The short version: I collect the least I can get away with, I don't run analytics or advertising trackers, and I don't sell or share your information with anyone for marketing.
Who is responsible for your data
Nehan Khan is the data controller for this website and is based in the United Kingdom. For anything in this policy, including any request about your own data, email the contact form, choosing "Something else" as the subject. It reaches me directly.
What I collect, and when
Nothing is collected simply because you read a page. Information only reaches me when you choose to send it:
- The free credit audit form. Your name, email address, phone number if you give one, and whatever you tell me about your situation. It is emailed to me and not stored in any database. It only reaches a mailing list if you separately tick the marketing box: the first box is consent to reply to you, and nothing more.
- The newsletter. Your email address goes to Substack, which publishes and sends it. It is never stored on this site: the signup form hands you over to Substack, and your subscription is between you and them from that point, under their privacy policy as well as this one.
- Free downloads, tool unlocks and the toolkits waiting list. Your email address, and which resource you asked for, held in Resend. You will always be sent a confirmation email first; nothing is sent to you, and you are added to no list, unless you click the link in it.
- Booking a Credit Clarity Call. Booking is handled by Calendly, which collects your name, email, time zone and your answers to its booking questions. Those questions include a short summary of what is on your credit file, which you give so I can prepare for the session. They never ask for account numbers, balances or lender names. If payment is taken, it is processed by Stripe. Card details never reach me or this site.
- Server logs. Vercel, which hosts this site, processes technical information such as your IP address and the page requested, in order to serve the site and protect it from abuse.
What I don't do
This site runs no analytics, no advertising pixels and no tracking cookies. There is no profiling and no automated decision-making. I don't sell your data, and I don't pass it to anyone for their own marketing.
Why I'm allowed to hold it
- Consent, for marketing emails and the newsletter. You can withdraw it at any time, and every email carries an unsubscribe link.
- Contract, to deliver a session you have booked and paid for.
- Legitimate interests, to keep the site running, secure and free from abuse.
How long it's kept
Audit enquiries live in my inbox and are kept while I may still be of use to you, and for a reasonable period afterwards. Email contacts are kept until you unsubscribe, through the one-click link on any email I send, and for the newsletter through Substack, which holds that list itself. Booking and payment records are kept as long as tax and accounting rules require. Ask me to delete your data and I will, except where I'm legally required to keep a record.
Who processes it on my behalf
Vercel (hosting), Resend (email delivery and the contact list), Calendly (bookings) and Stripe (payments). Google Fonts serves the typefaces, which means Google receives your IP address when a page loads. Some of these providers operate outside the UK, in which case transfers rely on the safeguards required by UK data protection law.
Substack is listed separately because it is not processing on my behalf: if you subscribe to the newsletter, Substack is the controller of that subscription and holds your address under its own privacy policy. Unsubscribing from the newsletter is done through Substack, and removing yourself there removes you.
Your rights
Under UK GDPR you can ask me to give you a copy of your data, correct it, delete it, restrict or object to how it's used, or hand it over in a portable format. You can also withdraw consent at any time. Send the request through the contact form under "Something else" and I'll respond within one month.
If you think I've handled your data badly, you're entitled to complain to the Information Commissioner's Office at ico.org.uk. I'd appreciate the chance to put it right first.
Changes
If this policy changes, the date below changes with it. Material changes will be flagged on the site.
Last updated: 4 August 2026