Last updated
This notice covers this website. It is written to be read, not to be survived, so it is in plain English and it is specific about things most privacy notices leave vague.
Who is responsible
Scale Rule Consultancy Limited, a company registered in England and Wales, company number 17406773, registered office 26 Brook Road, Horsham, West Sussex RH12 5FY. The company trades as Scale Rule Consulting and is the data controller for everything described here.
For anything in this notice, email hello@scaleruleconsulting.com.
What I collect, and why
There are only three things.
An enquiry
If you use the contact form or send an enquiry after the diagnostic, I hold your name, email address and your message, along with the page you sent it from, the site you arrived from if there was one, and any campaign tags in the link you followed.
Why: to reply to you. That is the only reason.
Lawful basis: legitimate interests. You asked me to get in touch, and holding your email address in order to reply is the least I can do it with. I have written that assessment out properly in my internal records. The short version is that you volunteered the data seconds earlier for exactly this purpose, nothing is done with it beyond replying, and there is no less intrusive way to answer an email than to keep the email.
What I do not ask for: no phone number, no company name, no job title, no budget field. The form has three boxes because three is what a reply needs.
Whether you want me to email you occasionally
There is an unticked checkbox on the form. If you tick it, I record that you did.
Lawful basis: your consent. Sending an enquiry is not consent to anything else, and the two are recorded separately.
Worth saying plainly: there is currently no mailing list and no way for me to send one. If you tick the box, nothing arrives until that exists. Tell me at any time to remove it and I will.
A diagnostic run
When you run the diagnostic, I record the four answers, which service came back, and what the screen told you.
No name, no email address, and nothing that identifies you. It is a separate record from an enquiry, on purpose: most people who run the diagnostic never send an enquiry, and without this record an abandoned run would leave no trace and I would have no way of knowing whether the tool is any use.
One field is free text, the "something else" box. Whatever you type there is kept as you typed it, so please do not put your name or anyone else's in it.
Lawful basis: legitimate interests, in giving you an answer and in knowing whether the thing works.
The platform gives your browser an identifier, and I cannot remove it
This site is built on a platform called Base44. The first time your browser loads a page, the platform stores a random identifier on your device and sends it with every request this site makes to its own servers. It is not linked to your name or your email address, I cannot connect it to you, and it does not follow you to other websites.
There is no setting that turns it off. It is written by the same code that fetches the page you asked for, so a button offering to refuse it would be a button I could not honour.
The platform also collected page-view and session analytics keyed to that identifier. I switched that off on 13 September 2026, so no analytics events are sent from this site any more. The identifier is what remains.
I am telling you because it is true, not because I have to. The full detail, including how to check all of it yourself in your own browser, is on the cookie page.
What I do not do
- No cookies. Not one.
- No analytics.
- No advertising or remarketing tags. None.
- No cross-site tracking, and nothing that follows you off this site.
- I do not buy contact data, and I do not enrich yours from anywhere else.
- I do not sell or rent your details, and I never will.
- No automated decision-making with any legal or significant effect on you. The diagnostic maps one answer to one service and shows you the result immediately. It does not score you, it never declines anyone, and every route through it ends in the same offer.
Where your data is held, and who else sees it
This is the part most notices are vague about, so here it is in full.
The site is hosted by Base44, Inc., which is my processor. Base44 in turn uses these sub-processors, which is the full list as published by them and read by me on 12 September 2026:
- MongoDB, stores the data. United States.
- Render, runs the servers. United States.
- SendGrid, sends platform email, including the notification that tells me your enquiry has arrived. United States.
- Google Cloud, platform analytics. United States.
- Datadog, logging. United States.
- Supabase, media hosting. United States.
- OpenAI, used by the platform's builder tools. United States.
- Anthropic, used by the platform's builder tools. United States.
- Wix.com Ltd., provides and improves the platform. Israel.
So your enquiry is stored in the United States. I want to be direct about that rather than bury it, because I would want to know.
There is no option on this platform to keep the data in the UK or the EU. I checked. That is a consequence of the platform this site is built on, and I have accepted it and written the decision down rather than discovered it later.
What protects it. Israel is on the UK government's list of countries with adequate data protection, so no extra safeguard is needed there. The United States is only partly covered: UK adequacy applies solely to data transferred under the UK Extension to the EU-US Data Privacy Framework, and only where the receiving company is signed up to it. Where it is not, Base44's data processing agreement commits to the European Commission's standard contractual clauses with the UK's additions applied. Both are recognised safeguards under UK data protection law.
Nobody else sees your enquiry. There is no CRM, no shared inbox, no assistant, no agency and no lead-scoring service. I read them myself, which is also why I can promise a reply in 2 business days.
How long I keep it
- Your enquiry, if we do not end up working together: 12 months from the last time we were in contact.
- Your enquiry, if we do: 6 years plus the current year, which is the normal period for business records.
- An enquiry marked as spam: 30 days.
- A diagnostic run: 24 months.
- A record of a consent choice: for as long as the consent stands, plus 24 months.
These are enforced by a job that runs every night, not by me remembering to do it. It deletes only what is already past the period above, it keeps a record of every run and what it removed, and it will not delete anything whose date it cannot read. The one exception is the 6-year row: records of actual client work are reviewed by hand rather than swept, because deleting a business record automatically is how you lose the one you needed.
Your rights
You can ask me to:
- tell you what I hold about you, and give you a copy
- correct it if it is wrong
- delete it
- stop using it, or restrict what I do with it
- hand it over in a portable format
- withdraw a consent you gave, at any time, without it affecting anything else
Email hello@scaleruleconsulting.com and say which. I will reply within one month, and in practice much faster, because there is not a great deal to look through.
If you object to me holding an enquiry, I will delete it rather than argue the balance, because replying to you is the only thing it was for.
There is one thing I keep. If you ask me never to contact you again, I keep your email address on a short do-not-contact list, and nothing else — no name, no message, no history. That is the only way to be sure I do not contact you again by accident, because without it the next form you fill in looks like a brand new enquiry. I also keep a dated record that your request was dealt with, which identifies you only by a one-way scramble of your address, not the address itself.
Nothing here is required of you. There is no statutory or contractual obligation to give me anything. If you would rather not fill the form in, do not. The only consequence is that I cannot reply.
If you are not happy with how I have handled it
Tell me first and give me the chance to put it right.
If that does not resolve it, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk. You can go to them directly without coming to me first.
Changes to this notice
When it changes, the date changes with it, and if the change is material I will say what changed rather than quietly reissue it.
13 September 2026 — added *"There is one thing I keep"* to Your rights. Asking me to delete your data now leaves a do-not-contact record behind on purpose, and you should hear that from this page rather than find it out.