NOT READY

5 details are still missing from this page, marked in amber below. Fill them in and delete this strip before the site goes live. Nothing else on the page is waiting on anything.

The Ghost · Legal

Privacy

What I collect, why I've got it, who else can see it, and how to make me delete it. Written to be read rather than survived.

01Who I am
02What I collect
03The Beige Test
04Who else sees it
05Outside the UK
06How long I keep it
07Your rights
08Keeping it safe
09Complaining

WHO I AM

I'm the data controller for everything described on this page. That means the decisions about your information are mine, and so is the responsibility.

Who I amSarra Richmond, trading as The Ghost. SOLE TRADER OR LTD, AND COMPANY NUMBER IF LTD

Where I am2 Blackworth Court, Highworth, Swindon, Wiltshire, SN6 7NS, United Kingdom.

How to reach mesarra@theghost.rocks. That address reaches me directly and I answer it myself.

VATVAT NUMBER

Data protectionRegistered with the Information Commissioner's Office, registration number ICO REGISTRATION NUMBER

WHAT I COLLECT, AND WHY

6 situations. That's the lot.

You join The LetterYour email address, and your first name if you give me one. I use it to send you the Beige Test breakdown and then a letter most weeks. The lawful basis is your consent, which you gave by typing your address in and which you can withdraw with the unsubscribe link at the bottom of every email. That link works instantly and I'm not notified in a way that lets me chase you.

You ask for a cold readYour first name, email address and LinkedIn URL, plus your company, role and what you want to be known for if you give them. I use them to read your profile and send you the read. They're held in Kit and in my systems. The lawful basis for the read is taking steps at your request. The Letter is only for people who tick the box on the form. If you do, the lawful basis is your consent, and the unsubscribe link at the bottom of every email withdraws it.

You buy somethingYour name, email address, billing address and what you bought. I need it to take the payment, do the work, and keep the records HMRC requires. The lawful basis is performing our contract, and for the tax records, a legal obligation. I never see your card details. They go straight to the payment processor and are never on any system of mine.

You book a callYour name, email address and whatever you type in the box. Used to hold the call and to know what it's about. The lawful basis is taking steps at your request before entering a contract.

You email meWhatever is in the email. I keep it so I can answer it and so I have a record of what we agreed. The lawful basis is my legitimate interest in running a business and being able to look up what was said.

You become a clientThe material you send me. Posts, drafts, links, recordings, transcripts, notes, and anything you say in a session. I need it to do the work you're paying for. The lawful basis is our contract. If the material contains other people's personal data, I handle it as your processor and only on your instructions.

THE BEIGE TEST COLLECTS NOTHING

The 12 questions, your answers, your score and your band all live in your own browser and never leave it. Nothing is sent anywhere. I don't know you took it, I don't know what you scored, and there's nothing for me to store.

The only way I find out anything is if you type your email address into the box afterwards, which is a separate decision and an obvious one.

Close the tab and it's gone. That isn't a privacy feature I bolted on. It's just how the page is built.

WHO ELSE SEES IT

I'm 1 person. There's no team, no agency, no contractor, and nobody junior. Your information isn't passed to anyone for their own purposes and it's never sold, rented or traded. It does pass through the companies whose tools I run the business on, and here they all are.

KitThe email list and the sending, including cold read requests. United States. kit.com/privacy

ThriveCartThe checkout. United States. thrivecart.com/privacy-policy

Payment processorSTRIPE, PAYPAL OR BOTH Takes the card details. I never see them.

CalendlyBooking the calls. United States. calendly.com/privacy

CloudflareServing this website. Sees the request, including your IP address, in order to send you the page. United States and worldwide. cloudflare.com/privacypolicy

Google FontsThis site loads 2 typefaces from Google. Doing so tells Google your IP address. It sets no cookies and it identifies nothing else about you, but it is a request to a 3rd party, so it's listed here rather than glossed over. policies.google.com/privacy

HMRC and my accountantSales records, because the law says so.

Beyond that, the only time I'd hand anything over is if a court or a regulator required it, and I'd tell you unless I were legally prevented from doing so.

INFORMATION THAT LEAVES THE UK

4 of the companies above are in the United States, so your information goes there. That's allowed, and it's covered by the UK extension to the EU-US Data Privacy Framework, or by the UK's International Data Transfer Addendum where a supplier isn't certified under it.

In plain terms: they're contractually bound to protect it to the standard UK law requires, and if they don't, that's on them and on me.

If you want to see the specific mechanism for a specific supplier, email me and I'll send it.

HOW LONG I KEEP IT

The LetterUntil you unsubscribe, and then a suppression record so I don't accidentally add you back. If you never open anything for 2 years I'll remove you without being asked.

Cold read detailsHOW LONG COLD READ DETAILS ARE KEPT The Letter part follows the line above.

Sales records6 years after the end of the tax year. That one isn't my choice, it's HMRC's.

Booking details12 months after the call.

Emails3 years, then deleted unless they're part of a live piece of work.

Client materialFor the length of the work and 12 months after it ends, so you can come back and ask for something. Then deleted. Ask me sooner and I'll do it sooner. Voice notes are deleted on request at any point, including during the work.

WHAT YOU CAN MAKE ME DO

UK GDPR gives you these. Email sarra@theghost.rocks and use any of them. I have to answer within 1 month and I don't charge for it.

See it. Ask for a copy of everything I hold about you.
Correct it. If something's wrong, tell me and I'll fix it.
Delete it. Ask me to erase it. I'll do it unless the law makes me keep it, and if that happens I'll tell you exactly which bit and why.
Pause it. Ask me to stop using it while something is being sorted out.
Take it with you. Ask for it in a format you can hand to somebody else.
Object. Tell me to stop processing it where I'm relying on legitimate interests.
Withdraw consent. Unsubscribe, or just say so. It doesn't affect anything I did before you withdrew.
Stop the marketing. Absolute, immediate, no reason needed, and I won't ask for one.

I don't do automated decision-making or profiling. No scoring, no segmentation by behaviour, no lead grading. If you're on the list you get the same letter as everybody else on the list.

KEEPING IT SAFE

Encrypted devices, a password manager, 2-factor authentication on every account that offers it, and no shared logins because there's nobody to share them with.

I keep the least I can get away with. The list holds an email address and sometimes a first name. If you asked for a cold read, it also holds what you typed into that form. That's the entire profile.

If something did go wrong in a way that put you at risk, I'd tell the ICO within 72 hours and I'd tell you without dressing it up.

IF YOU'RE NOT HAPPY

Email me first. I'd rather fix it than have it escalate, and I'm not going to be defensive about it.

You don't have to come to me first though, and you can complain to the regulator whether or not you do.

Information Commissioner's OfficeWycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
0303 123 1113
ico.org.uk/make-a-complaint

Last updated 10 September 2026