Privacy notice
Version 1. Effective date: 19 October 2026. Last updated: 19 October 2026.
The EU and EEA are not a supported area for the monthly update. The update email is offered only to people aged 16 or over who are outside the European Union and the European Economic Area. The website, the Changes page and the Atom feed are open to everyone and collect nothing about you. Why the update isn’t offered in the EU or EEA.
The short version
- Who we are. Privacy Map is run by jamiecurle ltd, trading as Privacy Posture. We decide how the personal data described here is used, so we are its “controller”.
- We don’t track you. The site sets no cookies, runs no analytics and loads nothing from other websites. Our host, Cloudflare, handles your connection (including your IP address) to deliver the site and keep it safe.
- The monthly update (not offered in the EU or EEA). If you subscribe, we keep your email address, a random code for your links, and the times you signed up and confirmed. We use them only to send the email you asked for. You can unsubscribe from any email, and that deletes your address straight away.
- If you email us, we use your message to reply.
- We don’t sell your email address, use it for advertising or profiling, or put it through AI tools.
- Your rights. You can ask to see, correct or delete your data, and more. Email hello@privacyposture.com. You can complain to the UK Information Commissioner (ICO) or your local regulator.
The rest of this page gives the detail.
This notice covers the personal data we control on Privacy Map (earth.privacyposture.com). Privacy Map has no customer accounts or workspaces, so we don’t process anyone’s data on someone else’s behalf here.
1. Who we are
jamiecurle ltd, trading as Privacy Posture. A private limited company registered in England and Wales, company number 14306285.
Registered office: 12 Millcroft Court, Blyth, Northumberland, NE24 3JG, England.
Email: hello@privacyposture.com
2. How to contact us about privacy
Email hello@privacyposture.com. It reaches the person responsible for privacy at jamiecurle ltd.
We have not appointed a data protection officer.
Representative in the EU: we have not appointed one. We don’t offer the monthly update, or any other service that collects personal data, to people in the EU or EEA. Here’s why.
3. What personal data we collect
If you visit the site
- Connection data: your IP address, browser and device details sent with each request, the page you asked for, and the time. Cloudflare handles this to deliver the page and to protect the site from attacks and abuse.
- Your light or dark theme choice, if you change it. This stays in your browser’s local storage. It is never sent to us.
If you subscribe to the monthly update
To subscribe, you confirm that you are 16 or over and that you are not in the EU or EEA. We don’t store those answers. Ticking both boxes is simply a condition of signing up.
- your email address
- whether you have confirmed your subscription
- a random code used in your confirm and unsubscribe links
- when you signed up, when we last sent you a confirmation email, and when you confirmed
If you email us
- your email address and name, as your email shows them
- what you write to us, and any attachments
Sensitive data
We don’t ask for sensitive data, such as health, religion or sexual orientation. Please don’t send it to us. If you do, we use it only to reply to you.
4. Where we get it from
- From you: your email address when you subscribe, and anything you send us.
- Automatically: connection data, when your browser connects to the site.
- From other people or companies: we don’t buy or receive data about subscribers from anyone else.
5. Why we use it, and our legal basis
| What we do | Data used | Legal basis (UK GDPR and EU GDPR) | Do you have to give it? |
|---|---|---|---|
| Deliver the website and protect it from attacks and abuse | Connection data | Legitimate interests: running a public website that works and stays secure | Your browser sends it automatically. Without it, the site can’t reach you. |
| Send you the monthly update | Email address, subscription status, link code | Consent, given when you sign up and confirm. You can withdraw it at any time by unsubscribing. | No. If you don’t subscribe, you don’t get the email. Everything else on the site still works. |
| Confirm sign-ups and stop the form being misused (for example, limiting how often confirmation emails go out) | Email address, sign-up and confirmation times | Legitimate interests: making sure only the owner of an address can subscribe it, and that our form can’t be used to send unwanted email | Needed to subscribe. |
| Reply to your email, and fix errors you report | Your email and what you wrote | Legitimate interests: answering you, and keeping the map accurate | Optional. We can’t reply without your email address. |
| Handle a request to use your privacy rights | Your request and the data it concerns | Legal obligation: the law requires us to respond | Needed to act on the request. |
| Keep records, and deal with legal claims or a regulator’s enquiry | Any of the above, only where needed | Legal obligation, or legitimate interests in protecting our legal position | Not applicable |
6. Who we share it with
We use these service providers. They act on our instructions under written contracts and may not use your data for their own purposes.
| Provider | What they do for us | Data involved |
|---|---|---|
| Cloudflare, Inc. | Hosts the site, delivers it, protects it, and runs the database of subscribers | Connection data; subscriber data |
| Postmark (ActiveCampaign, LLC) | Sends our emails. Open and click tracking are switched off. | Your email address, and the emails we send you |
| Google LLC (Google Workspace) | Hosts our email inbox | Emails you send us, and our replies |
We also share data, only where needed:
- with professional advisers, such as lawyers or accountants
- with the police, courts or regulators, when the law requires it
- with a buyer, if the business or this service is sold or reorganised. The buyer would have to use your data in line with this notice.
We don’t sell subscribers’ email addresses. We don’t share them for targeted advertising, and we don’t use them to profile anyone.
7. International transfers
Our subscriber database is stored in the European Union, using Cloudflare’s EU data location setting.
Some of our providers are based in the United States, so your data may be handled there:
| Provider | Country | How the transfer is protected |
|---|---|---|
| Cloudflare, Inc. | United States, and the country where Cloudflare’s network meets your connection | EU-U.S. Data Privacy Framework and its UK Extension; standard contractual clauses as a fallback |
| ActiveCampaign, LLC (Postmark) | United States | EU-U.S. Data Privacy Framework and its UK Extension; standard contractual clauses and the UK Addendum |
| Google LLC | United States | EU-U.S. Data Privacy Framework and its UK Extension; standard contractual clauses as a fallback |
You can check a company’s certification on the Data Privacy Framework list. To get a copy of the safeguards, email hello@privacyposture.com.
8. How long we keep it
| Data | How long |
|---|---|
| A sign-up you don’t confirm | 7 days. After that the confirmation link stops working, and a daily clean-up deletes the address. |
| A confirmed subscription | Until you unsubscribe. Unsubscribing deletes your address and its record straight away. |
| Copies of the emails we send, at Postmark | 45 days, then Postmark deletes them, along with their delivery records |
| Connection data | We don’t keep request logs. Cloudflare handles connection data to deliver and protect the site, and keeps it as its privacy policy describes. |
| Emails you send us, and our replies | While it’s useful for replying to you or checking the data. We delete it 2 years after the conversation ends, and clear out older email at least once a year. |
| Records of privacy requests (your request, our reply, and what we did) | 6 years after we close the request, so we can show it was handled properly if there is ever a legal claim. |
9. Your rights and how to use them
You have the right to:
- Access: get a copy of your personal data.
- Correction: have inaccurate data corrected.
- Deletion: have your data deleted.
- Restriction: ask us to limit how we use your data.
- Portability: get the data you gave us in a common digital format, or have it sent to someone else.
- Withdraw consent: at any time. For the monthly update, just unsubscribe. This does not affect anything we did before you withdrew.
- Complain to a regulator (see section 10).
Your right to object
You can object at any time to us using your data on the basis of legitimate interests. That covers connection data, sign-up checks and email replies. We will stop unless we have compelling legitimate grounds that override your interests, or we need the data for legal claims.
We don’t send direct marketing except the monthly update you asked for. If you no longer want it, unsubscribe and it stops.
How to make a request
Email hello@privacyposture.com and say what you want. Email is the only way to make a request. We’re a very small business, and a web form would mostly attract spam. If you can’t use email, ask someone to write to us for you.
- Checking it’s you. We usually reply to the email address the request is about. For a subscription, we may ask you to confirm from the address you subscribed with. We only ask for what we need to be sure.
- Someone acting for you can make a request, with your written permission or other proof that they may act for you.
- Timing. We reply within one month. If a request is complex, or you send several, we can take up to two more months. If so, we tell you within the first month.
- Cost. It’s free. We can charge a reasonable fee, or refuse, only if a request is clearly unfounded or excessive.
- If you disagree with our answer, reply and we will look at it again. You can also go straight to a regulator.
Global Privacy Control: the site runs no tracking or advertising code, so a Global Privacy Control signal has nothing to switch off here.
10. How to complain
We’d like the chance to sort out any problem first, so please email hello@privacyposture.com and say it’s a complaint. We acknowledge every complaint within 30 days, look into it, and tell you what we found and what we’ve done about it.
You don’t have to come to us first. You can complain to a regulator at any time.
- United Kingdom: the Information Commissioner’s Office (ICO). Complain online at ico.org.uk/make-a-complaint, or call 0303 123 1113 (+44 303 123 1113 from abroad).
- European Economic Area: the data protection authority where you live or work, or where you think the problem happened. The European Data Protection Board lists them all.
- Elsewhere: your local privacy regulator.
11. Automated decisions, profiling and AI
We don’t make decisions about you by automated means that have legal or similarly significant effects.
For the monthly update, we don’t profile subscribers, and we don’t put their email addresses through AI tools.
Emails you send us are kept in Google Workspace. Google’s built-in assistant features may process them, for example to summarise a message or suggest a reply.
12. How we protect it
- Every connection is encrypted with HTTPS (TLS), and browsers are told to use nothing else (HSTS).
- A strict content security policy means the site loads no code or content from other websites.
- No tracking, analytics or advertising code runs on the site.
- The subscriber database is stored in the EU. Each subscriber’s links use a long random code.
- Access to systems and data is limited to the people and services that need it (least privilege). Access keys are limited in the same way.
- The sign-up form is protected against automated misuse.
We hold no security certifications. No system is completely secure, but we work to keep your data safe. If something goes wrong that puts you at risk, we will tell you and the regulator as the law requires.
13. Children
Privacy Map is not aimed at children. You must be 16 or over to subscribe to the monthly update, and you confirm this with a checkbox when you sign up. We don’t check ages any further. If we learn that someone under 16 has subscribed, we delete their address.
14. Changes to this notice
This is version 1. Each time we change this notice, the version number goes up and the dates at the top change. Every earlier version stays online, unchanged, and is listed under Previous versions below.
If a change is material and affects subscribers, for example a new use of your email address or a new provider handling it, we email subscribers to tell them.
We review this notice at least every 12 months, and whenever the way we handle data changes.
Cookies and similar technology
We don’t use cookies. The only thing stored on your device is your light or dark theme choice, and only if you change it. It stays in your browser’s local storage, is never sent to us, and is used only to show the site the way you asked. Because nothing optional is stored, there is no cookie banner.
Email from us
The monthly update is the only email we send, apart from replies to you and the email that confirms your sign-up. We send it only if you subscribe and confirm (double opt-in). Every update has a one-click unsubscribe link, and supporting email apps show their own unsubscribe button.
Language and accessibility
This notice is in English. We aim to meet the Web Content Accessibility Guidelines (WCAG) 2.2, level AA. If you need this notice in another format, such as large print or plain text, email hello@privacyposture.com.
If you are in the UK
- Controller: jamiecurle ltd (section 1), which is established in the UK. The UK GDPR and the Data Protection Act 2018 apply.
- Regulator: the ICO (section 10).
- Your rights are in section 9, with the right to object set out on its own.
- Transfers outside the UK, and their safeguards, are in section 7.
- We don’t make automated decisions with legal or similarly significant effects (section 11).
If you are in the European Union or European Economic Area
We don’t offer the monthly update, or any other service that collects personal data, to people in the EU or EEA, and we have no establishment there. Here’s why.
- You can still read everything. The website and the Atom feed are open to you, and they collect nothing about you. Our host, Cloudflare, handles your connection to deliver them, as section 3 describes.
- If you subscribed anyway, please unsubscribe using the link in any update; that deletes your address straight away. If we learn a subscriber is in the EU or EEA, we delete their address.
- If you email us, we reply and handle your message as section 5 describes. You can use the rights in section 9, and complain to your local data protection authority (section 10).
If you are in the United States
We don’t sell or share subscribers’ email addresses, or use them for targeted advertising or profiling. We don’t ask for sensitive personal information. Whatever state you live in, you can use the rights in section 9 by emailing hello@privacyposture.com, and we won’t treat you differently for doing so.
Previous versions
None yet. This is the first version. When it changes, it will stay online at /privacy/v1/.
Privacy Map is a reference compilation, not legal advice. This notice describes how we handle your data. It is not advice about your own obligations.