Privacy policy

• Site audits and walkthroughs (marshal.studio/rate): your name, email, website address, anything you write in the note, and whether you let me feature your site’s grade. I use them to audit your homepage or make your video walkthrough, email it to you, and follow up once myself. To stop abuse, I keep a scrambled (keyed hash) form of your IP address for the daily limits, never the address itself.
• Referrals and fund partnerships (marshal.studio/partners): your name, email, fund or website, and note, to set up your link and credit and pay referrals.
• Booking a call (Cal.com): your name, email and answers to the booking questions, to prepare for and hold the call.
• Clients: the email addresses you give me for the project dashboard and handoff documents, to send sign-in links and show each client only their own project.
• If I emailed you first: I write to founders and teams at startups that have recently raised. I hold your name, work email, role and company, and public company details such as funding news, from public sources and business data providers. My lawful basis is legitimate interests: a relevant business offer sent to a business address. Every email has an unsubscribe link. Use it, or reply asking me to stop, and I won’t email you again.

For audits, walkthroughs, partnerships and calls the basis is that you asked: I need the details to do what you requested, and to follow up on it. I don’t sell personal data, and there’s no newsletter.

If you tick the box on the audit form, I may feature your site and its grade in a public round-up on X or LinkedIn. That shows your site, not your name or email. Changed your mind? Email me and I’ll take the post down.

Walkthrough videos are kept at a long, unguessable link. Anyone who has the link can watch it, so share it only with people you’d show the audit to. Ask and I’ll delete it.

These providers handle data on my behalf, only to run the parts of the site listed:

• Vercel: hosts the site.
• Supabase: database, sign-in and file storage, in its London region.
• Anthropic: writes the audits, walkthrough scripts and email drafts from the details above.
• Plunk: sends the emails.
• treg: takes screenshots of the website you submit, and supplies business contact data for outreach.
• Cal.com: takes bookings.

Some of these providers are based in, or process data in, the US. Where they do, the transfer relies on the safeguards each provider puts in place, such as the UK–US data bridge or the UK’s international data transfer addendum.

There are no analytics or advertising cookies on this site. These are the only cookies it sets:

• mref (optional): if you arrive through a partner’s referral link, I ask before setting it. It holds their code, not anything about you, for 30 days so they’re credited if you get in touch.
• mconsent: remembers whether you allowed the referral cookie, for six months, so you aren’t asked on every visit.
• Sign-in cookies: keep clients and me signed in to the project dashboard, handoff documents and admin pages.

You can change your answer any time with “Cookie settings” at the bottom of every page.

• Enquiries, audits, walkthroughs and outreach records: up to two years after we last spoke, unless you become a client.
• Client records: six years after the project ends, for UK tax and accounting.
• If you unsubscribe or object, I keep just your email address on a do-not-contact list, so you aren’t contacted again.

You can ask for a copy of your data, or ask me to correct it, delete it, restrict it, or hand it over in a portable format. You can object to how I use it, and you can always object to marketing, which stops it. Email chris@marshal.studio and I’ll reply within a month.

If you’re unhappy with how I’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. I’d appreciate the chance to put it right first.

When this policy changes, the date at the top changes with it.