Privacy Policy

1The short version

What is left is the ordinary business of running a website and a subscription: an account, an email address, a payment, a message you send us. This document says what that is, who else sees it and what you can make us do about it.

2Who is responsible

The controller for the data described here is the operator of combobulating: Ohmyfin Limited, a company registered in England and Wales under company number 15431563, with its registered office at 275 New North Road, Islington Suite 1422, London, England, N1 7AA . Write to hello (at) combobulating (dot) ai for anything in this document, including a request under section 9. We answer from that address, and we answer people, not ticket numbers.

We have not appointed a data protection officer, because we are not required to. If that changes we will name one here.

3What we collect, and why

We do not sell data, we do not rent it, and we do not use it for advertising by anyone else. We do not profile you or make automated decisions with legal effects about you.

4Your server, and who is responsible for what is on it

Two different things share one machine and the law treats them differently.

• Your account and your subscription: we decide what to collect and why, so we are the controller, and section 3 is the list.
• Everything you or your agents put on the server: you decide what it is and what it is for, so you are the controller and we are your processor for the hosting of it. If that data includes personal data about other people, having a lawful basis for it is your job, as clause 6 of the Terms of Service says.

As your processor we act on your instructions, and asking us for help or sharing a project with our team is an instruction of that kind. The other two cases in clause 8 of the Terms, a suspected security incident and a legal obligation, are the ones data protection law itself asks of a processor: keeping the processing secure, and complying with UK or EU law it is subject to (Articles 32 and 28(3)(a) of the GDPR and the UK GDPR).

If you need a data processing agreement under Article 28 GDPR, ask us at hello (at) combobulating (dot) ai and we will sign one.

5Who else processes data

These are everyone outside the team who handles data for us, what they do and where. We use no others, and we will update this list before we add one.

Transfers outside the EEA. Anthropic is in the United States, and Stripe, Google and Amazon have group companies there. Those transfers are made under the European Commission's standard contractual clauses, together with the measures those providers publish. Everything else in the list stays in the EU.

6Cases you send us, and the pipeline that reads them

If you offer us a case, what you upload goes through an automated pipeline that uses a language model to check it for problems, work out whether it says enough, structure it, expand it and translate it. That is Anthropic processing your material, on our account, as our processor.

Two things follow, and they are the reason this has a section of its own. First, do not upload anything confidential, personal or secret: strip customer names, credentials and anything under an NDA before you send it, as clause 14 of the Terms of Service requires. Second, this is the one place where a machine of ours reads something you wrote, and it happens because you sent it to us to be published. It is nothing to do with the server you rent, which nobody reads.

Uploaded files are held on a quarantine store, are scanned for malware, are never served to the web, and are deleted with the submission.

7Cookies and analytics

The site sets two cookies of its own and neither one needs your consent: a session cookie, so you stay logged in, and a CSRF token, so a form you submit is the form we sent you. Both go when the session ends. Open a page in English, Russian, Serbian or Portuguese and we set a third, holding those two letters and nothing else, so that the next time you arrive without saying which language you want you get the one you were reading. It lasts a year and you can change it at any time from the language control in the header. If you answer the cookie banner, or use the analytics control in the footer, we set a fourth, holding nothing but the word you pressed, so that your answer holds on the next page. It lasts twelve months.

Whether Google Analytics runs depends on where you are. We use it to count visits, so that we can tell whether anything we write here is read. In the EEA and the UK, and wherever we cannot work out where you are, it runs only if you press accept: it does not load, and it sets nothing, until you have pressed accept on the banner, and we do not treat carrying on browsing as consent. Everywhere else there is no banner and it runs from the first page you open, on our legitimate interest in knowing whether what we write is read, until you turn it off with the control in the footer. When it does run it sets two cookies of its own, holding a random identifier for the browser rather than anything that names you; they last up to two years. We do not send Google your name, your email address or anything you have written to us through Analytics.

The footer of every page carries a one click control that turns Analytics off, and back on again, wherever you are; where we show the banner, it appears once you have answered it. Turn it off and the tag stops loading on the very next page you open; the cookies Google has already set stay in your browser until they expire or you clear them, which your browser can do at any time.

We put the banner in front of visitors in the EEA and the UK, and in front of anyone whose country we cannot work out. To decide which you are, we look your IP address up in a copy of the MaxMind GeoLite2 country database that sits on our own server. That lookup happens in memory, we do not store your address to do it, and nothing about it leaves our machines: asking a geolocation service would mean handing your address to a company in order to decide whether we are allowed to track you. We use the same lookup to show prices in euro in Europe and in US dollars elsewhere; a switch on the pricing page changes it for your visit.

We also count presses, and that one is not about you. When you press something on this site the browser sends us the name of the button, the page it was on and the language you were reading in, and our own server adds one to a total for that day. That is the whole of it. Nothing is written to your browser and nothing is read from it, no identifier of any kind is made, the address the message arrived from is thrown away rather than stored, and if you are signed in your account is not mentioned. The table it lands in holds a day, a button, a page and a number, which means it cannot answer the question «what did this person do», by design and not by policy. That is why it runs for everyone, including anyone who pressed reject: there is nothing here to consent to under the cookie rules, because nothing is stored on your device and nothing about you is stored on ours.

The number under a walkthrough is the same kind of counting. When ten seconds of a video have actually played, your browser tells our server that it happened and the server adds one to a total kept against that video. The total is what the page prints. Nothing is written to your browser to do it and nothing is read from it, so watching the same walkthrough twice counts twice: we would rather the number were a little generous than mark your device to make it exact.

We also count how far into a walkthrough people get, and that is not about you either. As a video plays, your browser adds up the seconds of it that have actually played, and when that reaches a quarter, a half, three quarters and all of it, it tells us so. What arrives is the mark, which video it was and the language you were reading in, and our server adds one to a total for that day, in the same table the button presses land in. It is not a record of where you stopped or of which parts you watched: four counters go up, nothing is stored against you, nothing is written to your browser and nothing is read from it, and if you are signed in your account is not mentioned. We use it to decide how long to make the next one.

The number under an article is the same counting again. When one of our longreads has been the tab you are looking at for ten seconds, your browser tells our server that it happened and the server adds one to a total kept against that article in that language. The clock stops while the tab is in the background, so a link you opened and never came back to is not counted. Nothing is written to your browser to do it and nothing is read from it, exactly as above. The one thing our server does look at is the name your browser gives itself in the request, and it looks at it only to drop the search engines and scripts that would otherwise be counted as readers; it is used to make that decision and thrown away with the request, never stored beside the total or anywhere else.

And when a page breaks, the browser tells us what broke. If something in the site's own code throws an error while you are reading, your browser sends us the message, the script it came out of, the line it was on, and the name of the route the page was built from. It does not send the address of the page you were on, because an address on the customer side of the site carries a support reference and a case name, and this has no business holding either. We also record which browser family and major version it was, worked out here from the request and not stored as your browser sent it, because the fix usually depends on knowing that much and no more. Nothing is written to your browser and nothing is read from it, no identifier is made, the address the report arrived from is thrown away, and if you are signed in your account is not mentioned. Reports are grouped by fault rather than kept one by one, so the table holds a message, a script, a page and a number: it cannot answer «what did this person do» for the same reason the press counts cannot, by design and not by policy.

One measurement here IS about you, and it is the only one. If you are paying for something, we mark the DAY you used it: that you opened your machine, or watched a masterclass, or answered a change we proposed, together with the plan you were on. We do it because the question we need answered cannot be asked of a total. Everything above counts things and forgets people, and a total by day cannot tell one customer coming back every week from a stream of strangers arriving once; that difference is the whole of whether what we sell is useful, so we ask it about the smallest possible thing and about customers only. The mark holds the day and never the hour, the kind of thing and never which one, so it can say you watched a masterclass on a Tuesday and can never say which masterclass, which machine, which file. It does not count how many times. Nothing is written to your browser and nothing is read from it, and if you are not paying for anything nothing is written at all. It goes when the account goes. Section 3 is the row for it, and section 9 is how to ask for a copy of it or to object to it.

There is no advertising, no advertising network and no tracking pixel on this site.

8Security

There is no password on this site, so there is none to guess, reuse or leak: signing in is a six-digit code sent to your mailbox, and that code is stored hashed, stops working after ten minutes and dies the moment it is used. The site is served over TLS. Uploads are scanned before they are stored and are kept off the web. Administrative access to the servers is by key, limited to the people who need it, and used only for the purposes in clause 8 of the Terms of Service.

No security is perfect. If a breach puts your rights at real risk we will tell the supervisory authority within 72 hours and tell you without undue delay.

9Your rights

Under the GDPR and the UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it to you in a portable form. You can object to anything we do on the basis of legitimate interest, and you can withdraw a consent at any time, which does not undo what we did before you withdrew it.

Mail about masterclasses and news you can stop yourself, at any time: the unsubscribe link at the foot of any of them does it in one click, with no need to sign in, write to us or give a reason.

Write to hello (at) combobulating (dot) ai. We answer within one month. You do not have to give a reason, and we will not make it hard. Some things we have to keep whatever you ask, mainly invoices, and we will tell you which and why.

You can also complain to a supervisory authority in the country you live or work in. We would rather you told us first, and we will still fix it if you do not.

10Children

The service is for adults and is not directed at children. We do not knowingly collect data about anyone under 18. If you think we have, tell us and we will delete it.

11Changes

We will publish a new version here with a new date, and where a change matters we will tell you by email at least 30 days beforehand. The date at the top of this page is always the date of the version you are reading.