Skip to main content

Privacy policy

Last updated: May 2026

This policy explains how Cypress Quill Media ("we", "us") collects, uses, and protects personal data when you visit cypressquillmedia.com ("the site"), subscribe to the newsletter, contact us, or buy a digital product.

Cypress Quill Media is operated as a sole-trader business based in the United Kingdom. We act as the data controller for personal data collected through this site. UK GDPR and the Data Protection Act 2018 apply.

What we collect

Information you provide

  • Email subscriptions: if you sign up to the newsletter, we collect your first name and email address.
  • Contact form: if you write to us, we collect the name, email address, reason for contact, and message you submit.
  • Purchases: if you buy a digital product, the order is processed by Gumroad. We do not see or store your payment details. We receive your email address and order metadata to fulfil and support the purchase.

Information collected automatically

  • Anonymous analytics (Vercel Analytics): records aggregate, anonymous visit data (page paths, country, referrer, device class). Cookieless — does not use persistent identifiers; visitors are not individually identifiable. Always on.
  • Consent-based analytics (Google Analytics 4): when — and only when — you click Accept on the cookie banner, we load Google Analytics, which sets two cookies (_ga and _ga_XCM5JXJ10C, both 2-year duration) so we can understand site usage in aggregate. Click Decline and the script never loads. You can change your choice at any time on the cookie policy page.
  • Server logs: our hosting provider may log IP addresses and request metadata briefly for security and abuse prevention.

Why we use it

  • To send you newsletters and the lead-magnet content you requested (lawful basis: consent).
  • To answer your messages (lawful basis: legitimate interests — responding to enquiries).
  • To deliver and support digital products you purchase (lawful basis: contract).
  • To understand which content is useful, in aggregate (lawful basis: legitimate interests — improving the site).
  • To meet legal and accounting obligations (lawful basis: legal obligation).

Third-party services we use

We use a small number of third-party services to run the site. Each receives only the data needed to do its job, and each has its own privacy policy:

  • Vercel — hosting and anonymous (cookieless) analytics.
  • Google (Google Analytics 4 + Google Fonts CDN) — analytics on consent only; fonts always loaded.
  • Kit (formerly ConvertKit) — newsletter delivery and audience management.
  • Gumroad — digital product checkout and delivery.
  • Formspree (or equivalent) — contact form processing.
  • Spotify for Podcasters / Buzzsprout — podcast hosting and embedded player.
  • Google Fonts — typography. We load fonts directly from Google's CDN.

Some of these processors may transfer data outside the UK/EEA (notably to the United States). They use Standard Contractual Clauses or equivalent safeguards as required.

Cookies

We use very few cookies. The cookie banner explains the categories. See the cookie policy for the full list and instructions on managing them.

How long we keep it

  • Newsletter subscriber data: until you unsubscribe (every email has a one-click unsubscribe link), then deleted within 30 days.
  • Contact form messages: kept for up to 24 months for follow-up reference, then deleted unless an active conversation continues.
  • Order data: retained as required by UK accounting and tax law (typically 6 years from the end of the relevant accounting period).
  • Analytics data: aggregate, anonymous, kept indefinitely for trend analysis.

Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate data corrected.
  • Have your data erased (where the legal bases above no longer apply).
  • Restrict or object to processing.
  • Have your data ported to another service.
  • Withdraw consent at any time (for newsletter subscriptions, the unsubscribe link is the simplest way).

To exercise any of these rights, email hello@cypressquillmedia.com. We aim to respond within 30 days.

You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk.

Children

The site is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

Security

The site runs over HTTPS. Subscriber data is held by Kit; order data by Gumroad — both are reputable services with industry-standard security practices. No system is perfectly secure, but we take reasonable precautions and respond promptly to any incident.

Changes to this policy

We may update this policy from time to time. The date at the top reflects the most recent version. Material changes will be flagged in the next newsletter.

Contact

Questions or requests about this policy: hello@cypressquillmedia.com.