Privacy Notice
This notice explains what personal data Isochrone Consulting collects through this website, why we collect it, who else handles it, and what you can ask us to do with it. It covers this website and The Wayfinder. Client engagements are governed by their own contract.
Last updated 3 August 2026.
Who we are
Isochrone Consulting is the data controller for the personal data described here, which means we decide what is collected and why.
- Trading name
- Isochrone Consulting
The quickest route for anything in this notice, including a request to see or delete your data, is info@isochroneconsulting.com. We aim to reply within a few working days, and the law gives us one month.
What we collect, why, and for how long
Each purpose is listed separately, with the lawful basis we rely on for it. We do not sell personal data, we do not share it for anyone else’s marketing, and nothing on this site makes an automated decision about you.
Sending you The Wayfinder
- What
- Your email address.
- Lawful basis
- Consent, which you give by subscribing and can withdraw at any time.
- How long
- We send to you until you unsubscribe. Unsubscribing stops the emails but does not by itself delete the record: our email provider retains it, suppressed, so that you are not added back by mistake and so a later resubscribe works. Email us if you want it erased outright, and we will delete it.
Understanding which writing brings people to the site
- What
- Signup attribution: campaign parameters in the link you followed, the address of the site you arrived from (its domain, not the page), any referral code, and the path of the page you were on when you subscribed. We also record which form you used, so we can tell the newsletter box on an article apart from the one at the end of the Scorecard - and, if you asked to join the operator waiting list, that you did, since that is how we judge whether to build it. Held in the memory of the page you are looking at and not saved to your device, so it does not outlast that page, and it is sent only if you subscribe.
- Lawful basis
- Our legitimate interests in knowing which pieces of writing earn their keep. Those interests are why we keep it to the referring domain rather than the full address.
- How long
- Held alongside your subscription record, and kept for as long as that record is, which outlasts unsubscribing. Ask us to erase it and we will.
Making what we send you more relevant
- What
- Your organisation size and your role, if you chose to give them. Both are picked from a fixed list, and both are optional.
- Lawful basis
- Consent. Neither is required to subscribe, and leaving them blank costs you nothing.
- How long
- Held alongside your subscription record, and kept for as long as that record is, which outlasts unsubscribing. Ask us to erase it and we will.
Booking a call with us
- What
- Only if you choose to open the booking calendar: your IP address and browser details reach our scheduling provider, along with whatever you enter to book, which is typically your name, your email address and any note you add.
- Lawful basis
- Taking steps at your request before entering into a contract. Nothing is sent unless you open the calendar yourself.
- How long
- For as long as we need the booking, and thereafter under our scheduling provider’s own retention. Ask us and we will delete it sooner.
Keeping the forms usable and free of abuse
- What
- Your IP address, used to verify a bot-protection challenge and to count submissions against a limit. The challenge loads with any page carrying a form, so this happens whether or not you go on to submit one.
- Lawful basis
- Legitimate interests. A public form with no rate limit and no challenge becomes a spam relay within days.
- How long
- The rate-limit counter expires by itself a little over two hours after your last submission, and the duplicate-signup key after one hour. The challenge token is not retained by us at all.
Not acting twice on the same notification
- What
- When our email provider notifies us of a new subscription or a published post, we briefly store whichever reference that message carried. Depending on the message that is its own id, a subscription id, a post id, or a one-way fingerprint of the message itself. A subscription id identifies a subscriber to that provider, so it is treated as personal data here even though it names nobody.
- Lawful basis
- Legitimate interests in processing each notification once. Acting on a duplicate would mean re-sending or re-recording something that already happened.
- How long
- One hour, after which the key expires by itself.
Answering you when you email us
- What
- Your email address, whatever you write, and anything you attach.
- Lawful basis
- Legitimate interests in replying to correspondence, and a legal obligation where you are exercising a data protection right.
- How long
- Kept while we deal with your message and for a reasonable period afterwards, so that we have a record of what was asked and what we did. Requests about your data are kept as evidence that we handled them.
Running and securing the website
- What
- Server logs recording page requests, IP addresses and user-agents.
- Lawful basis
- Legitimate interests in operating a working, secure site.
- How long
- Held briefly by our hosting provider under their standard log retention.
Seeing how the site is used
- What
- Analytics tied to a random device identifier stored in your browser: the pages viewed, four named funnel events, and, because the requests are relayed through our own domain, the details any web request carries - your IP address, from which an approximate location is derived, and your browser’s user-agent, from which browser, operating system and device type are derived. One of those events records which of four readiness bands your scorecard produced - the band alone, not the answers behind it, and not alongside your email address. We do not know who that identifier belongs to, but it is still personal data and you have the same rights over it as anything else here.
- Lawful basis
- Consent, asked for before any non-essential cookie is set. If you decline, no analytics are collected and the site works exactly as it did.
- How long
- Kept under our analytics provider’s own retention policy.
Where we rely on legitimate interests, you can object at any time and we will stop unless there is a compelling reason not to. Where we rely on consent, you can withdraw it at any time and we will stop, full stop.
Your scorecard answers stay in your browser
The AI Readiness Scorecard is scored on your own device. Your answers are held in the page while you work through it and are not sent to us, so we cannot see how you answered, and we could not tell you if you asked.
One thing derived from them does reach us, and it would be misleading not to say so: if you have agreed to analytics, revealing your result sends a single event recording which of four readiness bands you landed in. The band only, not the answers behind it, and tied to nothing but the random device identifier described under Cookies below - not to your email address, and not to anything that names you.
If you use the email gate to subscribe at the end, that submission collects what any subscribe form on this site collects, and nothing extra for being the Scorecard: your email address, the organisation size and role you optionally chose from a fixed list, the signup attribution set out in the table above (campaign parameters, referring domain, referral code, the page you were on and which form you used), and the anti-abuse checks. Your scored answers are not part of it.
Separately, if the link you arrived from carried campaign parameters, the pages that carry a subscribe form or the Scorecard make a note of them, in case you go on to subscribe. That note is held in the memory of the page you are looking at, and nothing is saved to your device for it: no cookie, and nothing written to your browser’s storage. So it does not outlast the page. It may or may not come with you as you move around the site, depending on how the next page loads; reloading or closing the tab ends it, and whatever comes after starts again from the address you are on at the time. It never holds your answers, your email address or anything you typed, and it reaches us only if you subscribe.
Who else handles your data
We use a small number of suppliers to run the site and the newsletter. Each acts on our instructions under a contract, and each is listed here with what it actually handles rather than as a general category.
Vercel
Website hosting and delivery
Requests for pages on this site, including your IP address and browser user-agent, which appear in short-lived server logs. Anything you submit through a form is also processed here on its way to us, since the form handlers run on this host: that includes your email address and the optional organisation size and role.
Beehiiv
Newsletter subscriptions and sending
Your email address; the signup attribution described above, including the path of the page you subscribed from and which form you used, recorded both as a field and as a tag on your subscription; and, if you chose to give them, your organisation size and role.
Cloudflare
Bot protection on forms (Turnstile)
The challenge loads as soon as a page carrying a form does, not when you submit one, so Cloudflare receives your IP address and browser details even if you never fill anything in. If you do submit, it also receives the one-time token it issued, so we can confirm you are not a bot.
Upstash
Rate limiting, and not processing the same signup twice
Two short-lived keys. One is a counter derived from your IP address, used to hold the subscribe form to five submissions an hour. The other is written whenever our email provider notifies us of something, a new subscription or a published post: it holds whichever reference that message carried, which may be the message’s own id, the subscription’s, the post’s, or, failing all three, a one-way fingerprint of the message, so that a notification delivered twice is not acted on twice. Neither key contains your email address.
Booking a call and answering correspondence
If you open the booking calendar on our Book a call page, Google receives your IP address and browser details along with whatever you enter to book: typically your name, your email address and any note you add. Google Workspace also receives your email address, message and any attachments when you write to our published contact address.
PostHog
Website analytics, on their European servers
A random device identifier stored in your browser, the pages you viewed, and four named events: subscribing, starting the scorecard, finishing it, and clicking a book-a-call button. Finishing the scorecard carries which of four readiness bands you landed in. Analytics requests are relayed through our own domain rather than sent to them directly, which means each one arrives carrying the ordinary details any web request carries: your IP address, from which an approximate location is derived, and your browser’s user-agent, from which browser, operating system and device type are derived. We do not send them your email address, your name, or any individual scorecard answer.
We may also disclose personal data where the law requires it, or to establish or defend a legal claim.
Where your data goes
Some of these suppliers are based outside the UK, and analytics are hosted on European servers. Where personal data is transferred outside the UK, that transfer is covered by the appropriate safeguard for the country concerned: adequacy regulations where they apply, and otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us which applies to a given supplier.
Cookies and similar technology
The site sets no advertising cookies, and carries no advertising or social-media trackers. We use PostHog to count page views and the four actions listed above, so we can see which parts of the site are useful. Our analytics requests are served from this domain rather than a third-party one, so nothing here builds a picture of you across other websites. The lawful basis is your consent: PostHog is not started and sets no identifier until you accept. If your browser sends a Do Not Track signal, analytics stay off regardless.
That identifier is a random string stored in your browser. It carries no name and no email address, and we do not link an analytics event to your subscription, so we cannot tell who it belongs to. We would rather not call it anonymous, though, because it is stable enough to join up one visitor’s activity: in data protection terms it is pseudonymous, it counts as personal data, and you have the same rights over it as over anything else described here.
You can change your choice at any time with Cookie settingsin the footer. Choosing Reject there stops further collection and removes PostHog’s stored device identifier. We keep only the rejected choice so we do not ask you again; the site remains fully functional.
Your rights
Under UK data protection law you can:
- Ask for a copy of the personal data we hold about you.
- Ask us to correct anything that is wrong.
- Ask us to delete it. Unsubscribing stops the emails straight away, but it is not the same thing as erasure: our email provider keeps a suppression record afterwards so that you are not added back by mistake. If you want that record removed too, email us and say so.
- Ask us to restrict how we use it, or object to our using it.
- Ask for it in a portable, machine-readable form.
- Withdraw consent at any time, without having to explain why. Withdrawing it does not undo anything done before you withdrew it.
Exercise any of them by emailing info@isochroneconsulting.com. There is no charge, and we will not ask you to justify the request. We may need to check who you are before we hand over a copy of anything.
If you are unhappy with how we have handled your data
Please tell us first, so we have the chance to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at any time and without asking us first.
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk · 0303 123 1113
Changes to this notice
When the substance changes we update the date at the top of this page. If a change materially affects how we use data you have already given us, we will tell subscribers by email rather than relying on you to re-read this page.
Governing law
This notice, and any dispute arising from it, is governed by the laws of England and Wales.