Privacy

Just browsing

Nothing that identifies you: anonymous visit statistics with no cookie and no IP address, described under Analytics below. No account, no cookie wall, no fingerprinting.

You enquire

Name, email, company, role, and whatever you type into the boxes about what you’re trying to do. That is a contract-formation conversation and I keep it.

You buy something

Name, email and what you bought. Card details go straight to Stripe and never touch my systems — I can see that a payment happened, not how you paid.

I send you a proposal

Your name, email, organisation and role, because I typed them in to address it to you. Plus how you read it — the next section is entirely about that.

If I’ve sent you a private proposal link — an address that looks like deanlynn.com/p/… — that document records how you read it, and it records it against your name. I’d rather tell you that here than have you find out from a well-timed phone call.

What is recorded

• Each time the link is opened, and when — first open and every return visit.
• Which sections you looked at and roughly how long you spent on each one, counted only while the tab is actually in front of you.
• How far down the document you got.
• Anything you do on purpose: choosing an option, accepting, declining, asking a question, requesting a change, printing or saving it as a PDF, clicking a link out.
• Whether you were on a phone, a tablet or a desktop, the width of the browser window, and the country the request came from.
• If you forward the link and someone else tells me who they are, their name and email — because they typed them in.

What is not recorded

In shortNo IP address is stored.

No cookie is set by the document and no device identifier is kept, so I cannot recognise you anywhere else on the internet or link this to any other browsing you do. The country is the coarse two-letter code the network already attaches to the request — not a location. And none of this goes to Google, Plausible or PostHog: proposal pages are excluded from every third-party analytics tool on the site, precisely because the access token is in the address bar.

Why, and on what basis

Legitimate interest, in a business-to-business context (UK GDPR Article 6(1)(f)). The interest is straightforward and I’m not going to dress it up: knowing that you’ve read the commercials twice tells me whether to call you, and knowing which section you stopped on tells me what to fix. It is the same information I’d get from watching your face across a table, which is where this conversation would otherwise be happening.

I’ve weighed that against your side of it. This only ever applies to a document I wrote for you and sent to you by name; it is confined to that one document; it produces no profile, no scoring and no automated decision about you; and it is never combined with anything else or shared with anyone. It is not used for advertising and the data is never sold or passed to a third party for their own purposes.

How long I keep it

The reading history — opens, dwell, scroll depth, device — is kept for 24 months after the last activity on the link, then deleted. The proposal itself and its outcome (what you were sent, what it cost, whether you said yes) is kept for six years, which is how long I have to be able to evidence a commercial dealing. Your access link can be revoked or expired at any point and stops working immediately when it is.

How to object

Email dean@deanlynn.com and say you don’t want your reading tracked. No form, no reason needed. I will turn the tracking off for your link, delete the history already recorded, and if you’d rather have the document as a plain PDF with nothing in it at all, I’ll send you that instead. Asking costs you nothing — it doesn’t affect the proposal, the price, or whether I want the work.

Because this runs on legitimate interest rather than consent, you have an absolute right to object under Article 21 and I have to stop unless I can show compelling grounds that override yours. I won’t try. I’ll just stop.

If you sign up for an event on this site, I collect what the form asks for: your name and email, and optionally a mobile number, your business type, role and team size, how much you have built with AI, your Base44 username (for build events), where you heard about it, any dietary or access needs, and your answer to the event’s own question. I use it to run that event: to email you a personal link, confirm your place, remind you, check you in, and send you a thank you afterwards. The legal basis is that you asked to take part.

The two boxes you tick

• News of future events is unticked until you tick it. If you tick it, I may email you about later events, with an unsubscribe link in every message. If you leave it unticked, you only get the emails about the event you signed up for. You can change it on your personal page at any time.
• Photos is also unticked until you tick it. I take photographs at some events; if you have not ticked it, I will not publish a photograph that shows you. If you have, I may use them on this site, in my own posts and in the recap I send to Base44 where it has supported the event. You can withdraw it on your personal page or by email, and I will take a photograph down where I can.

Dietary and access notes

In shortDietary and access notes are deleted 30 days after the event.

I use them to plan food and the room, and for nothing else.

What is shown publicly

If you submit something you built, it appears on the site only if you tick that it may be shown and I approve it. It shows the app name, the link, the one-line description and any screenshot you gave, and not your name or email. You can ask me to remove it.

Who else sees it

Partners, venues and Base44 get numbers, such as how many people registered and came, and photographs of people who ticked the photo box, not names or email addresses. Some events are supported by Base44 and may include free credits for people who take part; if Base44 needs anything about you to give you a credit, I will ask you first. Registration data is held in the same systems as the rest of this policy describes.

How long I keep it

Sign-up records are kept for 24 months after the event, then deleted, so I can answer questions about a booking or a build and see how a series is growing. Anything you tell me on the host-an-event form is kept while we are talking and for 24 months after, then deleted.

If you join the list before there is a date

The form on the join page (and the same form on the community page) collects your name and email, the kinds of session you tick, and optionally your town, when you could come, how much you have built with AI, and a line about what you might build. I use it to email you when a session you ticked is confirmed and about new dates for the same kinds of session, and to decide what to run and when. The legal basis is your consent: the box you tick to say I may email you. I keep a record of that box, the wording next to it and the time you ticked it.

Every email has an unsubscribe link, and unsubscribing stops the emails. You can send the form again to change what you hear about, or email me to have your entry deleted. The list is not shared with venues, partners or Base44. I keep an entry until you unsubscribe or ask me to delete it, and delete it in any case 24 months after you last sent the form or I last emailed you.

If you want to host an event

The form on the host page collects your name, email, organisation, town and what you tell me about your room and your plans. I use it to reply to you and for nothing else. There is no automatic reply, so if you do not hear back, email me. The legal basis is that you contacted me about working together.

I count visits myself, so I know which pages are worth keeping and whether a post sent anyone here. I record the page, the site or tagged link you arrived from, which buttons and links are clicked, whether a form was started and sent (never what you typed), how far down a page you scrolled, and counts of missing pages and errors. If you are signed in, these are linked to your account so I can see how members use the library and the Academy. Only I can read them.

There is no cookie, no IP address, no email address and nothing typed into a form or search box. A visit gets a random number that lives in your browser tab and is gone when you close it: in memory until you make a choice in the banner, and in the tab’s session storage once you accept analytics.

In shortIf you decline analytics in the banner, or your browser sends Do Not Track or Global Privacy Control, none of this runs.

Separately, Base44, the platform the site runs on, counts page views on its own, whatever you choose: the page address without its query, the address you came from, device type and country, with a random visitor number it keeps in your browser’s local storage. Base44 says it keeps these for 60 days.

The site can also load Plausible or GA4. Neither is switched on today, and neither would load unless you accept analytics.

Declining changes nothing about how the site works. You can change your mind by clearing the site data in your browser.

Proposal pages and the client portal are excluded from my statistics and from Plausible and GA4, whatever you chose, as described above.

Some links to Base44 on this site are affiliate links, and each one is marked where it appears. If you sign up through one, I may earn a commission at no extra cost to you. It never changes what I recommend.

This site sets no cookie for those links. When you click one, Base44 and its affiliate partner may record the click on their own sites so the referral is credited, under their own privacy policies.

Email is sent through Postmark. Anything that is a marketing sequence carries an unsubscribe link, and unsubscribing is instant and permanent — I don’t run win-back campaigns at people who left.

Transactional email — a receipt, a password reset, my answer to a question you asked inside a proposal — has no unsubscribe link because it is a reply to something you did, and no open tracking on the personal ones.

Toby Assistant is my own internal assistant. It is not a product and nobody else can use it. Its Google sign-in is used by exactly one account: my own Google Workspace account toby@deanlynn.com. No member of the public ever signs in to it, and it never asks for access to anyone else’s Google account.

What it uses, and why

It uses the Gmail, Google Calendar, Google Drive, Google Docs and Google Sheets data of that one account, to read, draft and organise that account’s email, calendar events and documents for me. That is all it is for. If you email toby@deanlynn.com, send it a calendar invite or share a document with it, what you sent is handled the same way, for the same purpose.

Where it goes

In shortIt is not sold, not used for advertising, and not shared with anyone for their own use.

The data stays on my own server. The only exception is the text a task needs, which goes to the AI model service that runs Toby so the task can be done, and nowhere else. None of it is used to build a profile of anyone, and none of it is used to train general-purpose AI models.

Toby Assistant’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long, and how to stop it

Toby keeps what it holds about you only while it is useful for the work it does for me. If you have written to toby@deanlynn.com and want what it holds about you deleted, email dean@deanlynn.com and I will delete it. Everything under Your rights below applies here in full.

Base44 (hosting and database), Stripe (payments), Postmark (email), Cloudflare (network), Google Workspace and an AI model service (for Toby Assistant only, as described above), and — only with your consent — Google Analytics, Plausible and PostHog. They process it to run the service and for nothing else. Some are outside the UK, under the standard transfer safeguards.

In shortNobody buys data from me, because none of it is for sale.

You can ask what I hold, get a copy, have it corrected, have it deleted, or tell me to stop processing it. One email to dean@deanlynn.com — I’ll answer inside a month and usually the same week. If I get it wrong you can complain to the ICO at ico.org.uk, though I’d rather you told me first.

If this changes materially I’ll date it at the top. I won’t quietly widen what I collect and leave the old page up.