Privacy Policy
Last updated 25 August 2026
This policy covers spencerjhosking.com and everything sold through it. It is written to be read rather than to be survived, so it says plainly what is collected, why it is collected, who else sees it, and how to make it stop.
Who is responsible for your information
This site is operated by Spencer J Hosking ("we", "us"), the data controller for the information described here. For any question about this policy, or to make any request under it, email hello@spencerjhosking.com. A real person reads that address and will reply.
What is collected, and why
| Information | When it is collected | Why |
|---|---|---|
| Name and email address | When you request the free book, or start an order | To deliver what you asked for, send your receipt and access details, and let you sign back in to the members area |
| Order contents and amount | When you buy | To give you access to what you paid for, to handle refunds, and to keep the records tax law requires |
| Card details | At payment | Never collected or seen by us. Card details go directly to Stripe and are held by Stripe. We receive only the card brand and last four digits |
| An unfinished order | If you enter your email on the order page but do not complete the purchase | To send you a short reminder. Every reminder carries a one-click unsubscribe link |
| IP address and browser type | When you agree to the card-on-file terms at checkout | To evidence that the agreement was given, which is a requirement of storing a card at all |
| Advertising cookies and identifiers | When you visit a public page, and in particular if you arrive from an advertisement | To measure which advertisements produce sales. See the section below |
There is no account to create, no profile to fill in, and nothing is asked for that is not needed for one of the purposes above.
Advertising: the Meta pixel, the Google tag, and the Conversions API
This site advertises on Meta platforms (Facebook and Instagram) and on Google, and needs to know which advertisements lead to purchases. Three tools do that, and all three are described here because each involves your information leaving this site.
The Meta pixel
The Meta pixel is a small piece of code that runs in your browser on the sales pages. It sets
cookies — principally _fbp, which identifies your browser, and _fbc, which
records the advertisement you clicked — and reports to Meta when you view an offer, begin a checkout,
or complete a purchase, together with the amount.
The Google tag
The Google tag (gtag.js) is a small piece of code that runs in your browser on
every public page of this site. It sets cookies in the _gcl family, which record
that you arrived from a Google advertisement and which one, so that a purchase made afterwards
can be credited to it. It also lets Google Ads count you as someone who visited, which is how
advertisements are shown to past visitors on Google and YouTube.
Google acts as an independent controller of the data it receives and processes it under its own terms. You can review and limit how Google uses it in My Ad Center, and how Google uses information from sites that use its services explains what it does with it.
The Conversions API
Because browser-based tracking is frequently blocked, completed purchases are also reported to Meta directly from our server. That report contains the value and currency of the order, what was bought, the cookie identifiers above, and your email address in hashed form — it is converted into an irreversible string before it is sent, and the plain address is never transmitted to Meta. Hashing lets Meta match the purchase to an account it already holds without receiving a readable address from us.
Meta acts as an independent controller of the data it receives and processes it under its own terms. You can review and limit how Meta uses it in your Meta ad preferences and the Off-Facebook Activity controls.
How to opt out
- Block or clear cookies for this site in your browser, or use its tracking-protection setting. This stops both the pixel and the Google tag.
- Use the Meta controls linked above to disconnect activity received from businesses, and My Ad Center to turn off personalised advertising from Google.
- Email hello@spencerjhosking.com and ask us to exclude your purchase from advertising reporting. We will do it and confirm.
Opting out does not affect your purchase, your access, your refund rights, or any email you need to receive.
Who else your information reaches
Your information is never sold. It is shared only with the services required to run the site, each of which is bound to use it only on our instructions:
- Stripe — payment processing. Receives your name, email and card details, and holds the card. Stripe's privacy policy.
- Netlify — hosting and the database this site runs on. Netlify's privacy policy.
- Resend — sends your login codes, receipts and reminders. Receives your email address. Resend's privacy policy.
- Meta — advertising measurement, as described above.
- Google — advertising measurement, as described above.
We may also disclose information where the law requires it.
Under California law, disclosing advertising identifiers to Meta and Google for measurement and targeting is treated as "sharing" for cross-context behavioural advertising. We do not sell personal information for money, and you may opt out of that sharing by any of the methods listed above.
Where your information is held
The services above operate internationally, so your information may be processed outside your country, including in the United States. Where information is transferred out of the UK or European Economic Area, it is covered by the standard contractual clauses those providers maintain.
How long it is kept
- Order records — kept as long as tax and accounting law requires, generally seven years.
- Members area access — kept while you hold access, so that what you bought remains available to you.
- Unfinished orders — deleted within 30 days if the order is never completed.
- The card-on-file agreement record — kept with the order it belongs to, as the evidence that the card was stored with permission.
- The card itself — released at the end of the checkout, and in every case no more than two hours after you agree to it. See the Terms.
Your rights
Wherever you live, you may ask us to:
- tell you what information we hold about you, and give you a copy;
- correct anything that is wrong;
- delete your information — noting that we must keep order records for the legal period above, and that deleting your access removes what you bought;
- stop using your information for advertising measurement;
- stop emailing you.
Email hello@spencerjhosking.com. We will respond within 30 days, and we will not charge you or treat you differently for asking. If you are in the UK or EEA and are unhappy with our response, you may complain to your national data protection authority.
Email you receive from us
Receipts, access details and login codes are sent because they are part of the purchase, and cannot be unsubscribed from without losing access to what you bought. Reminders about an unfinished order are marketing, carry an unsubscribe link in every message, and stop immediately when you use it.
Children
This site is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has provided information, email us and it will be deleted.
Security
The site is served entirely over HTTPS, card details never touch our systems, access to the members area is by a one-time code sent to your email rather than a password you might reuse, and purchased files are served only after checking you own them. No system is perfect, and we will tell you promptly if anything affecting your information goes wrong.
Changes
If this policy changes, the date at the top changes with it. Material changes affecting how your information is used will be emailed to buyers.