Tom Cheddadi

1. Who this policy applies to

This Privacy Policy applies to information collected through the Site and Services. It does not apply to third-party websites, services, or platforms that you may reach through links on the Site, even if those third parties are referenced or embedded here. Their privacy practices are governed by their own policies.

2. Information I collect

I collect information in two ways: information you give me directly, and information collected automatically when you use the Site.

2.1 Information you provide

Newsletter subscriptions: When you sign up for the newsletter, I collect your email address and any optional information you choose to share (such as your name or role).
Forms and contact requests: If you submit a form (for example, to request a strategy call or to get in touch), I collect the information you provide, which may include your name, email address, business details, and the content of your message.
Booking and scheduling: If you book a call through a third-party scheduling tool linked from the Site, that tool collects scheduling-related information directly. I receive a copy of the booking details so I can prepare for and attend the call.
Correspondence: If you contact me by email or other means, I retain the content of those communications.

2.2 Information collected automatically

Usage and device data: When you visit the Site, my hosting and analytics providers may automatically collect information such as your IP address, browser type, device type, referring page, pages visited, time spent on pages, and similar diagnostic data.
Cookies and similar technologies: The Site uses a small number of cookies and similar technologies. See Section 6 (Cookies) for details on what is set and why.

3. How I use information

I use the information described above to:

Operate, maintain, and improve the Site and Services.
Deliver content you have requested, including newsletters, responses to inquiries, and scheduled calls.
Communicate with you about the Site, Services, and updates.
Analyze how the Site is used so I can improve content, layout, and performance.
Protect the Site against fraud, abuse, and unauthorized access.
Comply with legal obligations and enforce my terms.

I do not sell your personal information. I do not share your personal information for cross-context behavioral advertising.

4. Legal bases for processing (EEA / UK visitors)

If you are in the European Economic Area or the United Kingdom, I rely on the following legal bases under the GDPR and UK GDPR:

Consent — for newsletter subscriptions and any optional cookies you accept.
Performance of a contract — to deliver a service you have requested (for example, a scheduled call).
Legitimate interests — to operate the Site, keep it secure, understand how it is used, and respond to your inquiries.
Legal obligation — to comply with applicable laws and respond to lawful requests.

5. Sharing and disclosure

I do not sell your personal information. I share information only in the limited circumstances described below.

5.1 Service providers

I use trusted third-party providers to operate the Site and Services. These providers access information only to perform tasks on my behalf and are contractually required to protect it. Current providers include, in summary:

Hosting and infrastructure: Vercel Inc. hosts the Site and stores associated server logs. Vercel Blob stores media assets.
Database: A managed Postgres database stores content and form submissions.
Email and newsletter: An email service provider (for example, Kit / ConvertKit) is used to deliver newsletters and manage subscriptions.
Scheduling: A third-party scheduling tool may be used to book calls. It collects scheduling information directly from you and shares booking details with me.
Analytics: Privacy-respecting analytics may be used to understand aggregated traffic patterns. Where used, analytics are configured to avoid collecting personally identifying information wherever practical.

5.2 Legal and safety

I may disclose information if I believe in good faith that it is necessary to comply with applicable law, respond to lawful requests from public authorities, protect the rights, property, or safety of users or third parties, or enforce my terms.

5.3 Business transfers

If I am involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to the protections of this Privacy Policy.

6. Cookies and similar technologies

The Site uses a small number of cookies and similar technologies. These fall into the following categories:

Strictly necessary: Used to deliver the Site and core features, including remembering basic preferences such as your theme setting.
Analytics: Used to understand how visitors interact with the Site in aggregate, so I can improve content and performance.

You can control cookies through your browser settings. Blocking some cookies may affect parts of the Site.

7. Data retention

I retain personal information only for as long as is necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Newsletter subscriber data is retained while you remain subscribed and for a reasonable period after you unsubscribe. Form submissions are retained for as long as needed to respond to your inquiry and for any follow-up engagement.

8. Security

I take reasonable technical and organizational measures to protect information against unauthorized access, alteration, disclosure, or destruction. No method of transmission over the Internet or electronic storage is fully secure, so I cannot guarantee absolute security.

9. Your rights

Depending on where you live, you may have the following rights with respect to your personal information:

Access — request a copy of the information I hold about you.
Correction — request correction of inaccurate information.
Deletion — request deletion of your information.
Restriction — request that I limit how I process your information.
Portability — request a portable copy of your information.
Objection — object to processing based on legitimate interests.
Withdrawal of consent — withdraw consent at any time where processing is based on consent.

California residents have specific rights under the California Consumer Privacy Act (CCPA), including the right to know, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information (I do not sell or share for cross-context behavioral advertising). To exercise any of these rights, contact me at hey@tomcheddadi.com.

10. International data transfers

The Site and Services are operated from, and rely on providers based in, the United States and other jurisdictions. If you access the Site from outside those jurisdictions, your information may be transferred to, stored, and processed in countries that may have different data protection rules than your own. Where required, I rely on appropriate safeguards such as standard contractual clauses for international transfers.

11. Children

The Site is not directed to children under 16, and I do not knowingly collect personal information from children under 16. If you believe a child has provided personal information, please contact me and I will take appropriate action.

12. Third-party links

The Site contains links to third-party sites and services that I do not operate. I am not responsible for the privacy practices of those third parties. I encourage you to review their privacy policies before interacting with them.

13. Changes to this Privacy Policy

I may update this Privacy Policy from time to time. When I do, I will revise the effective date at the top of this page. Material changes may also be communicated through the Site or by email where appropriate. Continued use of the Site after changes take effect constitutes acceptance of the updated policy.

14. Contact

If you have questions about this Privacy Policy or your personal information, please contact me at hey@tomcheddadi.com.