Privacy Notice

Who is responsible

CTO on Demand is the trading name of Nick Tong's fractional and interim CTO practice, based in the United Kingdom. I am the data controller for everything described here. For anything on this page, including a request to see or delete your data, email web@ctoondemand.co.uk.

What I collect, and when

Nothing is collected until you submit a form. Browsing the site anonymously stores no personal data.

• Booking a call (/book/): your name, email, company, funding stage, and the situation you describe in the brief.
• Getting in touch (/about/): your name, email, company, and your message.
• Requesting a rate card (/services/ and /ai-brain/): your name, email, and company.
• Joining a course waitlist (/course/ and /course/ai-fluency/): your name, email, company, and the fact that you ticked the marketing consent box, with a timestamp.
• Subscribing to the Drift Digest (/digest/, the blog, and the tool pages): your email address only.
• Unlocking a scorecard or calculator report (/tools/): your email, plus the answers and figures you entered, because the report is built from them.
• Emailing yourself a generated file (the voice.md generator): your email and the file the tool generated in your browser. The writing samples you paste in are never sent anywhere: the generator runs entirely on your device.

Why I use it, and the lawful basis

• To reply to you and deliver what you asked for (the rate card, the report, the file, the call). Lawful basis: performance of a contract, or my legitimate interest in responding to a business enquiry you initiated.
• To send the Drift Digest and course emails. Lawful basis: your consent, recorded with a timestamp when you tick the box. You can withdraw it at any time and every email carries an unsubscribe route.
• To keep a record of who has been in touch so I do not lose your enquiry and do not ask you the same questions twice. Lawful basis: legitimate interest in running the business.

I do not use your data for advertising, I do not build profiles for third parties, and I do not sell or rent it to anyone.

Who processes it on my behalf

I use a small number of established suppliers. They process your data on my instructions only, under their own data-processing terms.

• HubSpot: the CRM where enquiries and subscriptions are stored. This is the system of record for your contact details and the notes attached to them.
• Resend: sends the confirmation and digest emails and holds the subscriber list.
• Anthropic: when a new enquiry arrives, the details you submitted are sent to Claude to draft a suggested reply for me to review. The draft is written back to your CRM record. No email is ever sent to you automatically as a result, and nothing about you is used to train a model.
• Slack: a notification to me that an enquiry has arrived, including what you submitted, so I see it promptly.
• Vercel: hosts the site and runs the form endpoints. Standard server logs include IP addresses, used for rate limiting and abuse prevention.
• Cal.com: the booking calendar embedded on /book/. If you pick a slot, the details you enter there are handled by Cal.com as well as by me.
• Google Analytics: only if you accept analytics cookies. See below.

Some of these suppliers are based in the United States, so your data may be transferred outside the UK. Each provides safeguards for those transfers under its own terms.

Cookies and analytics

The site sets no analytics cookies until you choose. On your first visit you get a banner with a genuine choice: if you decline, no analytics script is loaded at all and your choice is remembered in your browser's local storage. If you accept, Google Analytics 4 loads and records anonymous usage data such as which pages are read and which buttons are clicked. You can change your mind by clearing site data in your browser.

How long it is kept

Enquiries and their notes are kept in the CRM for as long as there is a plausible business relationship, and reviewed periodically after that. Newsletter subscriptions are kept until you unsubscribe. If you ask me to delete your data, I delete it from the CRM and the mailing list rather than keeping a suppressed copy, unless I am legally required to retain something.

Your rights

Under UK GDPR you can ask me to show you what I hold, correct it, delete it, restrict how I use it, or send it to you in a portable form. You can object to processing based on legitimate interest, and you can withdraw marketing consent at any time. There is no charge and no form to fill in: email web@ctoondemand.co.uk and I will action it, normally well inside the one-month statutory deadline. To unsubscribe from emails, you can also just reply "unsubscribe" to any of them.

If you are unhappy with how I have handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk, though I would rather you gave me the chance to put it right first.

Changes to this notice

If what the site does with your data changes, this page changes with it, and the date at the top moves. Material changes affecting people already on the mailing list will be flagged in an email rather than made quietly.

Questions about any of this: web@ctoondemand.co.uk.