Assay — privacy

Who is responsible

Assay is run by Adam Mayer, trading as Assay, contactable at adam@assayworks.co.uk. That address reaches a person directly, and it is the right one for any request on this page.

Assay is run from the United Kingdom. Postal address: 43 Rippleside Road, Clevedon, BS21 7JX, United Kingdom.

The short version

This website sets no cookies, uses no third-party analytics, and stores nothing in your browser. The one exception is described below: a report page notes that it was opened, and which of its links were used — nothing about who you are, and nothing stored on your machine.
If you were sent a report, I hold your business contact details, taken from public sources, and the findings about your public catalogue.
One reply saying stop removes you permanently. Not for a campaign — for good.
If you become a customer, I additionally hold your catalogue text and a key you issue and can revoke, which is encrypted where it is stored.

If you were sent a report

What	Where it came from	Why
Business email address	Your own website, or Companies House	To send you the report once
Shop domain, platform, catalogue size	Your public storefront	To work out whether there is anything worth telling you
Company number, company name, directors	The public register at Companies House	To tell whether a shared inbox reaches the owner, and whether you are a company or a sole trader — which changes what I am allowed to send
Findings about your catalogue	Your public product feed	The report itself
Whether I wrote, and whether you replied	Me	So you are not contacted twice, and so a “stop” sticks
Whether your report page was opened, and whether its spreadsheet, product links or “Connect your shop” were used	The report page itself, when it is viewed. No cookie, no IP address and no browser details are kept — only the time and which report.	To know whether a report was useful without having to ask you

The lawful basis is legitimate interests — offering a relevant business service to a business, using contact details that business publishes itself. I have weighed that against the nuisance of an unasked-for email, which is why there is exactly one, why it says so in the first paragraph, and why stopping takes three words.

No special category data, no profiling, no automated decisions about people. The automated judgements here are about catalogues, not about you.

If you are a customer

Your product content — titles, descriptions, images, types — read from your shop so it can be checked and rewritten.
An API credential you create, verified before it is stored and encrypted at rest with a key kept outside the database. You can revoke it in your own admin at any moment, without asking me.
Snapshots of anything changed, kept so that any edit can be put back. These are the record that makes “you can undo it” true, so they outlive the change itself.

Who else sees it

Who	What they handle	Where
Zoho	Email to and from me	EU
Cloudflare	Serving this website and the reports	Global
Anthropic	Customers only: product descriptions sent to a language model to be rewritten	US

Nothing is sold, and nothing is shared for anyone else’s marketing. If you are a prospect rather than a customer, your data never reaches the third of those.

How long it is kept

Asked me to stop: the address is kept, and only the address, precisely so a future run cannot write to you again. Everything else about you goes.
Never replied: removed when the outreach experiment ends, or on request, whichever comes first.
Customer: kept while you are a customer. Snapshots are kept for as long as the ability to undo is worth having — ask and they go with the rest.

What you can ask for

A copy of what I hold, a correction, deletion, or that I stop entirely. Email adam@assayworks.co.uk and it is done within a few days, usually the same one — this is a small operation and there is no ticket queue to wait in.

You can also complain to the Information Commissioner’s Office at ico.org.uk. I would rather you told me first, but it is your right either way.

This notice describes a small operation honestly rather than defensively. If you think something here is wrong, missing, or written to sound better than it is, say so — that is a bug in the same way a wrong finding is.