Privacy policy

This policy explains what personal information I collect when you visit systemsandfunnel.com, what I do with it, who helps me process it, how long I keep it, and the rights you have over it. I have written it to describe how this site actually works, not as a generic template. If anything here is unclear, email me at jordan.mft@kingdomsocialmedia.com and I will explain.

1. Who I am

This website is run by Emmanuel O. Awefada, an independent funnel strategist and automation specialist. For the purposes of data protection law, including the UK GDPR, the EU GDPR and similar laws elsewhere, I am the controller of the personal information collected through this site. That means I decide why and how it is used, and I am responsible for it.

You can reach me about anything in this policy at jordan.mft@kingdomsocialmedia.com.

2. The short version

• I only collect what you choose to send me, plus basic analytics about how the site is used.
• I never sell your personal information, and I never rent or trade my mailing list.
• You only receive my newsletter if you sign up for it, and you can leave at any time.
• The site uses Microsoft Clarity to understand how visitors use the pages. It records clicks, scrolling and page interactions, not what you type into forms.
• You can ask to see, correct or delete what I hold about you, and I will act on it.

3. What I collect and how

Information you give me

Contact form. When you send a message through the contact page I collect:

• your name and email address (required);
• your phone number, only if you choose to give it;
• the content of your message, and anything you include in it.

Your message is saved securely and a copy is emailed to me, so nothing is lost if an email goes astray. I also add your name, email and phone number to my private contacts list, marked as an enquiry, so I can follow up with you properly.

Please do not include sensitive information in your message, such as health details, financial account numbers or passwords. I do not need it to reply.

Newsletter. When you subscribe I collect your email address and, if you give it, your first name. I then send you a single welcome email.

Email. If you email me directly, I receive your email address, your name as it appears in your email, and whatever you write.

Booking a call. The booking calendar is provided by a third party scheduling service and opens inside a window on this site. Anything you enter there, such as your name, email, phone number and chosen time, is collected by that service and shared with me so the call can take place. See section 6.

Information collected automatically

Usage analytics. This site uses Microsoft Clarity. When you browse, Clarity collects information about how you interact with the pages: the pages you view, clicks, taps, scrolling and mouse movement, how long you stay, the page that referred you, your device type, screen size, browser and operating system, and your approximate location (country or region) derived from your IP address. Clarity uses this to produce heatmaps and session recordings, which are reconstructions of a visit that I can replay to see where the site is confusing or broken. Clarity masks text you type into form fields by default, so I do not see your contact details in recordings.

Security and abuse prevention. When you submit the contact form or the newsletter form, your IP address is recorded briefly so I can limit how many submissions arrive from one address in a short time. This stops spam and automated abuse. These records are deleted on a rolling basis once they are more than 24 hours old.

Server logs. Like almost every website, the hosting platform keeps technical logs of requests, which include IP address, browser type, the page requested and the time. These are used to keep the site running and secure and are kept only for a short period.

Information I do not collect

I do not ask for or knowingly collect special category information, such as health, religion, ethnicity or political opinions. I do not take payments on this site. The site does not use advertising pixels from Meta, Google Ads, TikTok or similar networks.

4. How I use it, and my legal basis

Data protection law in the UK and EU requires me to have a lawful basis for each use of your information. Here is each use and the basis I rely on.

• Replying to your enquiry and discussing whether we might work together. Basis: steps taken at your request before entering into a contract, and my legitimate interest in responding to people who contact me.
• Keeping a record of enquiries in my contacts list, so I can follow up and remember our conversation. Basis: legitimate interests. Keeping track of who I have spoken to is a normal part of running a business, and you would reasonably expect it.
• Sending the newsletter and the welcome email. Basis: your consent, given when you subscribe. You can withdraw it at any time.
• Delivering work if you become a client. Basis: performance of our contract.
• Understanding and improving the site through Clarity analytics. Basis: your consent where the law of your country requires it for this kind of technology, and otherwise my legitimate interest in finding and fixing problems on the site.
• Preventing spam, fraud and abuse, and keeping the site secure. Basis: legitimate interests.
• Meeting legal obligations, such as keeping business records or responding to a lawful request from an authority. Basis: legal obligation.

Where I rely on legitimate interests, I have weighed them against your rights and expectations. You can object at any time, as explained in section 10.

I do not make decisions about you based solely on automated processing, and I do not build profiles of you for advertising.

5. Cookies and similar technologies

Cookies are small files a website stores in your browser. Local storage works in a similar way. Here is everything this site uses.

Strictly necessary and preferences

• theme (local storage, no expiry): remembers whether you chose the light or dark theme. It stays in your browser and is never sent to me.
• Sign in cookies for the private admin area. These are only set for me when I sign in to manage the site. Visitors never receive them.

Analytics (Microsoft Clarity)

• _clck (1 year): keeps a random Clarity user ID and settings, so repeat visits are recognised.
• _clsk (1 day): joins several page views into one session recording.
• CLID (1 year): records the first time Clarity saw this browser on any site using Clarity.
• MUID (1 year): a Microsoft identifier for this browser, used across Microsoft services.
• ANONCHK (10 minutes), MR (7 days) and SM (session): Microsoft cookies that manage and synchronise the MUID identifier.

Microsoft sets and controls these cookies and may change them. Its current list is in the Clarity cookie documentation.

Embedded content

Some articles embed YouTube videos, and the booking calendar opens inside this site. These are loaded from the provider's own servers, and those providers may set their own cookies and collect information about you, just as if you had visited their site directly. The booking calendar only loads when you open it.

Controlling cookies

You can block or delete cookies in your browser settings. Blocking analytics cookies does not stop the site working. A content blocker or your browser's strict tracking protection will also stop Clarity from loading. Blocking the booking or YouTube cookies may stop those embeds from working.

6. Who else handles your data

I do not sell, rent or trade your personal information. I share it only with the service providers that make this site work. Each one processes it on my behalf, under a written data processing agreement, and only for the purpose described.

• Vercel Inc. (United States): hosts the website and processes server logs. Privacy policy.
• Supabase Inc. (servers in the United States): the database that stores contact form messages, my contacts list, newsletter subscribers and rate limiting records. Privacy policy.
• Resend (Plus Five Five, Inc., United States): delivers emails from this site, including the welcome email, newsletters and the copy of your contact form message sent to me. Privacy policy.
• Microsoft Corporation (United States): provides Clarity analytics. Microsoft may also use Clarity data under its own privacy statement to improve its products. Microsoft privacy statement.
• Booking calendar provider: the scheduling service at link.authoritysystems.net, which collects the details you enter when booking a call.
• Google LLC (YouTube): only if you view an article with an embedded video. Privacy policy.
• My email provider: stores messages you send me directly and the copies of form enquiries delivered to my inbox.

I may also disclose information if the law requires it, to protect my rights or the safety of others, or to a successor if my business is ever transferred. In that last case this policy would continue to apply to your information.

7. International transfers

The providers above are based in, or store data in, the United States. If you are in the UK, the European Economic Area or Switzerland, this means your information is transferred outside those areas. Where a provider is certified under the EU US Data Privacy Framework (and its UK Extension and Swiss framework), I rely on that certification. Otherwise I rely on the Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum, which the providers include in their data processing agreements. You can ask me for more detail on the safeguards for any transfer.

8. How long I keep it

I keep personal information only as long as I need it for the purpose I collected it for.

• Contact form messages and enquiry records: up to 24 months after our last contact, unless you become a client, after which records are kept for as long as the law requires for business and tax purposes (usually six years after the work ends).
• Newsletter subscription: until you unsubscribe. After that I keep only your email address, marked as unsubscribed, so I never email you again by mistake. If you ask me to erase you completely, I will, but I will then have no record to stop your address being added again.
• Rate limiting records containing your IP address: deleted on a rolling basis once they are more than 24 hours old.
• Clarity analytics: kept by Microsoft under its retention settings, currently around 30 days for session recordings and up to 13 months for heatmaps and reports.
• Server logs: kept by Vercel for a short period, typically a few days.

When I delete information, it is permanently removed from my database, not merely hidden.

9. How I protect it

I take the security of your information seriously. The measures in place include:

• encryption in transit on every page, with browsers told to connect only over HTTPS;
• database access rules enforced by the database itself, so contact records can only be read by me after signing in;
• sign in by single use email link, with session cookies that page scripts cannot read;
• limits on repeated form submissions, and spam traps on every form;
• security headers that stop other sites framing these pages or loading unapproved scripts;
• secret keys kept on the server only, never in your browser.

No system is perfectly secure. If a breach affecting your information ever happens, I will notify you and the relevant regulator where the law requires it.

10. Your rights

Depending on where you live, and in all cases under the UK GDPR and EU GDPR, you have the right to:

• Access the personal information I hold about you, and get a copy.
• Correct information that is wrong or incomplete.
• Erase your information, where there is no good reason for me to keep it.
• Restrict how I use your information while a concern is resolved.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Data portability: receive the information you gave me in a common, machine readable format.
• Withdraw consent at any time, where I rely on it. This does not affect anything done before you withdrew.
• Complain to a data protection regulator (see section 16).

To use any of these rights, email jordan.mft@kingdomsocialmedia.com. I will respond within one month. I may ask you to confirm your identity first, usually by replying from the email address I hold for you. Making a request is free, unless it is clearly unfounded or excessive.

11. If you live in the United States

Residents of California and several other states have rights under their state privacy laws, including the California Consumer Privacy Act as amended by the CPRA.

• Categories collected in the last 12 months: identifiers (name, email, phone number, IP address, online identifiers), internet and network activity (how you interact with the site), approximate geolocation, and any other information you choose to include in a message. The sources, purposes and recipients are described in sections 3, 4 and 6.
• No sale. I do not sell personal information, and I do not share it for cross context behavioural advertising as those terms are defined in California law.
• No sensitive personal information is collected or used to infer characteristics about you.
• Your rights include the right to know, access, correct and delete your personal information, and the right not to be treated differently for using them. You can use them by emailing jordan.mft@kingdomsocialmedia.com, or through an authorised agent with your written permission. I will respond within 45 days.
• Global Privacy Control. I treat a GPC signal from your browser as a valid request to opt out of any sale or sharing.

12. Email and how to stop it

I only send the newsletter to people who have subscribed to it. Every newsletter explains why you are receiving it and how to leave. To unsubscribe, reply to any email with the word "unsubscribe", or email jordan.mft@kingdomsocialmedia.com. I will remove you promptly, and in any case within 10 days.

If you send me an enquiry, I will reply to it and may follow up about that enquiry. I will not add you to the newsletter unless you ask to be added.

13. Children

This site is intended for business owners and professionals. It is not directed at children under 16, and I do not knowingly collect information from them. If you believe a child has sent me personal information, email me and I will delete it.

14. Links to other sites

This site links to other websites and social profiles, such as LinkedIn and GitHub. I am not responsible for how those sites handle your information. Please read their privacy policies before giving them any personal details.

15. Changes to this policy

I will update this policy when the site or the law changes. The effective date at the top always shows when it last changed. If I make a significant change to how I use information you have already given me, I will tell you by email before it takes effect.

16. Contact and complaints

Questions, requests and complaints about privacy go to jordan.mft@kingdomsocialmedia.com. I read every message personally and will do my best to put things right.

You also have the right to complain to a data protection regulator. In the UK that is the Information Commissioner's Office at ico.org.uk. In the European Union it is the supervisory authority in the country where you live or work, listed by the European Data Protection Board. I would appreciate the chance to deal with your concern first, but you do not have to.