Privacy

Who is responsible

Martin Crandon is the controller for personal data processed through this website. For privacy questions or requests about your personal data, email contact@martincrandon.com.

Optional analytics and your choice

The site uses self-hosted Umami analytics on the homepage, work case studies, and this privacy page. The lawful basis used for this optional analytics is your consent. No request is sent to Umami until you accept analytics.

You can change your choice at any time using the persistent Privacy settings control. If you reject, the site does not load the Umami script. Do Not Track is also honoured; while it is enabled, Umami stays off.

Umami is designed to work without cookies. To remember your choice, this site stores a small versioned preference in your browser's local storage, not in a cookie. It records whether you accepted or rejected, the time of that decision, and the policy version. The preference expires after 180 days, or sooner if you clear browser storage or the policy version changes. If persistent storage is unavailable, an explicit acceptance is kept in memory for the current page and cannot be saved for your next visit. A rejection may also be held in tab-scoped storage so an earlier saved acceptance cannot restart Umami after the page reloads. The interface tells you when a choice was not saved as a persistent preference.

What Umami receives

After consent, Umami may receive the page address (including its query string), the referrer address, browser and device details, and approximate location. Umami processes the IP address to create a rotating hash used for pseudonymous session grouping; the IP address is not stored as a field in the analytics record. The IP address is still processed to deliver the request and may be handled in operational or security logs by the service providers.

Analytics is used to understand visits to this site. No advertising profile or cross-site tracking is configured here.

Hosting and service locations

Cloudflare Pages serves the website. The self-hosted Umami application runs on Vercel, and its Neon database is configured in the London region. A database region does not mean all processing, routing, support, or operational logging stays in the UK. Cloudflare, Vercel, Neon, and other providers may process information in other countries.

The providers' service terms include data-processing provisions. Where information is transferred outside the UK, their published data-processing terms describe the applicable safeguards, including standard contractual clauses and the UK international data transfer addendum. You can read those terms below or contact me for further information.

• Cloudflare privacy policy
• Vercel privacy notice
• Neon privacy and security resources
• Umami data and metric definitions
• Cloudflare data-processing terms
• Vercel data-processing terms
• Neon service terms and data-processing terms

Retention

Analytics records older than 90 days are deleted by a daily cleanup. This means records are normally removed within about 91 days of collection. If a cleanup fails, removal may be delayed until it is restored. Session metadata may remain while a retained analytics record still refers to it, and is removed after no retained analytics rows depend on it. Database backup retention is managed separately by the database provider. Consent preferences expire after 180 days and are stored only in the browser used to make the choice.

Changing your mind

Choose Reject analytics in Privacy settings to withdraw consent. If analytics is already running, the page reloads to stop further collection. Withdrawal stops future analytics collection; it does not undo or invalidate processing that happened before you withdrew consent.

Other website requests

The analytics setting controls Umami only. Cloudflare receives the connection information needed to serve and protect the website. Site images and other media may be served from Sanity's content delivery network or from project-specific external hosts. Hover previews can contact their source sites; Spotify's player is requested when the Music section is opened or playback is requested; and project pages may contain YouTube or Vimeo embeds. Following map and other external links also connects you to those providers. These requests are separate from Umami consent, and the relevant provider may receive connection data such as your IP address, browser details, and the page that referred you. Their own privacy information applies.

Your rights

Depending on the circumstances, you may have rights to request access to, correction of, erasure of, or restriction of personal data, to object to certain processing, and to data portability. You can withdraw consent to optional analytics at any time using Privacy settings. To make a privacy request, email contact@martincrandon.com.

You can also complain to the Information Commissioner's Office (ICO) if you are concerned about how your personal data is handled.