Who is responsible
Mark Boyer, based in the United Kingdom, is the data controller for this site. Contact: info@markboyer.co.uk.
Visiting the site
Analytics are provided by Plausible, which is privacy-friendly by design: it sets no cookies, does not follow you between sites, and does not build a profile of you. It counts pages, referrers and rough country. None of it identifies you, and I could not pick you out of it if I tried.
The site is hosted by Netlify, whose servers keep ordinary access logs including IP addresses, for security and to keep the site running. That is standard for any website and I do not use those logs for anything else.
Because there are no analytics or advertising cookies, there is no cookie banner. That is not an oversight, it is the point.
If you give me your email address
The waitlist and the contact form send what you type to Netlify Forms, where I read it. I use your address for the thing you asked for and nothing else. No list swapping, no selling, no adding you to something you did not ask for. Unsubscribe or ask me to delete you at any time and it is done.
The Service Flow Benchmark works the same way. Your figures are used in aggregate, and the email address is optional: leave it blank and your numbers still count.
The lawful basis is your consent, which you gave by filling in the form, and which you can withdraw whenever you like.
If you buy Shift Right
Lemon Squeezy handle the sale as merchant of record, so they collect your payment and billing details. I never see your card number. I can see your name, your email address, and what you bought. Their own privacy policy governs what they do with the rest.
When you unlock a device, your licence key is sent to my server, which asks Lemon Squeezy whether it is valid. I do not store it. What comes back is used to decide which modules you can open, and then discarded.
Your device then holds a session cookie so you do not have to enter the key every time. It is strictly necessary for a service you asked for, which is why it needs no banner. It contains which modules you are entitled to and when it expires, and no personal information at all: no name, no email, nothing that identifies you.
What you type into Shift Right
Everything you enter into the modules stays on your own device. Your demand data, your journey maps, your figures and your operating model never reach me, and there is no mechanism by which they could.
This is not a promise about how carefully I would handle your data. It is a fact about the architecture: there is nowhere for it to go. It also means I cannot recover your work if you clear your browser, so download a copy of anything that matters.
How long anything is kept
Email addresses stay until you ask me to remove them, or until the thing you signed up for has clearly finished. Purchase records are kept for as long as tax law requires, which is currently six years. Server logs turn over on Netlify's own schedule, measured in days.
Your rights
Under UK GDPR you can ask to see what I hold about you, have it corrected, have it deleted, object to how it is used, or ask for a copy in a portable form. Email me and I will action it, ordinarily well within the month the law allows.
If you are unhappy with how I have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. I would rather you told me first so I could put it right.
Where your data goes
Netlify, Plausible and Lemon Squeezy may process data outside the UK. Each provides the safeguards required for international transfers under UK data protection law.
Version 1.0 · 26 July 2026 · Questions to info@markboyer.co.uk