Who is responsible
Mark Boyer, based in the United Kingdom, is the data controller for this site. Contact: info@markboyer.co.uk.
Visiting the site
Analytics are provided by Plausible, which is privacy-friendly by design: it sets no cookies, does not follow you between sites, and does not build a profile of you. It counts pages, referrers and rough country. None of it identifies you, and I could not pick you out of it if I tried.
The site is hosted by Netlify, whose servers keep ordinary access logs including IP addresses, for security and to keep the site running. That is standard for any website and I do not use those logs for anything else.
Because there are no analytics or advertising cookies, there is no cookie banner. That is not an oversight, it is the point.
If you give me your email address
The waitlist and the contact form send what you type to Netlify Forms, where I read it. I use your address for the thing you asked for and nothing else. No list swapping, no selling, no adding you to something you did not ask for. Unsubscribe or ask me to delete you at any time and it is done.
The Service Flow Benchmark works the same way. Your figures are used in aggregate, and the email address is optional: leave it blank and your numbers still count.
The lawful basis is your consent, which you gave by filling in the form, and which you can withdraw whenever you like.
If you buy Shift Right
Nothing is on sale yet, so nobody is collecting anything. When it is, whoever handles the payment will be named here and on the licence page before the first sale. What will not change is that I never see your card number: that stays with whoever takes the money, under their own privacy policy. I would see your name, your email address, and what you bought.
When you unlock a device, your licence key is sent to my server to be checked. I do not store it. What comes back is used to decide which modules you can open, and then discarded.
Your device then holds a session cookie so you do not have to enter the key every time. It is strictly necessary for a service you asked for, which is why it needs no banner. It contains four things: which modules you are entitled to, which licence you bought, a reference to this device's activation, and when it expires. There is no name in it, no email address, and not your licence key. That activation reference identifies a browser rather than a person, but I could trace it back to your purchase, so I will not call it anonymous.
What you type into Shift Right
Everything you enter into the modules stays on your own device. Your demand data, your journey maps, your figures and your operating model never reach me, and there is no mechanism by which they could.
This is not a promise about how carefully I would handle your data. It is a fact about the architecture: there is nowhere for it to go. It also means I cannot recover your work if you clear your browser, so download a copy of anything that matters.
How long anything is kept
Email addresses stay until you ask me to remove them, or until the thing you signed up for has clearly finished. Purchase records are kept for as long as tax law requires, which is currently six years. Server logs turn over on Netlify's own schedule, measured in days.
Your rights
Under UK GDPR you can ask to see what I hold about you, have it corrected, have it deleted, object to how it is used, or ask for a copy in a portable form. Email me and I will action it, ordinarily well within the month the law allows.
If you are unhappy with how I have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. I would rather you told me first so I could put it right.
Where your data goes
Netlify and Plausible may process data outside the UK. Each provides the safeguards required for international transfers under UK data protection law. If a payment provider is added, it will be named here alongside them.
Version 1.2 · 3 August 2026 · Questions to info@markboyer.co.uk
Changed in this version: Lemon Squeezy is no longer named as the merchant of record, and no longer appears in the list of processors who may handle data outside the UK. The arrangement with them did not go ahead and nothing has replaced it, so at present no payment provider touches your data at all. Whoever eventually does will be named here before the first sale.
Version 1.1, on 2 August, rewrote the session cookie paragraph to list everything the cookie holds.