Privacy Policy

Last updated: 15 August 2026

This policy explains how Nadine Benjamin ("I", "me", "my"), an independent Brand & Marketing Strategist trading as a sole trader in London, United Kingdom, collects and uses personal data through this website and in the course of consultancy work. For the purposes of the UK General Data Protection Regulation, the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003, I am the data controller.

You can reach me about anything in this policy at [email protected], or by post to a correspondence address, which I will give you by return if you ask for it by email. If you are in the European Economic Area, please also read "Visitors in the EEA" towards the end of this policy.

This policy is written to describe what this website and my records actually do, rather than what they are intended to do. Where a control is still being built, that is said plainly.

Information you give me

When you submit an enquiry or project brief, I collect what you type into the form. Every submission asks for your name, email address, the type of enquiry and your message. A business or working name is generally optional, but is required when applying for the named case-study partnership. Depending on the service selected, the form may also ask for a company website, an estimated budget, a project timeline and links to useful material. The Focus Consultation brief collects a fuller picture of your business: your role, what your business does and for whom, your ideal customer, what makes you different, how customers find you, your closest competitors, the challenge you want addressed, what you have already tried, what a good outcome looks like, the decision waiting on the answer, any constraints, and links to useful material. A telephone number may be supplied voluntarily for project administration, but live telephone or video consultations are not offered and the number is never used for unsolicited contact.

If you sign up to the newsletter, through the footer form, the tick box on the enquiry form, or the AI assistant, I collect only your email address.

If you apply for and are selected for the Brand Clarity Audit named case-study partnership, I also collect the business name, website, logo or brand assets, honest and detailed written feedback, a written progress update and the project material needed to prepare the case study. The partnership is only available where the business agrees to public identification: the business name and logo, agreed project context, recommendations, implementation progress, results and accurate attributed extracts from the feedback will be published. The case study will state that a reduced partner rate was provided. Information unrelated to the agreed case-study scope remains confidential.

Please do not send me information about your health, your beliefs, your background or anything else that UK GDPR treats as a special category of personal data, or information about criminal offences. None of my services need it. If you do include something of that kind in a free-text field, it will sit in the message you sent until that record reaches the end of its retention period; tell me and I will remove it sooner.

Information collected automatically

My hosting provider, Cloudflare, processes the technical information every website receives in order to serve pages, defend the site and keep it available: your IP address, your browser's user-agent string, the page you requested and approximate location derived from your IP address. This happens at network level, before any code of mine runs, and is described in Cloudflare's own privacy documentation.

Cloudflare Web Analytics is used on this site. This site loads a small measurement script from static.cloudflareinsights.com on its public pages, and it reports page views back to Cloudflare. It is not loaded on the private office or the client area, and it is not loaded in a browser that has been used to sign in to the private office, so my own visits are excluded from my figures. It sets no cookies, stores nothing on your device and does not follow you between websites; Cloudflare processes technical information including your IP address in order to count visits and produce aggregate figures such as which pages are read most and which countries visitors come from. I see only those aggregate figures.

This site also records a small number of its own progress events so that I can see where people give up on the free positioning statement generator and the paid review, for example, that the tool was started, that a statement was completed, or that the review page's call to action was chosen. To join those steps into one sequence, a random identifier is created in your browser's local storage the first time such an event happens and is sent with each event. It contains no information about you, it is not shared with anyone, it is never used for advertising and it is not used to follow you to other websites; but because it stays in your browser between visits, it does allow the steps taken in this browser to be linked together over time. The Cookie Notice names it, explains how to stop it and explains how to ask me to delete the events already recorded against it.

The two measurement technologies above sit on different legal footings, and it would be misleading to describe them as though they sat on one. Cloudflare Web Analytics neither stores anything on your device nor reads anything from it, so regulation 6 of the Privacy and Electronic Communications Regulations 2003 , which governs storage and access , is not engaged by it. What it does involve is Cloudflare processing technical information such as your IP address in order to count a visit, and the lawful basis for that is my legitimate interests in understanding how the site is used and where it can be improved (UK GDPR Article 6(1)(f)). You may object at any time under Article 21; see “Your rights”.

The measurement identifier is the opposite case. It is written to your browser and stays there between visits, which is exactly the storage regulation 6 covers. Regulation 6 as amended by the Data (Use and Access) Act 2025 does now contain an exception for storage whose sole purpose is collecting statistical information about how a website is used, and it would probably cover this identifier , but I do not rely on it. The identifier is used only with your consent (UK GDPR Article 6(1)(a)): it is not created until you accept analytics, nothing is measured while your choice is undecided, and declining or later withdrawing removes it. That is the stricter of the two positions and I would rather be on it. The Cookie Notice names the identifier, explains how to stop it and explains how to ask me to delete the events already recorded against it.

The AI assistant, Clara

This website offers an AI assistant called Clara, shown as a chat button in the corner of the page. Clara is an artificial intelligence system, not a person. She is powered by Anthropic's Claude, with Cloudflare's Workers AI as a fallback if Anthropic is unavailable, and she is set up by me to answer questions about the services and help you find a sensible starting point.

To generate each reply, the AI provider receives up to the twenty most recent messages, the address and title of the page you are viewing, and a short approved summary associated with that page. Controlled additional page detail is included only when you explicitly ask Clara to explain, summarise or answer a question about the current page; the page's visible text is not copied and sent automatically. The provider also receives whether you have already submitted an enquiry or newsletter sign-up in the conversation, the current London date and time, a list of the site's published services and articles, and, if you have used the chat before on this browser and given your first name, that first name and the fact that you are returning. Content sent to the Anthropic API is not used to train Anthropic's models. Anthropic and Cloudflare act as my processors for this purpose.

Conversations are logged so that I can follow up properly and review the quality of the service. The log holds the transcript, the address of the page the chat began on, your browser's user-agent string and your IP address. An ordinary conversation is deleted seven days after your last message. If the conversation is linked to an enquiry, it is kept while that enquiry is still open and for a further seven days after I close it as won or lost, so, in practice, a conversation attached to an enquiry I have not yet closed is kept until I do close it. The IP address is held to protect the site from abuse and is deleted with the conversation it belongs to.

Two things are stored in your browser by the assistant: a short session identifier and the active conversation, which are cleared when you choose “End chat”, after five minutes without a user or Clara message, or when you close the tab; and a small marker recording that you have used the chat before together with your first name if you have given it, which stays until you clear this site's storage. Ending or timing out a conversation prevents its messages being included in a new AI request. It does not erase a server-side conversation log or an enquiry that has already been submitted; those records follow the retention periods below. The Cookie Notice lists the browser storage.

If you give Clara your name, email address or other contact details during a conversation, those details are recorded in my enquiry records at the point in the conversation when you give them, before you press Send on the in-chat form; the form is a review step over information I already hold. Clara is also set up to work out your likely company website from a work email address and to note the role you appear to hold, without asking you for either. When you do press Send, the details and a transcript of the conversation reach me in the same way as a website form.

Clara is instructed not to ask for your name or any personal detail in her opening reply, and not to start collecting details until you show an actual interest in a service, an enquiry, a newsletter sign-up or being put in touch with me. She is instructed to ask only for what the particular service needs.

Clara can also end a conversation and mark it for my attention where it appears to be spam, a sales pitch, time-wasting, suspicious or abusive. Where that happens, the IP address the conversation came from is recorded automatically and prevents further use of the chat from that address for thirty days. That is an automated step taken on the AI system's own assessment, without my reviewing it first. It affects the chat only: the enquiry form, the newsletter and email to me all remain open to you. If it happens to you and you think it is wrong, email me at [email protected] and I will look at it myself and remove the block if it should not have been applied.

The lawful basis for providing the assistant, logging conversations and protecting the site from abuse is my legitimate interests in helping visitors, in understanding and improving the service, in responding to enquiries and in keeping the site secure (UK GDPR Article 6(1)(f)). Newsletter sign-up through the assistant relies on your consent (Article 6(1)(a)).

Other AI processing of your information

Two further AI operations use Anthropic's Claude as my processor. Neither produces a decision about you that is taken solely by a machine and has a legal effect or a similarly significant effect on you; every reply and every decision about whether and how to work with you is mine.

First, when an enquiry arrives, the organisation named, the service asked about, any budget and timeline given, your message and any brief answers, including, for an enquiry made through Clara, the chat transcript, are sent to Anthropic, which returns a suggested priority (high, medium or low), a suggested service tier and a one-line reason. Your name, email address and telephone number are not included. The result is stored on the enquiry record and affects only the order in which enquiries are shown to me on my own dashboard.

Second, I use an AI-generated daily summary of my own workload. The information sent for that purpose includes the names and organisations of people with open enquiries, the email addresses and names of clients with overdue payments or past-due project dates, engagement references, amounts due and due dates, and figures about revenue and system health. It does not include enquiry message text or client email addresses beyond those cases.

The lawful basis for both is my legitimate interests in running the consultancy efficiently and responding to enquiries properly (Article 6(1)(f)). You may object to either at any time under Article 21; see "Your rights".

The client account

If you become a client I may give you an account on this website where you can see the details and progress of your engagement. To provide it, I store your name, email address, a securely hashed version of your password (never the password itself), your organisation, telephone number and website where you have given them, an internal note of my own about the engagement, and the details of your projects: the reference, the engagement, the dates, the stage, the deliverables, progress updates, the onboarding steps, the agreed fee, the scope, the payment terms, and any external folder, task-board or calendar reference. Proposal and billing records hold the service, amount, status, dates and relevant proposal, invoice or payment references. If either of us uploads a project file, the file is held in private Cloudflare storage and its account record includes the project, file name and type, size, version, status, visibility, replacement history and download history. When you review or approve a deliverable, accept or decline a proposal, request changes, or confirm completion, I keep the action, any comment, your account email address, the date and time, the applicable version and a fixed snapshot of the record acted on. Notification emails may tell either of us that an action occurred, but the signed-in account record is the source of truth. A non-disclosure agreement generated for you is not stored as an uploaded file.

Signing in sets one strictly necessary cookie so that you stay signed in securely. It is not used for measurement or advertising, and the Cookie Notice describes it in full. Sessions last seven days and end after twelve hours of inactivity.

Please note that Clara can be used from within the signed-in client area, and that the visible text of the page she is opened on is sent to the AI provider as described above. If you would rather your project details were not sent that way, do not open the chat while your project page is on screen.

The lawful bases are performance of our contract (Article 6(1)(b)) and my legitimate interests in administering client relationships (Article 6(1)(f)).

How enquiries and newsletter sign-ups are handled

An enquiry is emailed to me so that I can respond, and recorded in my own private database, hosted by Cloudflare, so that I can manage and follow up enquiries in one place. The email is delivered by Resend, my email provider. Enquiries made through Clara reach me the same way, together with the chat transcript. The lawful basis is my legitimate interests in responding to and keeping track of business enquiries (Article 6(1)(f)), and performance of a contract once an engagement is agreed (Article 6(1)(b)).

Newsletter sign-up uses a confirmed two-step opt-in. When you give your email address I send you a confirmation email and add you to the list only if you click the link in it, which expires after three days, so no address can be added without the owner's agreement. Your address is then held by Resend, which sends the newsletter on my behalf. Every newsletter carries an unsubscribe link, and you can also reply to any email from me, or write to [email protected], and I will remove you straight away. So that I can show your consent was properly given, I keep a dated record of the form you signed up from, the version of the wording you were shown, and the moment you clicked the confirmation link. The lawful basis is your consent (Article 6(1)(a)), which you may withdraw at any time.

Who else handles your information

I do not sell personal data and I do not share it for anyone else's marketing. The following organisations process personal data on my instructions, under contract, as my processors: Cloudflare, which hosts this website, its database, its file storage and its network protection; Anthropic, which generates Clara's replies, the enquiry priority suggestion and my daily summary; Resend, which sends my email and holds the newsletter list; and Asana, which holds my own task list. I also use Google Search Console, which receives no personal data of yours. My accountant and, where necessary, my professional advisers may see records that contain your information. I will disclose information where the law requires it.

Cloudflare, Anthropic, Resend and Asana are established in, or process data in, the United States. Those transfers are made under the safeguards permitted by Chapter V of the UK GDPR, applying the data protection test introduced by the Data (Use and Access) Act 2025, in practice the UK Addendum to the EU standard contractual clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it. You may ask me for details of the mechanism relied on for any particular provider.

How long I keep your information

The schedule below is the standard I work to. Where the table shows a period that is applied by hand rather than automatically, that is stated, because at present only the conversation log and the backup files are deleted automatically by the system itself.

Being straightforward about the three rows marked "not yet applied": those records currently have no automatic deletion, so they persist until I remove them by hand. Automatic deletion for each is being built. If you want any of them removed sooner in your own case, ask me and I will do it.

Erasure is carried out by me by hand against this schedule. When I complete a request I record what was done, erased in full, anonymised, retained because the law requires it, retained for accounting and tax record-keeping, declined because I could not verify the request, or another outcome that I explain, together with my reason and the lawful basis for anything kept. Backups taken before your request are not edited; they fall out of the backup cycle within 35 days, except for the single most recent backup, which is replaced when the next one is taken.

Your rights

Under UK GDPR you have the right to be told what personal data I hold about you and to have a copy of it; to have inaccurate data corrected; to have data erased where there is no good reason for me to keep it; to restrict or object to processing, including profiling; to receive data you gave me in a portable form; and to withdraw consent where I rely on it. You also have the right not to be subject to a decision taken solely by automated means that has a legal or similarly significant effect on you, and to ask for human involvement, to make representations and to contest such a decision.

To exercise any right, email [email protected] with the subject line "Data Protection Request", or use the enquiry form on the contact page and choose the data protection option. If you use the form, you will get an automatic acknowledgement straight away giving you a reference and the date by which I will answer. I will respond within one calendar month. Where a request is complex or there are several, I may extend that by up to two further months and will tell you if I do. Where I genuinely need you to tell me more before I can search for your data, I will ask, and the month runs from your reply. My search will be reasonable and proportionate rather than exhaustive, as the Data Protection Act 2018 now provides. I may ask you to confirm your identity before I disclose anything.

If you have a client account you can download a copy of your account, project, proposal, billing, project-file metadata, decision and data protection request records at any time from the account itself. File bodies that are still visible in your project library can be downloaded separately. You can also ask for your account to be deleted from there; making that request suspends your access while I deal with it. The account-data download does not yet include your original enquiry, your Clara conversations, the progress events, the activity log or the contents of uploaded files; ask me and I will supply those too.

You can switch the progress-event measurement described above off in one click, in this browser, using the control on the Cookie Notice. Doing that stops the events and removes the identifier from your browser immediately. You can also ask me to delete the events already recorded against it, and if you are in the EEA nothing is recorded in the first place.

Complaints

If you are unhappy with how I have handled your personal data, please tell me first, so that I have the chance to put it right. Email [email protected] with the subject line "Data Protection Complaint", or use the enquiry form on the contact page and choose the data protection option; either route is a valid complaint and you do not have to use any particular wording. If you use the form you are acknowledged automatically within minutes; in any event I will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, take whatever steps are appropriate, and tell you the outcome. This is the complaints procedure required by section 164A of the Data Protection Act 2018, inserted by the Data (Use and Access) Act 2025.

You also have the right to complain to the Information Commissioner's Office, the UK's independent data protection regulator, at ico.org.uk or on 0303 123 1113. The ICO will normally expect you to have raised the matter with me first.

Visitors in the EEA

My services are offered to visitors in the United Kingdom, Ireland, the rest of Europe, North America and the United Arab Emirates, so if you are in the European Economic Area the EU General Data Protection Regulation applies to your information alongside UK law, and you may complain to your own national supervisory authority as well as to the ICO. Two differences matter in practice. The statistical-measurement exception in regulation 6 described above is a feature of UK law and has no equivalent in the EEA. I do not rely on it in the United Kingdom either: the identifier is consented to everywhere. But rather than run a measurement question at all for something that exists only to tell me where visitors abandon a free tool, no progress event is recorded for visitors whose connection places them in an EEA country, whatever they have accepted. Nothing is stored server-side about you from it. And Clara is an AI system within the meaning of the EU Artificial Intelligence Act, whose transparency requirements for AI systems that interact with people apply from 2 August 2026; she identifies herself as an AI assistant, and you can always reach me by email instead.

Security

This site is served only over HTTPS, with a strict content security policy, and no third-party script other than Cloudflare's measurement beacon is permitted to run. Passwords are stored only as salted hashes and are rehashed to the current work factor when you sign in. Sign-in attempts are rate-limited by IP address and email address. Administrative access requires a separate credential and, for changes to client records, a second confirmation. Project uploads are held outside the public media library, are limited to PDF, PNG, JPG and plain-text formats up to 10 MB, are checked against the declared file type, and are served only through an authenticated download as an attachment. Database backups are taken to Cloudflare storage that is not publicly readable, verified by reading them back, and tested by restoring them into a separate database. Backup files are not separately encrypted by me beyond the encryption the storage provider applies.

Changes to this policy

I update this policy when the way the site works changes or when the law changes. The date at the top shows when it was last revised. Where a change materially affects you, I will say so in the newsletter or by email.