Privacy Policy

Scope

This policy applies to teaandtoast.co and to the forms on it. It does not apply to any third-party site reached through a link from this one.

Where a US privacy law refers to a business or a controller, that is Tea & Toast, contactable at the address given under Contact.

Information collected

Information you provide

The notify form on the home page collects an email address, and the blog's subscribe card collects the same. Submitting either records the address, the date, and the card it came in on.

The Get sorted and audit forms collect a name and an email address, and where you offer them: a phone number, a company name, a website, your social media profiles, the services you are interested in, and anything you write in the notes. Each form asks you to agree to this policy before it sends.

Submissions are held in a Postgres database operated by Tea & Toast and hosted by the database provider named under Disclosure, alongside the analytics storage described below. The notify list is also held by the customer relationship manager that delivers to it.

An email sent to the address under Contact is retained with whatever information it contains.

Information collected automatically

This site measures how it is used, but only after you allow it. The consent banner on your first visit asks before any measurement runs, and a refusal is honoured by not loading the tools at all. With your permission, two tools run:

Google Analytics 4, operated by Google LLC as a service provider. It collects:

• The page viewed, the referring page or search, and the time of the visit.
• Browser, operating system, device type, screen size, and language.
• An approximate location at city or region level, derived from the IP address.
• A randomly generated identifier stored in a cookie, used to recognise a returning browser.
• Events reported by the page, such as a page view, a scroll, an outbound click, or a form submission.

Google receives the IP address carried by each request and uses it to derive the approximate location above. Google Analytics 4 does not report IP addresses to the site operator, and no IP address is stored by Tea & Toast.

No name, email address, or form content is sent to Google Analytics 4. Demographics and interests reporting is disabled on the property, so no age band, gender, or interest category is inferred.

Google's use of the data it processes is described in how Google uses information from sites that use its services and in the Google Privacy Policy.

PostHog, operated by PostHog Inc. as a service provider, records the same kind of information: pages viewed, events such as clicks and form submissions, and browser characteristics, along with unhandled errors the page encounters. PostHog stores a randomly generated identifier in the browser so returning visits can be counted as returning, and its handling of data is described in the PostHog Privacy Policy.

Analytics storage

Google Analytics 4 events are exported on a schedule into a Postgres database operated by Tea & Toast, where reporting is run in SQL. The export and every connection to the database run over TLS, and the database accepts no connection without credentials.

The database holds the event data described above. Email addresses are held in the customer relationship manager and are not joined to analytics records.

Cookies

A cookie is a small file a site asks your browser to keep. This site sets three kinds, and the first is the only one you are never asked about:

• The consent record, tt_consent: stores your cookie choices so the banner does not ask again on every visit. It holds two yes-or-no answers and a date, carries no identifier, and expires 180 days after it is set. This cookie is what makes your choice stick, so it does not need your permission to exist.
• _ga and _ga_ followed by the property's measurement identifier, set by Google Analytics 4. The first stores the randomly generated browser identifier and the second stores session state; both expire two years after they are set. They exist only while analytics consent is granted.
• PostHog's storage, named ph_: a randomly generated identifier so returning visits can be counted as returning, in a cookie or in your browser's local storage. It exists only while analytics consent is granted, and refusing removes any that an earlier yes left behind.

No analytics tool runs before you answer the banner. Refusing leaves the tools unloaded rather than loaded but blinded, and changing your answer through the Cookie preferences link in the footer applies immediately: a yes loads them, a no stops them and removes their storage.

Meta's pixel is wired to the marketing answer and is not on the site yet. If it arrives, it will set its own cookie only while marketing consent is granted, and this policy will name it here before it does.

The analytics cookies are not used for advertising and do not track activity on other sites. No feature of this site depends on any of them.

Cookies can also be blocked in browser settings, or measurement can be disabled across all sites using Google's Analytics opt-out browser add-on.

How information is used

• To measure how many people visit the site and which pages they read.
• To identify pages that load slowly, fail, or perform poorly.
• To inform decisions about what to publish.
• To send the messages the notify form and the blog's subscribe card describe, to respond to the Get sorted and audit forms, and to answer correspondence.
• To comply with a legal obligation, or to establish or defend a legal claim.

Personal information is not used for profiling, automated decision-making, or targeted advertising.

Disclosure

Personal information is disclosed to the following service providers:

• Google LLC, which operates Google Analytics 4 and processes the analytics data.
• PostHog Inc., which operates PostHog and processes the product analytics data.
• Cloudflare, which serves this site and retains request logs, including IP address, browser string, and URL, for a limited period for network operation and security. Its handling is described in the Cloudflare Privacy Policy.
• The database host, which operates the Postgres instance holding exported analytics data and form submissions.
• The customer relationship manager, which holds the notify list and delivers messages to it.
• The payment processor for the audit, which receives the email address the checkout link prefills.

Personal information may also be disclosed where required by a court order, subpoena, or applicable law. If the site is sold or transferred, the notify list transfers with it, this policy continues to apply, and the list is notified before the transfer takes effect.

Sale and sharing

Tea & Toast does not sell personal information and has not sold personal information in the twelve months preceding the effective date of this policy.

Tea & Toast does not share personal information for cross-context behavioural advertising, as that term is defined by the California Consumer Privacy Act, and has not done so in the twelve months preceding the effective date.

Tea & Toast does not sell or share the personal information of consumers known to be under sixteen years of age.

Retention

• Google Analytics 4 event data: fourteen months, the maximum available to a standard property, after which Google deletes it.
• Exported analytics records in Postgres: twenty-four months, after which they are deleted. Aggregated counts derived from them contain no identifier and are retained indefinitely.
• Analytics cookies: two years from the date each is set.
• The consent record cookie: 180 days from the date it is set, then the banner asks again.
• Email addresses on the notify list: until you unsubscribe or request deletion, then removed within thirty days.
• Get sorted and audit form submissions: twenty-four months from the date of submission, unless a working relationship exists, in which case for the life of that relationship.
• Email correspondence: twenty-four months from the final message in the thread.

Security

The site is served over HTTPS. Connections to the analytics database run over TLS. Credentials are held in a password manager and are not committed to the site's source repository. Multi-factor authentication is enabled on the Google, Cloudflare, and database host accounts.

The site runs server-side code for its forms: submissions are written to the Postgres database described above, over TLS, and the database accepts no connection without credentials. An internal operations panel for the site's owners is protected by a passcode; the site offers no public account or login.

No method of transmission or storage is completely secure. In the event of a breach affecting personal information, affected individuals and any regulator required by applicable state breach notification law will be notified within the period that law prescribes.

Children's privacy

This site is not directed to children, and personal information is not knowingly collected from anyone under thirteen years of age. If you believe a child under thirteen has submitted an email address, contact the address under Contact and it will be deleted.

Your privacy rights

Comprehensive privacy laws differ by state and take effect on different dates. The rights below are extended to all residents of the United States, regardless of state of residence:

• The right to know what personal information is collected, why it is collected, and to whom it is disclosed.
• The right to access a copy of the personal information held about you.
• The right to correct inaccurate personal information.
• The right to delete personal information, except where retention is required by law.
• The right to obtain that copy in a portable, machine-readable format.
• The right to opt out of the sale or sharing of personal information, targeted advertising, and profiling. None of these activities is carried out.
• The right not to receive discriminatory treatment for exercising any right above.
• The right to appeal a refused request, which will be answered in writing within forty-five days.

No sensitive personal information is collected. This includes government identifiers, precise geolocation, health data, biometric data, racial or ethnic origin, religious belief, union membership, sexual orientation, immigration status, and the contents of mail or messages.

Submitting a request

Send requests to contact@teaandtoast.co, including the email address provided to the notify form.

1. Receipt of a request is confirmed within ten business days.
2. A request is answered within forty-five calendar days. Where reasonably necessary, that period may be extended once by a further forty-five days, with notice and reason given before the first period expires.
3. Requests are verified against the email address on file. No identity document is required.
4. An authorised agent may submit a request with written permission signed by you, which may be confirmed with you directly.
5. Requests are free of charge twice in any twelve-month period. A further request in the same period, or one that is manifestly unfounded or excessive, may incur a fee or be refused, with reasons given.

Analytics data is held against a randomly generated cookie identifier and generally cannot be linked to an identified individual. Where a request cannot be connected to the data held, that will be stated in the response. Clearing this site's cookies ends the identifier.

California privacy notice

This section applies to California residents and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Categories collected

The following categories of personal information have been collected in the twelve months preceding the effective date:

• Identifiers: an email address where submitted, the Google Analytics 4 cookie identifier, the PostHog identifier where analytics consent is granted, and the IP address received by Google and Cloudflare.
• Internet or other electronic network activity information: pages viewed, referring page, events, and session data.
• Geolocation data: approximate location at city or region level, derived from IP address. Precise geolocation is not collected.

No other statutory category is collected, including commercial information, biometric information, professional or employment information, education information, financial information, audio or visual information, inferences, and sensitive personal information.

• Sources: the consumer, the consumer's browser, Google Analytics 4, and Cloudflare's delivery of the site.
• Business purposes: those listed under how information is used.
• Disclosed for a business purpose to: Google, Cloudflare, the database host, and the customer relationship manager.
• Sold or shared: no category is sold or shared.
• Retention: each category is retained for the period listed under Retention.

California rights

California residents have the right to know, access, delete, and correct personal information, to opt out of its sale or sharing, to limit the use and disclosure of sensitive personal information, and not to be discriminated against for exercising those rights. No personal information is sold or shared and no sensitive personal information is collected.

Requests are submitted by email, as provided under Submitting a request. A business that operates exclusively online and has a direct relationship with the consumer is required to provide one method only.

Under California Civil Code section 1798.83, California residents may request, once per year, details of personal information disclosed to third parties for those third parties' direct marketing purposes. No such disclosures are made.

Under California Business and Professions Code section 22575, this site discloses that it does not respond to Do Not Track browser signals, for which no common standard exists. It does honour Global Privacy Control signals.

Global Privacy Control

Global Privacy Control is an opt-out preference signal sent by a browser or extension and recognised as a valid opt out of sale and sharing in California and several other states. Signals received are honoured. No personal information is sold or shared in any case.

Data location

Personal information is processed in the United States. Google, Cloudflare, and the database host operate global networks, and information may be processed on infrastructure outside the United States under each provider's terms. This site is directed to users in the United States, and this policy is written to US state privacy law.

Changes to this policy

Material changes to this policy are published here with a revised effective date. A change to the categories collected, the purposes of collection, or the recipients of personal information is notified to the notify list by email before it takes effect.

Contact

Questions about this policy and all privacy requests should be sent to contact@teaandtoast.co.

Email is the method offered for a privacy request, because Tea & Toast operates exclusively online. Post reaches the same person at the address below and is answered the same way.

California residents may lodge a complaint with the California Attorney General's office. Residents of other states may contact their own state Attorney General.

Back to the home page