Privacy
What this site knows about you.
Almost nothing, and only what you hand over deliberately. This page says exactly what is collected, why, and how to make it stop.
The short version
If you just read this site, no account is created, no cookies are set, and nothing about you is stored. The only personal data collected is an email address, and only if you type one into the subscribe box yourself.
Who is responsible
Margin & Co. is an independent research project run by one person, Adam Benghalia, in the United Kingdom. For data protection purposes I am the data controller. You can reach me at hello@marginco.co.uk.
What is collected
If you only read the site
Nothing that identifies you. There are no accounts, no advertising, no tracking pixels, and no analytics scripts — the site ships no JavaScript at all, which you can verify in your browser's developer tools or by reading the source.
The site is served through Cloudflare, which processes technical request data (IP address, browser type, page requested) to deliver pages and block attacks. This is standard infrastructure logging, it is not linked to any identity, and I do not receive a copy of it. Cloudflare's own privacy policy covers that processing.
If you subscribe
Your email address, the date you subscribed, and a record that you gave consent. That is the entire record. No name, no location, no inferred interests.
Why, and on what legal basis
Your email is used for one purpose: sending you the weekly research report. It is never used for anything else.
The lawful basis under UK GDPR is consent, which you give by ticking the box on the subscribe form. Consent can be withdrawn at any time, and withdrawing it is as easy as giving it.
Cookies
This site sets no cookies. There is no cookie banner because there is nothing to consent to.
Who your data is shared with
Nobody. The subscriber list is not sold, rented, shared, or used for advertising. It sits in Cloudflare storage attached to this site.
If a mailing provider is used in future to actually send the emails, this page will be updated to name it before any data is transferred, not after.
How long it is kept
Until you unsubscribe, at which point the record is deleted rather than flagged as inactive. If the project stops publishing, the list is deleted.
Your rights
Under UK GDPR you have the right to access a copy of your data, correct it, have it deleted, restrict or object to its use, and take it elsewhere. Exercising any of these costs nothing.
Email hello@marginco.co.uk and I will action it within 30 days, usually the same week. For a deletion request you do not need to give a reason.
If you think I have handled your data badly, you can complain to the Information Commissioner's Office. I would rather you told me first so I can fix it.
Security
The site is served over HTTPS only, with HSTS, a strict Content Security Policy that forbids JavaScript entirely, and clickjacking protections. No passwords are stored because there are no accounts. There is no payment processing on this site.
No system is perfectly secure. If you find a vulnerability, please email hello@marginco.co.uk — you will get a fast reply and public credit if you want it.
Changes
If this policy changes materially, the date at the top changes and subscribers are told by email. Previous versions are visible in the public git history, so you can see exactly what changed and when.