Privacy

This page explains what rutherford.consulting collects, why, and what you can ask me to do about it. The site is run by me, James Rutherford, trading as Rutherford Consulting. If you have a question about anything here, email james@rutherford.consulting.

The short version: I collect what you choose to send me, plus anonymous-by-default analytics about how the site is used. The site sets no cookies. I don't sell personal information, I don't run advertising on the site, and I won't add you to a mailing list without asking.

What I collect, and why

When you contact me

The contact form asks for your name, email, organization (optional), your message, and how you heard about me (optional). I use this to reply and, if we work together, to keep a record of the conversation. Submissions are stored in my CRM, HubSpot. If HubSpot can't be reached, the submission is emailed to me instead so it isn't lost.

If you email me directly, the same applies to what you send.

The Operating Check

You can complete the Operating Check and see your overall result without giving me any personal information. Your answers and scores are recorded anonymously in the site's analytics, which tells me which questions people find hardest.

If you ask for the category breakdown, you give me your name, email, organization (optional), and optionally your revenue band, ownership type and role. That information and your scores are stored in HubSpot alongside your contact details, so I can follow up if you'd like to talk.

Booking a call

The booking page is run by Google Calendar, so Google's privacy policy covers the page itself. When you book, I receive your name, email, and your answers to the booking questions. An automated process copies these into HubSpot so I have the context before we speak.

Calls take place on Google Meet. I don't record or transcribe a call unless everyone on it agrees at the start.

The chat assistant

The chat assistant answers questions about my work. Your messages are sent to Anthropic, which provides the AI model, to generate each answer. Under its commercial terms, Anthropic does not use these messages to train its models.

I keep a log of questions and answers so I can see what people want to know and improve the assistant. The log doesn't include your name or email, only the time and a one-way scrambled version of your IP address, which I use to stop abuse. Please don't share anything confidential in the chat; if you want to discuss something sensitive, email me instead.

Downloads

Some resources ask for your name and email before you can download them. These are stored in HubSpot so I know who requested what.

How the site is used

I use PostHog to understand how the site is used: which pages are visited, in what order, for how long, what's clicked, how far down a page people read, and whether anything breaks. PostHog also records your browser, device type, the site that referred you, and an approximate location derived from your IP address.

For visitors outside Europe, PostHog also makes a recording of the visit: a reconstruction of what was shown on screen and where the mouse moved and clicked, so I can see where the site is confusing. Anything typed into a form is masked and never captured in a recording. I don't make recordings for visitors in Europe.

This analytics is anonymous by default. It doesn't use cookies or store anything on your device, so every visit starts fresh. It only becomes linked to you if you identify yourself some other way, for example by filling in a form during the same visit.

If your browser sends a Do Not Track or Global Privacy Control signal, the analytics doesn't run at all.

Links I share

Links I send in messages or post on LinkedIn sometimes go through a short address such as rutherford.consulting/go/…. When one is used, I log that it was opened, along with the browser and approximate location, so I know whether a link I sent was opened.

Cookies

This site doesn't set cookies or store anything in your browser. Pages on other sites that it links to, such as the Google booking page or LinkedIn, have their own policies.

Who processes your information

I use a small number of service providers, each only for the purpose described:

• Hetzner hosts the website and my automation server.
• HubSpot stores contacts and enquiries.
• Google Workspace provides email, calendar, the booking page and video calls.
• PostHog provides site analytics and visit recordings.
• Anthropic generates the chat assistant's answers.

All of them process information in the United States.

I don't sell personal information or share it with anyone for advertising, and nobody else gets access to it unless the law requires it.

If you're outside the United States

Everything above is processed in the United States. If you're in the EU, UK or elsewhere, your information is transferred there, relying on the safeguards those providers offer, such as the EU–US Data Privacy Framework or standard contractual clauses.

For visitors in the EU and UK, the legal bases are: taking steps you've asked for before a possible engagement (replying to you, booking a call); my legitimate interest in running and improving the site and keeping it secure (analytics, the chat log, abuse prevention); and your consent where I ask for it (recording a call).

How long I keep it

• Enquiries, Operating Check breakdowns, downloads and booking details: while we're in contact, and for three years after our last contact, unless you ask me to delete them sooner.
• Chat log: 12 months, then deleted automatically.
• Analytics and visit recordings: up to one year, then deleted automatically by PostHog.

Your choices and rights

You can ask me to:

• tell you what I hold about you and send you a copy
• correct it
• delete it
• stop using it for a particular purpose

Email james@rutherford.consulting and I'll respond within 30 days. You don't need to give a reason. If you're in the EU or UK and you're not satisfied with my response, you can complain to your data protection authority.

Security

The site is served only over an encrypted connection. Access to the systems that hold your information is limited to me and protected by strong passwords and two-factor authentication where the provider supports it. No system is perfectly secure, but I keep what I hold to what I need.

Children

This site is for business audiences and isn't directed at anyone under 16. I don't knowingly collect information from children.

Changes

If I change how the site handles personal information, I'll update this page and the date at the top.