Privacy Policy

The site records aggregate, first-party analytics (PostHog) — pages viewed, referrer, and campaign parameters (UTM tags on inbound links) — to understand how visitors arrive and what they read. For visitors in the EU, EEA, and UK this runs cookieless until you consent: no non-essential cookie is set and no persistent identifier is stored.

When you reveal a contact detail or open a case study, the site checks your IP address against a business database (IPinfo) to work out which company you are visiting from. I do this because I have a legitimate interest in knowing which businesses are paying attention to the work described here.

Here is exactly what gets saved: the event (a contact reveal or a case-study view), the page it happened on, whether you looked like a real person or a bot, and the company name and domain the lookup returned. The IP address itself is never stored — it is used for the moment the lookup takes and then discarded. There are no cookies behind this, no cross-site tracking, and nothing is sold or shared. These records are visible only to me — in the site admin and in the private briefing Zeus sends me.

I keep them for 180 days, then they are deleted automatically.

• Vendor: RB2B, a third-party visitor-identification provider, may match a visit to a professional identity.
• Data collected: name, professional profile, and business contact details associated with the visit.
• Purpose: business development — reaching out to organizations and individuals who show interest in the consulting work described here.
• Legal basis & consent: for EU/EEA/UK visitors this feature is off by default and runs only after you opt in via the consent banner. Elsewhere it operates on a legitimate-interest basis with the opt-out below.
• Retention: identified-person records are kept for at most 24 months from the last interaction, then deleted. They are never shown publicly.

Pages under /work and /dartboard can embed YouTube videos and use YouTube API Services. By using those pages you agree to the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.

Video playback is click-to-load on YouTube's privacy-enhanced domain: the YouTube iframe is not inserted until you press play. Before that, the page loads only the video's thumbnail from YouTube's image CDN. This site does not access, collect, store, or share any YouTube user data about its visitors.

The publishing workflow behind this site is owner-only. Today, uploads are staged for the site owner to complete in YouTube Studio. After YouTube API audit approval, the tool will use the site owner's authorization only to upload private videos, manage video metadata, and read this channel's analytics for production review. Access can be revoked at any time via Google security settings. No other person's YouTube data is accessed or stored. If access is revoked there, stored YouTube API data tied to that authorization is deleted as soon as possible and within 30 calendar days; deletion requests sent to the contact below are completed as soon as possible and within 7 calendar days.

You can decline or withdraw consent at any time via the banner (EU/EEA/UK) or by emailing the address below (opt-out anywhere). To exercise a data-subject request — access, correction, deletion, or objection (DSAR) — email privacy@matthjones.com. Requests are actioned within 30 days.

Details you submit through the contact form (name, email, organization, message) are used solely to respond to your inquiry and are stored securely. They are never sold or used for advertising.