Privacy policy
Who is responsible
This site, fromexperiencetoevidence.com, is operated by Derrick Moore, trading as From Experience to Evidence, a sole proprietor based in North Carolina, USA (registered address: 1811 Sardis Rd N Ste 218 PMB 471, Charlotte, NC 28270). For the purposes of the GDPR, the UK GDPR and Brazil's LGPD, that person is the data controller. Privacy questions and requests go to privacy@fromexperiencetoevidence.com.
What this site collects, and why
Site visits. We use Cloudflare Web Analytics (cookieless, aggregate) and Google Analytics 4 (cookies; see "Google Analytics" below). Cloudflare, which also hosts the site, sees the technical data any web server sees (IP address, request headers) to deliver the pages and protect them from abuse, and keeps it for its own security purposes under its privacy policy.
The free interview-question pack. When you ask for the pack, we collect your email address and the language of the page you used. We store it with MailerLite, our email provider, to send the pack and the short series of emails that follows, and later occasional emails about the books. The legal basis is your consent, which you give by submitting the form and confirming the double opt-in email, and which you withdraw by clicking unsubscribe in any email or writing to us. We also record the date, the source page and the IP address of the sign-up as evidence of consent.
Purchases. Checkout is run by Payhip Ltd (London, UK), which acts as the merchant of record: it collects your email address, your country, and the payment details it needs to charge you and to account for VAT and sales tax, and it delivers your files. Payment cards are processed by Stripe, and PayPal payments by PayPal; we never see or store your card number. Payhip shares with us your email address, your country, what you bought and when, and any name you entered, which we keep to deliver the product, handle refunds and support, meet tax and accounting rules, and, if you agree at checkout, send you emails about the books. The legal basis is the contract you enter when you buy and our legal obligations; for marketing emails it is your consent.
Support email. If you write to any of our addresses, we keep the correspondence for as long as we need it to answer you and to keep a record of the request.
Who processes it for us
Cloudflare, Inc. (hosting, DNS, cookieless analytics, USA); Payhip Ltd (checkout and delivery, UK) with Stripe, Inc. and PayPal as its payment processors; MailerLite (email, Lithuania, EU); Google (Google Analytics 4 and, when we advertise, Google Ads): site analytics, ad measurement; Zoho Corporation (our mailboxes). Each of these acts under its own terms and privacy policy and processes your data on our instructions. Transfers outside the EU and UK rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or the EU-US Data Privacy Framework, as each provider states.
How long we keep it
Email subscribers: until you unsubscribe, and then only the record that you unsubscribed, so we never email you again by mistake. Purchase records: seven years, the period tax and accounting rules require. Support correspondence: two years after the last message. Analytics: Cloudflare, aggregate counts only. Google Analytics 4: event-level data is kept for 14 months, then deleted; aggregated reports are kept.
Your rights
Wherever you live, you can ask us what personal data we hold about you, have it corrected or deleted, and object to or restrict how we use it. In the European Union and the United Kingdom these rights come from the GDPR and UK GDPR, together with the right to data portability, the right to withdraw consent at any time, and the right to complain to your supervisory authority (in the UK, the Information Commissioner's Office). In Brazil they come from the LGPD, including the right to know whom we share data with and to complain to the ANPD. In California they come from the CCPA and CPRA: we do not sell personal information for money. Linking Google Analytics to Google Ads can count as "sharing" for cross-context behavioral advertising under California law (CCPA/CPRA) and similar state laws. You can opt out with the "Do not sell or share my personal information" link in the footer, and we honor the Global Privacy Control signal. We do not discriminate against anyone who exercises a right.
To exercise any right, write to privacy@fromexperiencetoevidence.com from the address you used with us, or tell us which address it was. We answer within one month and never charge for a first request.
Children
This site is not directed at children under 16, and we do not knowingly collect personal information from children. If you believe a child has given us data, write to us and we will delete it.
Changes to this policy
If this policy changes, the new version is posted here with an updated date at the top of the page. A change that affects how we use data you already gave us is announced by email to subscribers before it takes effect.
Google Analytics and advertising
This site uses Google Analytics 4 to understand how it is used. It records the pages viewed, the device and browser type, your approximate location and how you arrived (the referral). It sets cookies in your browser, with names that start with _ga, to tell visits apart. Outside the places listed below, the legal basis is our legitimate interest in measuring and improving the site and our advertising. You can object at any time with the "Change my choice" link below, which works in every country.
The EU, Iceland, Liechtenstein, Norway, the UK, Switzerland, Brazil and Quebec. In these places Google Analytics sets no cookies until you accept, and the legal basis is your consent (in Brazil, LGPD art. 7, I). Until you accept, it sends Google only cookieless signals with no identifier (such as the time, the page and the browser type), which Google uses for aggregate estimates. A banner asks on your first visit. You can change your choice at any time: Change my choice
Advertising link. When we advertise, our Google Analytics is linked to Google Ads. Under US state privacy laws, such as California's CCPA and CPRA, this can count as "sharing" personal information for cross-context behavioral advertising. We honor the Global Privacy Control signal from your browser. You can also use the "Do not sell or share my personal information" link in the footer of every page.
Payhip, our checkout provider, runs its checkout pages under its own privacy policy. We do not add our Google Analytics tag to those pages.