Privacy Policy

Tom Phillips, based in the United Kingdom, is the data controller for anything collected here. Contact: tom@tomphillipslabs.com.

• Your message — if you use the contact form: your name, email address, and whatever you write. It is emailed to me and nothing else is done with it.
• Analytics — anonymised page-view and performance data, collected only if you accept analytics cookies.
• Server logs — the host records request data including IP address, for security and debugging. Held briefly.

There is no account system, so no passwords, profiles or purchase records exist. No payment data is handled at all.

• To reply to you — legitimate interest, UK GDPR Article 6(1)(f). You got in touch; answering is the point.
• To keep the site up and secure — legitimate interest, covering the server logs.
• Analytics — consent, Article 6(1)(a). Refuse and the site works identically.

Nothing is sold or rented, there is no marketing list, and nothing is used to train machine-learning models.

Two categories only:

• Essential — remembers your cookie choice itself. No consent needed under UK PECR.
• Analytics — privacy-respecting page-view and performance measurement via Vercel, loaded only with your consent.

Change your mind at any time via Cookie settings. Refusing analytics leaves the site fully functional.

• Vercel (USA/EU edge) — hosting, content delivery and analytics.
• Resend (USA) — delivers the contact-form message to my inbox.

Both are bound by data-processing agreements. Transfers to the USA rely on the UK's adequacy decision where applicable, and on Standard Contractual Clauses where not.

Contact messages stay in my email while the conversation is useful and are deleted when it isn't. Server logs are held briefly by the host, typically around 30 days. Analytics data is aggregated and not tied to you.

Under UK GDPR you can request access, rectification, erasure, restriction or portability, object to processing based on legitimate interest, and withdraw cookie consent. For a site this small that mostly means asking me to delete a message you sent — which I will do on request.

Email tom@tomphillipslabs.com and I aim to respond within 30 days. You can also complain to the Information Commissioner's Office at ico.org.uk.

Traffic is served over TLS. The site holds no credentials and no database, which removes most of what there would otherwise be to protect. If you find a vulnerability, report it responsibly to tom@tomphillipslabs.com — I won't take legal action against good-faith researchers.

This site isn't aimed at children and doesn't knowingly collect their data.

If this policy changes materially, the effective date at the top of the page changes with it.