Privacy policy

Who I am

I'm Tom Greenwood, a sole trader based in the United Kingdom, the author and publisher of the book Overton's Garden and the operator of this website at overtonsgarden.com. When this policy says "I," "me," or "my," that's me.

I am the data controller for personal data collected through this website. My UK Information Commissioner's Office (ICO) registration number is [pending — to be added once issued].

If you have any questions about this policy or about how I handle your data, the best way to reach me is privacy@overtonsgarden.com.

What this policy covers

This policy explains what personal data I collect when you use overtonsgarden.com, why I collect it, who I share it with, how long I keep it, and what rights you have.

It doesn't cover personal data collected by Substack when you subscribe to the Overton's Garden newsletter or paid Membership on substack.com. Substack is a separate data controller — see Substack's privacy policy for how they handle your data there.

Personal data I collect

I try to collect as little personal data as possible. What I collect depends on how you use the site.

When you browse the site

I don't run analytics on overtonsgarden.com. Browsing the site doesn't create any record that can be tied back to you personally.

Your browser remembers a small piece of information for your light/dark theme preference. It's stored locally as a cookie called theme and is used only to render the site the way you've asked for it on return visits. It contains no personal data and is not shared.

When you fill in the contact form

If you send a message via /contact, I collect your name, your email address, the optional subject line, and your message. I use this to read your message and reply to it.

Form submissions are delivered to me as an email via Cloudflare Email Routing. I don't add you to any mailing list as a result of contacting me, and I don't pass your message to anyone else.

When you sign up for the newsletter

The Newsletter button on this site takes you to overtons-garden.substack.com to subscribe directly via Substack. I don't see or store your email address on overtonsgarden.com — your subscription is created between you and Substack, who become the data controller for that subscription.

When you buy a book

If you buy the print edition, ebook, or audiobook, I collect your name, email address, shipping address (for print only), order details, and the country your card is registered in. I never see your full card details — payment goes directly to Stripe, who process the card data on my behalf. Snipcart provides the cart and checkout experience that sits between this site and Stripe.

I use your order data to fulfil the order: sending you a confirmation email, arranging printing and shipping, and (for digital books) granting access to your downloads via BookFunnel. I may also use your email to contact you about the specific order — for example, delivery updates or a ship-date reminder.

I keep order records for six years from the date of the transaction, which is the period UK tax law requires me to retain financial records.

When you join the paid Membership

The paid Membership is sold on Substack. Your payment, billing email, and subscription history are held by Substack as the data controller for that subscription.

If you're a Founding member, you'll be invited to fill in the /welcome form on this site so I can post your physical perks (the print edition of the book and printed issues of the zine). On that form I collect:

• Your name
• The email address you used to subscribe on Substack
• Your shipping address
• A short confirmation code from your Substack welcome email (an anti-spam measure)

If you're on the standard monthly or annual tier, you can claim your ebook on the /claim form, where I collect only your name (optional), the email address you used on Substack, and the same confirmation code — no postal address, because nothing is posted to you.

I use this to send the right things to the right place. I keep active member records for as long as you remain a member, and for two years after your membership lapses, in case you renew or have a question about past benefits. After that I delete or anonymise the record.

Anti-spam checks (Cloudflare Turnstile)

The /welcome and /claim forms use Cloudflare Turnstile to verify that a submission comes from a real person rather than an automated bot. Turnstile sends a challenge to your browser and Cloudflare assesses the response. It doesn't track you across sites and it doesn't build a profile of your activity.

Why I collect it (lawful basis)

Under UK GDPR I need a lawful basis for processing personal data. The bases I rely on are:

• Contract — to fulfil orders and to provide the goods, downloads, and member benefits you've paid for.
• Legitimate interest — to respond to messages you send me via the contact form, and to maintain a record of members so I can deliver the benefits I promised.
• Legal obligation — to keep transaction records for the period required by UK tax law.
• Consent — for anything that isn't covered by the above. At the moment I don't run any consent-based processing on the site (no marketing emails from me directly, no analytics, no advertising).

Who I share your data with

To run the site I use a small number of service providers ("processors") who handle data on my behalf. Each one is contractually required to keep your data secure and to use it only for the purpose I ask them to.

The processors I use are:

• Cloudflare, Inc. (United States) — hosting, DNS, CDN, Email Routing for the contact form, and Turnstile bot challenges. Privacy policy.
• Snipcart Inc. (Quebec, Canada) — cart and checkout. Privacy policy.
• Stripe (Stripe Payments UK Ltd in the UK; Stripe Payments Europe Ltd in the EU; Stripe, Inc. in the US) — payment processing. I never see or store your card details. Privacy policy.
• Twilio SendGrid (United States) — transactional email such as order confirmations, member welcome notes, and fulfillment updates. Privacy policy.
• BookFunnel LLC (United States) — digital book delivery for the ebook and audiobook. I pass your name and email so they can grant you access to download or stream your purchase. Privacy policy.
• An international print partner (to be confirmed) — for print orders shipping outside the UK. I'll update this section with the partner's name and privacy notice before any international print orders are fulfilled.
• My UK print partner — for print orders shipping within the UK. I pass your name, shipping address, and order details to the printer in a periodic batch by email.
• Substack, Inc. (United States) — when you subscribe to the newsletter or Membership on Substack. Substack is a separate controller for that subscription. Privacy policy.

I may also share your data when legally required to (for example, in response to a court order or a properly authorised request from a UK regulator).

I never sell your personal data, and I don't share it with advertisers or marketing networks.

International data transfers

Most of the processors above are based in the United States, with some operations elsewhere. When your personal data leaves the UK I rely on the UK Government's adequacy decisions where they apply, and otherwise on the UK International Data Transfer Agreement or the standard contractual clauses approved by the UK ICO. Each processor is contractually required to apply protections equivalent to those required under UK GDPR.

If you'd like to know more about how a specific transfer is safeguarded, get in touch and I'll tell you what I can.

How long I keep your data

• Contact form messages: up to two years from when you sent them.
• Order records (name, email, shipping address, order detail): six years from the date of the transaction, as required by UK tax law.
• Member records: for as long as you are an active member, plus two years after your membership lapses.
• Privacy queries you send me: until resolved, plus two years.

After these periods I delete or anonymise the records.

Your rights

Under UK GDPR you have the following rights in relation to your personal data:

• Right of access — ask for a copy of what I hold about you.
• Right to rectification — ask me to correct anything that's wrong.
• Right to erasure — ask me to delete your personal data, subject to my legal obligation to retain certain records (e.g. order records for tax purposes).
• Right to restriction — ask me to pause processing while a query is resolved.
• Right to data portability — ask for a copy of your data in a portable format.
• Right to object — object to processing I do on the basis of legitimate interest.
• Right to withdraw consent — where consent is the basis, you can withdraw it at any time.

To exercise any of these rights, email privacy@overtonsgarden.com. I'll respond within one month, and usually faster. I may ask you to confirm your identity if it isn't already obvious from your request.

You also have the right to lodge a complaint with the UK Information Commissioner's Office if you believe I've handled your data improperly. The ICO can be contacted at ico.org.uk/concerns or on 0303 123 1113. I'd rather hear from you first so I can put anything right, but the ICO route is always open to you.

Cookies and similar technologies

I use as few cookies as possible. The cookies set on overtonsgarden.com are:

• Theme preference cookie (theme). Stores whether you've chosen light or dark mode. Strictly necessary for the function you've selected; contains no personal data. No consent required under the UK Privacy and Electronic Communications Regulations (PECR).
• Snipcart cart cookies. When you add a book to your cart, Snipcart sets cookies to remember your cart and checkout state. Strictly necessary for the cart to work.
• Cloudflare Turnstile challenges. Turnstile may set short-lived cookies on form pages to perform bot checks. Strictly necessary for the form to function; not used for tracking.

I do not run analytics on this site, and I do not use any advertising, social, or third-party tracking cookies.

If a cookie banner ever appears on the site, it means I've added something that requires your consent — and you should expect a clear "accept or reject" choice with no dark-pattern nonsense.

Children

This site is for an adult audience. I don't knowingly collect personal data from anyone under 13. If you believe a child has provided me with personal data, email privacy@overtonsgarden.com and I'll delete it.

Changes to this policy

I update this policy when something material changes — a new processor, a change to retention periods, a new feature that collects data I didn't previously collect. When I do, I'll update the effective date at the top, and for material changes I'll also flag the change on the site. The current version is always at overtonsgarden.com/privacy.

How to contact me

For anything to do with your personal data or this policy:

privacy@overtonsgarden.com

If you'd prefer to write: