Privacy Policy

Who's responsible (data controller)

The data controller for this site is John Bradshaw, acting in a personal capacity, based in the United Kingdom. This site is a personal site — not an Akamai site — so Akamai Technologies is not the controller of any personal data processed here. See the Legal notice for context.

For any data-protection question or request, get in touch via the channels on the About page and mark your message as a privacy request.

What data the site collects

The site is a static site — there are no user accounts, no comments, and no login. Personal data is only collected in the following narrow ways:

1. Product analytics (PostHog)

The site uses PostHog (opens in a new tab) for analytics, hosted in the EU. Requests are sent to the first-party subdomain t.bradshaw.cloud, which proxies PostHog's EU service. The analytics script is configured with PostHog's defaults: '2026-01-30' preset and exception tracking enabled (capture_exceptions: true).

That setup collects, on each page view:

• the URL of the page you visited and the referring URL;
• your browser, operating system, device type, and language;
• a coarse approximation of location derived from your IP address (typically country, region, and city); your full IP address is not stored by PostHog;
• autocaptured interaction events (clicks, form interactions, page-leave events) and basic web-vitals performance metrics;
• a randomly-generated identifier stored in a first-party cookie / local storage so repeat visits can be linked into a session.

On top of those defaults, the site emits a number of named custom events to understand which content and call-to-action buttons resonate. The current set includes:

• outbound_link_clicked — when you click a link to another site, with the destination URL, the link text (truncated), the section of the site you were on, and (if the link was inside a content card) the card's title and content type;
• share_clicked — when you use the share bar (X, LinkedIn, Bluesky, Email), with the channel, the URL being shared, and the page path;
• hero_cta_clicked — when you click a call-to-action button in the homepage hero, with the button label;
• contact_link_clicked — when you click one of the contact buttons on the About page (LinkedIn, Signal, X);
• follow_clicked — when you click one of the social profile icons in the site footer (LinkedIn, X, Bluesky), with the channel and the page path;
• speaking_cta_clicked, speaking_external_link_clicked, speaking_register_clicked, speaking_calendar_downloaded, speaking_recording_clicked — interactions on speaking pages, with the event slug, event title, and (where relevant) the type of link;
• media_external_link_clicked, media_coverage_link_clicked — when you click through to a media item or one of its syndicated pickups, with the destination and media slug;
• calculator_cta_clicked, writing_calculator_clicked — when you open an interactive calculator from a strategy insight or a writing post, with the insight slug and the calculator's title;
• diagram_downloaded — when you download a diagram from a strategy insight, with the diagram's id and title and the insight slug;
• insight_nav_clicked — when you use the previous/next arrows between strategy insights, with the direction and the destination's title;
• ai_fundamentals_concept_viewed — when you select a concept tab on the AI Fundamentals insight, with the concept's id and label;
• search_opened — when you open the site search overlay, with the page path only; what you type into it is never sent;
• speaking_book_viewed — when you reach the speaker booking page;
• newsletter_subscribed — when you submit the newsletter form (see below).

New CTA / link-click events of the same kind may be added as new content ships, following the same pattern: an event name, the page or component it fired from, and the URL or label involved — never your identity or any data you didn't submit.

Unhandled JavaScript exceptions and rejected promises are also captured automatically and sent to PostHog's error-tracking feature so production bugs can be diagnosed. Source maps are uploaded as part of deployment so stack traces can be de-minified. Error reports may include the URL where the error occurred, a stack trace, and the browser/device information already listed above.

Content-Security-Policy violations are recorded in PostHog too. The site's Content-Security-Policy is a browser security rule that blocks resources the page didn't explicitly allow; when a block happens, a csp_violation event captures only technical metadata — the policy directive that fired, the blocked resource's address (its origin and path, with any query string stripped off), the script location involved, the page path, and whether the policy was enforcing or only reporting. It never includes anything you type or any real-world identity, and is separate from the browser's own violation reports sent to the site's report collector.

Session replay is enabled. PostHog records a playback of your visit — the pages you move through and how you interact with them — so usability problems can be diagnosed from the visitor's point of view. Every input field is masked, so anything you type (and the contents of password and email fields in particular) is never captured in the recording. Replays are linked only to the anonymous person profile described below, never to your name or email.

Heatmaps, surveys, feature flags, and PostHog's identification of named individuals are not enabled. PostHog keeps an anonymous person profile, keyed only to the random device identifier stored in your browser, so repeat visits can be measured as returning visitors. It is never linked to your name, email, or any other real-world identity.

2. Newsletter subscriptions (Buttondown)

If you submit the newsletter form, your email address is sent directly to Buttondown (opens in a new tab), the third-party service that runs the mailing list. The form opens Buttondown's own confirmation page in a new tab. Buttondown becomes the processor for your email address and any analytics data it captures about email opens, clicks, or unsubscribes; their practices are governed by Buttondown's own privacy policy.

We also fire the newsletter_subscribed analytics event in PostHog at the moment of submission so we know how many people signed up from a given page. That event does not include your email address.

You can unsubscribe from the newsletter at any time using the link in the footer of any email it sends.

3. Speaking inquiries (Typeform)

The Book speaking page embeds an inquiry form operated by Typeform (opens in a new tab). Anything you enter into that form — typically your name, email address, organisation, and details of the event you're inviting John to — is submitted directly to Typeform, which stores it as a processor so the inquiry can be read and answered. It is used only to evaluate and respond to your inquiry; it is not added to the newsletter or any other mailing list.

Loading that page also loads Typeform's embed script and renders the form from Typeform's own domains, so your browser connects to Typeform even if you never submit anything. At that point Typeform receives standard request data (such as your IP address and user agent) and may set its own cookies, all governed by Typeform's own privacy policy — independently of this site.

Nothing you type into the form is sent to PostHog: the form renders inside a Typeform iframe, which the session-replay recording described above cannot see into, and no analytics event includes your answers.

4. Hosting and CDN logs

The site is served as static files from Linode Object Storage, fronted by the Akamai content-delivery network, which also handles edge logic such as custom error pages. When you request a page, the CDN and origin storage receive standard HTTP request information — including your IP address, the URL requested, your user agent, and the referring URL — which is processed for the purposes of delivering content, operating the network, and protecting against abuse.

These logs are operated by Linode (an Akamai company) and Akamai respectively as processors. They are not used for site-level analytics and are not joined with the PostHog data described above.

The Akamai delivery configuration also injects mPulse, Akamai's real-user monitoring tool, into pages as they are served. mPulse measures how fast pages load for real visitors and sends those performance timings — together with standard request metadata such as your IP address, user agent, and the page URL — to Akamai-operated collection endpoints (go-mpulse.net / akstat.io). Akamai processes that data as a processor to monitor and improve delivery performance; it is not joined with the PostHog analytics described above.

Embedded third-party content

Some pages embed video players from YouTube (for recorded talks and interviews). When you load a page containing a YouTube embed, your browser connects directly to YouTube; YouTube may set cookies and process your data in line with Google's privacy policy, independently of this site. We use standard youtube.com/embed/… URLs and do not control what YouTube collects via that connection.

A small number of speaking pages embed a LinkedIn post about the event. When you load one of those pages, your browser connects directly to LinkedIn to render the embedded post; LinkedIn may set cookies and process your data in line with LinkedIn's own privacy policy, independently of this site.

The Book speaking page embeds the Typeform inquiry form described above — it is the only page on the site that connects to Typeform.

Share buttons on content pages, and the social profile icons in the site footer, link to X, LinkedIn, Bluesky, and your email client. They are plain links — they only contact those services if you click them.

What the site doesn't do

• It does not show advertising or share data with ad networks.
• It does not sell, rent, or trade any personal data.
• It does not capture what you type — session replay masks every input field.
• It does not run heatmaps or behavioural surveys.
• It does not track you across other websites you visit.
• It does not build a profile of you under a real-world identity — the anonymous PostHog person profile described above is keyed only to a random device identifier, never your name or email.

Cookies and similar technologies

The only cookie / local-storage entry set directly by this site is the PostHog identifier described above, stored as a first-party item on the bradshaw.cloud domain. It is used to group your page views into sessions and to recognise repeat visits for analytics purposes, and is not used for advertising.

Embedded YouTube players and LinkedIn posts may set their own cookies on their respective domains when they load or when you interact with them, and the embedded Typeform form on the Book speaking page may set its own cookies on Typeform's domains. The site does not control those cookies.

Most browsers let you block or delete cookies and local-storage entries from their settings. PostHog also exposes a programmatic opt-out: running posthog.opt_out_capturing() from your browser's developer console disables analytics for the current browser. The site does not currently auto-honour Do Not Track or Global Privacy Control headers; if you'd like that added, please get in touch.

Legal basis for processing (UK GDPR / EU GDPR)

For visitors in the UK or the EEA:

• Analytics, error tracking, and the related first-party identifier are processed on the basis of our legitimate interest in understanding which content people find useful and in keeping the site working correctly. The processing is limited to what's necessary for those purposes, no profiles under a real-world identity are built, and you can opt out as described in the Your rights section below.
• Newsletter subscription is processed on the basis of your consent, given by submitting the form. You can withdraw consent at any time by unsubscribing.
• Speaking inquiries are processed because the processing is necessary to take steps at your request before entering into a possible speaking engagement and, where that doesn't strictly apply, on the basis of our legitimate interest in reading and answering messages sent to us. You choose what to include in the form.
• Hosting, CDN logs, and mPulse performance monitoring are processed on the basis of legitimate interest in delivering the site quickly and reliably and protecting it from abuse, and (for security-related processing) the legitimate interest of network operators in maintaining service integrity.

How long data is kept

• Analytics events: retained in PostHog for as long as needed to spot trends in site usage — typically up to PostHog's default retention window. Aggregated data may be kept longer.
• Error-tracking data: typically retained for a shorter period sufficient to diagnose and fix bugs.
• Newsletter subscriber data: kept by Buttondown until you unsubscribe (or you ask for it to be deleted).
• Speaking-inquiry submissions: kept in Typeform (and in any follow-up correspondence) for as long as needed to handle the inquiry and any engagement that comes out of it, and deleted on request.
• Hosting and CDN logs: retained according to Linode's and Akamai's standard operational retention periods.

International transfers

PostHog data is processed on PostHog's EU infrastructure. Buttondown is based in the United States; when you subscribe to the newsletter, your email address is transferred to the US under the safeguards provided by Buttondown's terms (which typically include the EU Standard Contractual Clauses for any onward transfers from the UK / EEA). The speaking-inquiry form is operated by Typeform S.L., based in Barcelona, Spain; where Typeform or its sub-processors handle data outside the UK / EEA (parts of Typeform's infrastructure run in the United States), the transfer is covered by the safeguards described in Typeform's privacy policy, which include the EU Standard Contractual Clauses. Akamai and Linode operate global networks; CDN edge nodes outside the UK / EEA may briefly process your request data to deliver content from the nearest location.

Your rights

If UK or EU data-protection law applies to you, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (where the legal basis allows);
• restrict or object to processing (including objecting to analytics processing carried out on the basis of legitimate interest);
• withdraw consent at any time, where consent is the legal basis;
• receive your data in a portable format, where applicable;
• complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ICO) (opens in a new tab); in the EEA, the supervisory authority of the country where you live or work.

To exercise any of these rights, contact us via the channels on the About page. Because the site does not identify individual visitors by name, fulfilling an access or erasure request usually requires you to supply enough information for us to locate the relevant data (for example, the date range and approximate IP range you used, or the email address you subscribed with).

Children

This site is aimed at a professional adult audience and is not directed at children. We do not knowingly collect personal data from anyone under 16.

Changes to this policy

Material changes to this Privacy Policy will be reflected by updating the "Last updated" date at the top of this page. If a change is significant — for example, the introduction of a new third-party service that collects personal data — we will try to flag it more prominently before it takes effect.