We collect the least we can get away with.

What is collected, and why

There are five situations in which this site handles information about you. Nothing outside these five is collected.

1. Conversation requests (this form was retired on October 23, 2026)

Until October 23, 2026, a form at cultmath.com/request asked for your name, email address, company, role and company website, and five short questions about your business: the decision you are weighing, who buys from you and why, what they compare you to and whether your price sits higher, the same or lower, where sales stall, and what you would want customers to say about you. Everything was required. Nothing confidential was asked: no costs, contracts or exact prices. The page also recorded which page on this site sent you, if any. The form no longer exists; this section applies to requests already sent.

That information was used to read your request, prepare the positioning review, and reply. It is also looked at in aggregate, by me alone, to understand who asks and what they ask about, so the work and this site get better. It is not added to a mailing list, and it is never sold or shared.

Your request is emailed to me and saved in a request store: a database hosted in the United States (Upstash, through Vercel) that only I can open, behind the same sign-in as the rest of the site's private tools. To limit spam, the site counts requests per connection for one hour using a scrambled version of your IP address; the address itself is never stored.

Reader polls. If you vote on a question at /predict, your answer is added to an anonymous count in the same store. To allow one vote per browser, the site sets one cookie holding a random, signed identifier. It contains nothing about you, is HttpOnly and Secure, and is sent only to the voting service. The store keeps a scrambled version of that identifier with the answer you chose, so it can tell that a browser has already voted, and it counts votes per connection for one hour using a scrambled version of your IP address. Your name, email and IP address are never collected for a vote.

2. When you submit a form inside a Google ad

CULT+MATH sometimes runs advertising on Google. If an ad carries a form, the name, email address, company, and answers you provide there are passed to me by Google and used the same way as a request sent through this site: to read it and reply.

Google's own handling of that submission is governed by Google's privacy policy, not this one. Google also sets advertising cookies in its own products. It does not set any on this website.

3. When you open a private client or working page

Some pages under /clients and /for are password protected. When you sign in, a session cookie is set so that you are not asked for the password on every page. That cookie holds a signed session token and nothing else. It is HttpOnly, Secure, restricted to that one client area, and it expires on its own.

It is a functional cookie. It does not follow you, it cannot be read by other sites, and it is not used for advertising or measurement.

4. When you browse a public page

Public pages on this site carry a Google advertising tag, account AW-18400942856. It exists for one reason: CULT+MATH runs advertising on Google, and the tag reports back whether an advertisement led to a conversation request. Without it there is no way to tell a working advertisement from a wasted one.

The tag sets cookies in your browser and sends Google information about your visit, including your IP address, the page you are on, and whether you completed a request. Google may use this to measure and personalise advertising under its own terms.

If you buy a brief, the page you land on afterwards reports that purchase to the same account — the amount paid, the currency, and the Stripe checkout reference, which is sent so that one sale cannot be counted twice. That reference is an opaque identifier Stripe generates for the transaction. It is not your name, your email address or your card, none of which this site ever sends to Google.

The tag is deliberately absent from every private page. It does not run on client deliverables under /clients, on working pages under /for, or on the sign-in page. Client engagement material is not Google's business, and those pages are excluded from advertising measurement by design rather than by oversight.

Consent settings are applied before the tag loads. Visitors from the European Economic Area, the United Kingdom and Switzerland have advertising and analytics storage set to denied by default, so no cookies are set for them and advertising identifiers are stripped from any request. This site does not show a consent banner; it withholds the storage instead.

Google Analytics. Public pages also load Google Analytics 4 through the same file, so I can see which pages are read, which links lead to a conversation request or a purchase, and which sites and AI assistants send readers here. It records the page you are on, the page that sent you, your approximate location and device type, and a small set of events: clicking a link to /request or /advisory, clicking a payment link, sending a request, and completing a purchase. The request event says only that a request was sent. It carries no name, email address or answers. The purchase event carries the amount, the currency and the same Stripe checkout reference described above. Nothing you type into a form is sent to Google Analytics, and no personal information is sent as an event detail. Google Analytics does not store IP addresses. It sets cookies in your browser, and the regional consent defaults above apply to it in the same way. It is absent from the same private pages as the advertising tag.

If you would rather not be measured at all, any mainstream ad or tracker blocker will stop the tag, and nothing on this site breaks when it does. Google also offers its own ad settings and opt-out tools.

5. When you subscribe to Sound Decisions

Many public pages show a small bar near the bottom with one field, once you have read some of the page. If you enter your email address and press Subscribe, this site saves the address, the page you were on, a note that you asked for the emails, and the time. That is all it saves. The bar is not shown on the request page, the purchase pages, or the private pages, and dismissing it keeps it away for 30 days. It remembers that in your browser's own storage, not on a server.

The address is stored in a database hosted in the United States (Upstash, through Vercel) that only I can open, and it is passed to Substack, which sends one confirmation email and then the newsletter. Substack holds the address under its own privacy policy. Every email carries an unsubscribe link, and you can also write to me to be removed from both places. To limit abuse, the site counts attempts from each connection using a scrambled, one-way code in place of your IP address. The code expires within the hour. The site does not say whether an address was already subscribed.

6. Ordinary server records

This site is hosted on Vercel. Like any web host, its servers keep short-lived technical records of requests, which include IP addresses and browser information. These are used to keep the site running and to investigate abuse or errors. I do not build profiles from them and do not connect them to any form submission.

Typography on this site loads from Google Fonts, which means your browser contacts fonts.googleapis.com and fonts.gstatic.com. Google receives your IP address as part of that request. It is a genuine third-party contact and worth naming rather than burying.

What this site does not do

Stated plainly, because most policies bury it:

• One analytics product, and only that one. Public pages use Google Analytics 4 and the Google advertising tag, both described above. There is no other analytics tool, no session recording, no heatmaps and no tag manager.
• No tracking on private pages. Client and working areas carry no tag at all. Pages under /for additionally enforce a security policy that would block one at the browser level.
• No sale of personal information. Your information is not sold, rented, licensed, or traded, and it never will be. Under California law this also means no sharing for cross-context behavioural advertising.
• No profiling and no automated decisions. Nothing about you is scored by a machine. A person reads what you send.
• No sensitive information wanted. Please do not send health, financial account, government identifier, or similarly sensitive details through a form. If you send them anyway, they will be deleted.

If any of this changes, this page changes in the same commit as the code that changed it. A privacy policy that lags the software it describes is not a policy, it is a decoration.

Who else handles your information

Running even a small business means using other companies' software. These are the only ones that touch anything you send. Each is used for the single job listed and nothing more.

Beyond these, information is disclosed only where the law requires it, or where it is necessary to establish or defend a legal claim. If CULT+MATH LLC were ever sold or merged, information would transfer with the business, and this page would say so before it happened.

Some private client deliverables use additional services chosen for that engagement. Where that applies, it is set out in the agreement with that client rather than here, because it is their data and their contract governs it.

How long it is kept

• Newsletter subscriptions are deleted from the subscriber store automatically two years after you subscribe, or sooner if you ask. Substack keeps its copy until you unsubscribe.
• Conversation requests are deleted from the request store automatically two years after you send them. The emailed copy is kept for as long as the relationship is live, and for up to two years after the last contact, so that a later conversation can pick up where the previous one left off. Ask sooner and both go sooner.
• Session cookies for private pages expire on their own within hours. Nothing persists after that.
• Poll votes: the record that a browser voted, and its answer, is deleted automatically about 13 months after the vote, and the voting cookie expires on the same schedule. Vote totals contain nothing personal and are kept as a record of how readers called the question.
• Advertising cookies set by the Google tag follow Google's own retention, typically up to two years, and can be cleared from your browser at any time.
• Server records are retained on the host's standard schedule, which is a matter of weeks, not years.
• Client engagement material is governed by the agreement with that client, which sets its own retention and deletion terms.

Your rights

Depending on where you live, you may have legal rights over your information under the Texas Data Privacy and Security Act, the California Consumer Privacy Act, the UK and EU General Data Protection Regulation, or a comparable law. Those rights generally include the following:

• Access. Ask for a copy of what is held about you.
• Correction. Ask for anything inaccurate to be fixed.
• Deletion. Ask for it to be erased.
• Portability. Ask for it in a form you can take elsewhere.
• Objection. Ask that it stop being used for a particular purpose.
• No retaliation. Exercising any of these rights costs you nothing and changes nothing about how you are treated.

These requests are honoured for everyone who asks, wherever they live. A firm this size may fall outside some of these statutes. That is not a reason to make people argue about jurisdiction to get their own information back.

There is no account to log into and no dashboard to navigate. Write to me, tell me what you want done, and it gets done. Expect a reply within thirty days, and usually much sooner.

Where the GDPR applies, the lawful bases relied on are your consent when you choose to send a form or subscribe, and legitimate interests in operating a secure website and responding to enquiries. Consent can be withdrawn at any time. Nothing in the five situations above involves an international transfer beyond the ordinary use of the United States services named above.

Security, and its limits

This site is served over HTTPS. Private client areas sit behind password authentication with signed, expiring, HttpOnly session cookies scoped to a single client's pages. Access is granted on a least-privilege basis, meaning each client area can reach only its own material. Credentials and keys are held as environment variables and are never committed to the code repository. A content security policy restricts what any page is permitted to load.

No system is perfectly secure, and anyone claiming otherwise is selling something. What is promised here is a specific standard of care, not a guarantee. If a breach ever affected your information, you would be told directly and promptly rather than through a legal notice buried on a webpage.

Children, and changes to this page

This site is built for business audiences and is not directed at children. Information is not knowingly collected from anyone under 18. If you believe a child has sent something through a form here, tell me and it will be deleted.

If this policy changes, the effective date at the top changes with it, and the substance of the change is described here rather than quietly slipped in. Material changes will be summarised in this section for a reasonable period after they take effect.

Change log · August 20, 2026: first published version. Amended the same day to disclose the Google advertising tag added to public pages, the cookies it sets, the regional consent defaults, and how to opt out. The earlier claim that this site carried no advertising tag was accurate when written and is no longer, which is why it was removed rather than left standing. September 25, 2026: added reader polls at /predict, the anonymous voting cookie, and how long a vote is kept. October 23, 2026: added a newsletter sign-up bar to public pages, and what it saves and where, and added Google Analytics 4 to public pages. The earlier statement that this site carried no analytics product was accurate when written and is no longer, which is why it was changed rather than left standing.