Privacy

Who is responsible

Alexander Andersson, trading as andersson.consulting, Malmö, Sweden. I decide why and how the data below is used, so under the GDPR I am the controller. Write to [email protected] with anything on this page.

What the page reads in your tab

Every page of the site runs the same lifecycle program on whoever is reading it; the home page shows its working. To do that it reads, in your browser:

• where you came from (the utm_source if there is one, otherwise the referring site’s host name, never the full address);
• your time zone, language, device type and window size;
• which pages of this site you open and in what order, how long each is on screen, and how far down each you scroll;
• how long the tab was on screen, when you were idle or away, and how often you came back;
• your clicks, which receipts and programs you opened, how long you read them, whether you copied text (its length only, never the text), and when your pointer left through the top of the window.

None of this is written to cookies, local storage, session storage or any other store. It lives in memory and disappears when the tab closes. While tracking is on, some of the events the page logs are also sent to my analytics, the ones listed under “Analytics”; the page doesn’t send the time zone, language or window size it reads. The request itself carries your browser’s language and user agent, which the server passes on (see “Analytics”). Following a link to another page of the site doesn’t reload the tab: the page is fetched from this site and swapped in, so the profile stays in memory and carries on. That request carries the page’s address, as any visit to any website does, and nothing from your profile; the server counts it (see “Analytics”). Reload the tab, or open a page in a new tab, and a new profile starts. The “Tracking on · stop” control, on every page, wipes it at once, stops the program and stops the events.

The note: what goes to Claude

Two messages on the page are written by Claude, an AI model from Anthropic. The page shows its own template first and swaps in Claude’s text if it arrives. A request is made at most twice per visit:

• Win-back email. The first time you head for the door, on any page (your pointer leaves through the top of the window, or you press the leave button). Nothing is asked if tracking is off or you have already booked.
• Line above the book button. The first time you reach the booking section with a p(book) of at least 50%. Below that no note is requested.

What goes in the request

Numbers and names from your scoring card: the kind of note; your p(book) and its band; the card’s signal column (receipts and programs opened, pages read, minutes read, scroll depth, and so on); which receipts and programs you opened, by their printed names; your leading interest; time on screen; and for the win-back, the time you left. The dialog and the booking section show the exact body and its size under “What went to Claude”.

It does not contain anything you typed (the booking form never goes into a note), your time zone, language, device or source, or your IP address. The request is made by this site’s own server, not by your browser to Anthropic.

What happens to it

• It goes to a function on this site’s host (Cloudflare Pages), which checks it, adds a prompt and calls Anthropic’s API. The reply is checked and sent back to your tab.
• The function stores and logs nothing from the request. The only thing it keeps is the day’s total spend on notes, a single number, so a daily budget can be enforced. To limit abuse it also counts recent requests per IP address in the server’s memory for ten minutes; that count is not written anywhere.
• Anthropic receives the request as an API input. It does not get your name, email or IP address from me, and handles API inputs under its own terms and retention policy; see anthropic.com/legal/privacy. Anthropic is based in the United States, so this is a transfer outside the EU/EEA.

I treat the facts in a request as non-identifying: they are a handful of counters I don’t link to your name or email. Press “stop” and nothing more goes to Claude.

Booking a call

Every book button on the page opens the same booking panel. Nothing is requested from my calendar until you press one.

• Times. Pressing a book button asks this site’s server which times are open. That request carries nothing about you. The server asks Google Calendar when I am busy (times only, never what), keeps part of each day back, and answers with the times you can book. Not every free minute in my calendar is offered.
• The booking. When you confirm, the page sends four things: the time you picked, your name, your work email and what you wrote about the flow, if anything. The panel shows the exact body and its size under “What goes to my calendar” before you send it. Personal mailboxes (Gmail, Hotmail, iCloud and the like) can’t book.
• Where it goes. A function on this site’s host (Cloudflare Pages) checks it and creates an event in my Google Calendar, with you as the guest and a Google Meet link. Google emails you the invite from my calendar. You can add colleagues to the invite; they see the event, including your name, email and note. The function keeps nothing itself. The event holds your name, email and note, plus a one-way hash of your email, which only I can see, so a second booking from the same address can be spotted.
• Why: to hold the call you asked for, a step taken at your request before any agreement (GDPR Art. 6(1)(b)).
• How long: like an enquiry. If nothing comes of the call, the event is deleted within 12 months; ask and I delete it sooner.
• Who else sees it: Google, as my calendar and email provider, under its privacy policy, which can involve transfers outside the EU/EEA; Cloudflare, as host; and anyone you add to the invite. To limit abuse the server counts recent booking attempts per IP address in its memory for ten minutes, not written anywhere, and caps the bookings it accepts per day.

The page logs that you picked a time and that the booking went through, like any other event, but never your name, email or note. Pressing “stop” forgets the booking panel along with the rest; the event in my calendar stays, because you booked it.

Hosting and the connection itself

The site is served by Cloudflare. Like any host, Cloudflare processes the technical data of a connection (your IP address, the browser’s headers, the page requested) to deliver and protect the site. That processing is Cloudflare’s, under its privacy policy and data processing terms, and can involve transfers outside the EU/EEA.

I run no analytics other than my own (below): no Cloudflare Web Analytics, no tag manager, no third-party script. Both fonts are served from this site, so there is no request to Google Fonts or any other third party. The page’s security policy allows connections to this site only. An automated test runs on every change. It fails if a page makes any request after loading other than these: a batch of analytics events, a note, the booking you confirm, the request for free times once a book button is pressed, or the next page of this site (with its styles, fonts and images) when you follow a link. Links aren’t fetched ahead: nothing loads until you follow one.

Analytics

I use Umami, an open-source analytics tool, which I run on my own server in Sweden. It is fed two ways, both through this site, so the page’s security policy still allows connections to this site only.

• Pages. When this site’s server sends you a page, it counts it once, without holding the page up. That runs on the request your browser already made, so it happens with tracking on or off. A link from another site to a page that doesn’t exist is counted as the event page_not_found. If your browser sends Global Privacy Control or Do Not Track, I don’t count the visit, pages or events.
• Events, while tracking is on. The page sends this site some of the events its program has logged, in batches about two seconds after the first event and when you leave or hide the tab. They are the receipts, programs and pages you opened and how long you read them, how far you scrolled, your clicks on buttons, links, the email address and the phone number, text copied (never the text or its length), the stage you reached, the messages the rules sent, heading for the door, the notes asked of Claude, and the booking steps (the panel opening, times shown, a time picked, a field the form refused (which field, and whether the address was a personal mailbox, never what you typed), a booking sent, made or refused). Each event carries the page it happened on, your p(book) and stage at that moment. The site passes them on to Umami. Press “stop” and the events end at once; anything not yet sent is dropped. The rest of the program’s events (being idle, tab focus, the clock) stay in your tab.
• What Umami receives with each: for a page, its address (with any utm_ tags, and nothing else from its query string) and the site you came from (not the page); for an event, the page’s path. With both, your browser’s user agent and language, and your IP address.
• What it keeps: the pages and events with their times and details, the site you came from, your browser, operating system, device type and language, and the country, region and city it looks up from the IP address. It doesn’t store the IP address or the user agent. It tells visits apart by a one-way hash of the IP address and user agent, salted with a value that changes every month, so the hash can’t be matched from one month to the next. This is personal data under the GDPR, because a visit can be told apart within a month. I don’t link it to your name or email. The booking steps are logged with the time they happened, and I can see the time of each booking in my calendar.
• Why: to see what people read, where they come from and where the site loses them, so I know what to write and fix. That is my legitimate interest (GDPR Art. 6(1)(f)). It is not used to identify anyone. The page’s messages are decided in your tab; analytics plays no part.
• How long: until I delete it.
• Who else sees it: Cloudflare, as host (see “Hosting”), carries it from the site to my server in Sweden; it passes through Cloudflare’s network, which can involve transfers outside the EU/EEA. Nobody else. To limit abuse the server counts recent event requests per visitor in its memory for ten minutes, not written anywhere.

If you contact me

You can also book, or ask anything, by email. If you write to [email protected], I receive your email address, your name if it is in the address or signature, and what you write. If you call or text, I receive your number. The phone number is not in the page’s HTML; it appears when you press “Show number”.

• Why: to reply, to arrange a call and, if it goes further, to agree and deliver work.
• Legal basis: my legitimate interest in answering enquiries about my services, and steps taken at your request before an agreement (GDPR Art. 6(1)(f) and (b)). If we sign an agreement, keeping the records Swedish accounting law requires is a legal obligation (Art. 6(1)(c)).
• How long: an enquiry that goes nowhere is deleted within 12 months of the last message. Records tied to an engagement are kept as long as the agreement and the law require; accounting records in Sweden are kept for seven years.
• Who else sees it: my email provider and phone carrier, as processors. I don’t sell or share this with anyone else, and I don’t add you to a mailing list because you wrote to me.

Links to other sites

The page links to LinkedIn, and the email address opens your email app. Once you leave this site, the other service’s own privacy policy applies. These links are plain links: they load nothing in this page.

Your rights

You can ask me for a copy of the personal data I hold about you, to correct it, to delete it, to restrict its use, or to hand it to you in a portable format. You can object to processing based on legitimate interest, and that includes being counted. A visit can be found by its date, IP address and browser’s user agent; I use those only to find and delete it. With Global Privacy Control or Do Not Track set in your browser, I count nothing from you. Email [email protected] and I’ll answer within a month. Nothing on this site involves automated decisions that have legal or similarly significant effects on you: the score only changes which message the page shows.

If you think I have handled your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se) or to the data protection authority in the country where you live.

Children, changes

The site is written for people who hire consultants, and is not aimed at children. If I change how the site handles data, I change this page and the date at the top. The page’s behaviour is described in the open on the home page itself, under “How this page works”, and the two have to agree.

The terms of using the site and of working with me are on the terms page.