the merchant of record and a separate controller: it collects your payment details, email, billing country and handles tax under its own privacy policy (https://gumroad.com/privacy). Gumroad shares with us your name, email, product and order details so we can deliver the product and support you (lawful basis: performance of a contract). Customer records are held in Gumroad as merchant of record; we don't copy them into other systems. Gumroad is based in the USA; transfers of your data from Gumroad to us happen inside Gumroad's own systems and safeguards.
Emails
If you download a free product (such as the Security Checklist or Solo Founder OS Lite) or buy a product, Gumroad emails you the download. We only send you marketing emails (tips, new products, offers) if you tick the box to agree to them, or if you follow us on Gumroad. The lawful basis is your consent. Emails are sent through Gumroad. Every email has a one-click unsubscribe link, and you can also reply to ask us to stop. We keep your address for marketing until you unsubscribe.
Hosting and fonts
The site is hosted on GitHub Pages (GitHub, Inc.), which processes technical data such as IP addresses to serve pages (https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement). Fonts are served from this site.
Your rights
You can ask to access, correct or delete your data, restrict or object to its use, or ask for a copy (portability), by emailing Edtrackai@gmail.com. We reply within one month. Because analytics records contain no name, email or IP address, we may not be able to link them to you unless you give us your session ID. You can complain to us first, and then to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/ (0303 123 1113).
Changes
We'll update this page and its date if anything changes.