Privacy Policy

Who we are

Joel Lipman operates joellipman.com and is responsible for the personal information covered by this policy. Use the contact form for privacy questions, requests or complaints.

What we collect and why

• Accounts and sign-in. We use your name, username and email to manage your account, sign-in and password resets. We store a password hash. Profile photos and phone numbers are optional. We use your account details to provide the features you request and have a legitimate interest in keeping accounts and the site secure.
• Enquiries, projects and support. We use your contact details, messages and any project records, attachments or billing information you share to reply, prepare quotes and deliver agreed work. We may receive your name and contact details from a client who invites you to a project. We process this information to take steps you request before a contract, fulfil an agreement, support our legitimate interests in running projects and keep records required by law.
• Article comments. We use your submitted name, email and comment to moderate discussions, prevent abuse and notify you when a comment is approved. These are our legitimate interests in running the discussion. Approved comments are public with a shortened display name and, where applicable, your profile photo. Your email address is kept private.
• Purchases and reminders. Where available, we use order and payment records to deliver purchases, handle refunds or support requests and meet accounting obligations. PayPal handles payment details at checkout and returns transaction information to us. SubTracker stores the records and settings you add and uses your email address or phone number to send the reminders you choose. Twilio receives the recipient number and message to deliver SMS reminders.
• Guided process documents. When you request an AI-assisted document, we use your submitted answers and any logo you upload to prepare it. With the permission requested at checkout, the written answers are sent to OpenAI for document generation. We retain an encrypted copy of the submission to support and improve this feature. Please include only information you have permission to share.
• Requests and security. The web server receives connection and browser information when you visit. We have a legitimate interest in using it to deliver pages, troubleshoot and protect the site against abuse. Where enabled, Google reCAPTCHA processes device and interaction information to help detect automated contact submissions.

You can browse public pages without an account. If you choose to withhold information needed for an account, enquiry, order or reminder, we may be unable to provide that feature.

We use automated checks for tasks such as detecting spam and scheduling reminders. The website does not make solely automated decisions about you that have legal or similarly significant effects.

Newsletter

We use your email address and subscription status to confirm your signup and send newsletters with your consent. You can withdraw consent using the unsubscribe link in any newsletter or through your account. After you unsubscribe, we retain your address and opt-out status to honour that choice. We have a legitimate interest in using any reasons you choose to share to improve future newsletters.

Cookies and browser storage

A session cookie supports sign-in, security and form submissions. The site also uses browser storage to remember privacy choices and restore drafts for features such as the guided process builder. Blocking essential cookies may prevent account and form features from working. You can clear cookies and stored drafts in your browser. Optional advertising and analytics choices are separate.

Advertising choices

Google AdSense may show display ads on eligible public pages. Administration, account pages, private projects and protected notes are excluded. The advertising integration does not send account details, messages, comments or developer tool inputs to ad providers.

Google AdSense

Google and its advertising partners may use cookies or similar technologies to serve and measure ads. Use Google’s consent message and privacy options where they are available. Those choices are separate from Google Analytics and Adsterra. See how Google uses information from partner sites.

Adsterra

Adsterra banners are paused while an unwanted redirect is investigated. Existing preferences are retained, and the site does not load Adsterra banner code during the pause.

When banners are available and you allow them, Adsterra and its advertising partners can use cookies or similar storage and receive IP addresses, browser and device information, and ad interactions to select and measure ads. This may involve processing outside the UK. See Adsterra’s privacy policy and cookie policy.

Your Adsterra preference and the time you made it are stored in this browser for up to six months. Refusing stops future Adsterra loads without restricting access to the site. Use your browser settings to clear any cookies already set by third parties. Do Not Track and Global Privacy Control prevent the Adsterra loader from running.

Analytics choices

With your permission, Google Analytics counts visits to public pages. It may use cookies to distinguish browsers and sessions. The site sends the public page address without query strings or fragments. It does not send your account identity, search terms, form answers or tool entries. Administration, account pages, private projects and protected notes are excluded.

Your choice is stored in this browser for up to six months. You can withdraw consent here when Analytics is available. Declining keeps the website accessible. Do Not Track and Global Privacy Control prevent our Analytics loader from running.

Local statistics and country detection

We have a legitimate interest in measuring site performance and understanding which articles and tools visitors use. These local statistics run separately from Google Analytics and advertising.

Tool usage totals

Successful tool operations increment a daily count by tool and approximate country. Rapid changes are grouped into one use. The counters do not store tool inputs, passwords, uploaded files, account IDs or raw IP addresses. They do not send these events to Google or set an additional analytics cookie. Do Not Track and Global Privacy Control prevent counting.

SiteStats and server logs

SiteStats counts public requests on the server without adding cookies or scripts, including when Google Analytics is declined. It uses a keyed hash of the connection IP address to estimate visits and visitors. It stores public page paths without query strings, referring domains where supplied, approximate country, browser family and device type for a rolling 90-day reporting window. Older records are removed when statistics next run. A visit ends after 30 minutes of inactivity. Private pages and administrator traffic are excluded. Do Not Track and Global Privacy Control requests are counted without visitor or visit grouping. Web hosting access logs and AWStats reports follow separate hosting retention settings.

Country lookup

We compare the connection IP address against a country database on our server for advertising eligibility and local statistics. The lookup does not call an external geolocation service or create a visitor IP log. The result is approximate, especially if you use a VPN or proxy. Country data is from DB-IP under CC BY 4.0. Database release 1 September 2026.

Who receives information

Information may be available to authorised site administrators, hosting and email service providers and, for private project records, people authorised to work on that project. Google, Adsterra, PayPal, Twilio and OpenAI receive information when the relevant feature is used, as described above. We may also disclose information when required by law or where necessary to handle a legal claim.

Some service providers may process information outside the UK. Where UK transfer rules apply, transfers must use a lawful mechanism such as a UK adequacy regulation or approved contractual safeguards. Use the contact form to ask for details about transfers and safeguards for a feature you use.

Retention and security

We keep account information while needed to provide your account. Enquiries and project records are kept for as long as needed to respond, deliver the work or resolve disputes. Payment and invoice records are kept as needed for accounting and legal obligations. The newsletter and statistics sections above describe how those records are used and retained. We restrict access to account and private project data and use security measures appropriate to the information we handle.

Your privacy rights

Under UK data protection law you can ask for access to your personal information or ask us to correct it. Depending on the circumstances, you can also ask us to erase it, restrict its use or provide a portable copy. Where we rely on consent, you can withdraw it at any time. This does not affect processing that took place before withdrawal.

You can object to direct marketing at any time. You can also object to processing based on our legitimate interests in certain circumstances.

Use the contact form to exercise your rights or make a data protection complaint. Tell us what happened and how to contact you. You also have the right to complain to the Information Commissioner’s Office (ICO).

We may update this policy as the website or our processing changes. The date at the top shows the latest revision.