as considered.

Private by design.

Privacy notice · 27 September 2026

We collect information needed to provide, secure and bill for your website. We do not sell personal data, build advertising profiles, use third-party analytics systems or train generative AI on your content. That does not mean we store only billing data: running your account, publishing your work and protecting people requires the information below.

Who is responsible.

As Considered, made by Will Hackett in London, is the controller for account administration, payments and platform safety. For personal data in your published content and visitor insights, the website owner is normally the controller and we act as their processor. Our data processing terms describe that relationship. Our trader details, service address and privacy/abuse contacts are listed below.

What we process and why.

• Account access: your email address, hashed session tokens, short-lived sign-in challenges and passkey public credentials. We never receive your device’s biometric data. This is necessary to provide the service and keep accounts secure.
• Your website: content, images, settings, drafts, revisions and domain configuration, to store and publish what you ask us to. Content you publish is public and may be copied or indexed by others.
• Billing and domains: plan, payment and invoice identifiers, amounts, billing information held by Stripe, and registrant contact details required by Porkbun or a registry. Our lawful bases include performing the contract and complying with financial/legal obligations.
• Security and support: rate-limit keys derived from connection addresses, error information, support requests, abuse reports, image screening decisions and records needed to prevent misuse or meet legal obligations. We rely on legitimate interests in protecting people and the service, or legal obligations where applicable.
• Optional visitor insights: only after consent, page views, approximate country, page paths, referral codes, outbound destinations without query strings, and active reading/scroll measurements. We do not record browsing sessions or store IP addresses in our analytics dataset.

Cookies and visitor choice.

Essential cookies keep account owners signed in and bind login challenges to their browser. Optional visitor insights are off until the visitor opts in. The cookie named anonymous_id lasts 90 days; despite its name, it is pseudonymous personal data. Identifiers are scoped to each website. A separate privacy-choice cookie remembers the visitor’s decision for a year. Visitors can withdraw through the Privacy link on the website. We honour Do Not Track and Global Privacy Control. Refusing insights does not block access to content.

Insights cover consenting visitors and are estimates, not a complete audience count or proof that someone understood an article. External media is linked rather than automatically embedded; following a link makes a connection to that provider under its own policy.

Who receives information.

Cloudflare provides hosting, storage, email delivery, network security and the Analytics Engine infrastructure used by our own insights system. Stripe processes payments and may act as an independent controller for its fraud prevention and regulatory obligations. Porkbun and relevant registries process domain registrations. Approved image-safety providers may process uploads solely for moderation; their identity and processing terms must be included in our subprocessor register before they receive production uploads. We may disclose information when legally required or necessary to protect people, subject to appropriate safeguards.

Hosting a site on your own domain does not determine where its data is processed. Cloudflare’s network and our service providers operate internationally. Where restricted transfers occur, the applicable provider agreements and transfer safeguards, including UK-approved contractual mechanisms where required, must be in place. We do not promise UK-only storage or processing.

How long we keep it.

Sign-in codes expire after 10 minutes, passkey challenges after five minutes, and account sessions after seven days. Expired authentication/rate-limit records are cleaned up daily. Visitor analytics events expire after three months. Unused domain quotes expire after 30 minutes and their contact/authorisation data is removed by the next daily cleanup. Successful domain provisioning removes the local transfer code and contact copy once no longer needed.

Unapproved uploads without a legal preservation requirement are removed after seven days. Suspected illegal material may be subject to restricted legal hold. Content stays while you use the service; account deletion requests are reviewed and completed within one month unless a lawful extension applies. We separate data needed for outstanding domain services, disputes, safety holds and legally required financial records. UK business accounting records may need to be retained for six years or another applicable statutory period. Backup/provider retention and restoration procedures are documented in our operations register.

Your rights.

You can export account and website content and request deletion in Plan. You can ask to access or correct personal data, restrict or object to certain processing, obtain portable data where applicable, and withdraw consent. Some rights depend on the legal basis and circumstances. We may verify your identity before responding. Visitors should normally contact the website owner about that owner’s content or insights; we assist them with valid requests.

You can complain to the UK Information Commissioner’s Office at ico.org.uk, or your relevant supervisory authority. We will update this notice when material processing changes and notify account owners where appropriate.