What I collect, why, and who else touches it.

What gets collected

Only what the thing you asked for needs to work.

• Newsletter. Your email address, collected by Substack when you subscribe. Substack also records opens and clicks on what it sends.
• Contact form. Your name, email, website, what you are asking about, the details you type, and when you want to talk.
• Book orders. Name, shipping address, email and order contents, collected by Lulu at checkout. Payment card details go to Lulu’s payment processor. I never see the full number.
• PopCall. Your PopCall account, phone number and call history live with PopCall. I see your name, the length of the call and anything you choose to tell me. PopCall records calls and keeps them 180 days.
• Consulting. Whatever you share for the work, which can include access to your accounts and your customers’ data. That is covered by the written agreement for the engagement.
• Site visits. No analytics and no ad pixels run on this site. The host, Vercel, keeps standard server logs (IP address, pages requested, browser type) for security, and nothing else is recorded about your visit.

What it is used for

Delivering what you bought, answering what you asked.

• Sending the newsletter you subscribed to, shipping the book you ordered, answering the message you sent.
• Keeping records of orders, refunds and subscriptions, because tax and consumer law require it.
• Emailing you about things I make, if you signed up for the newsletter or the drops list. Every email has an unsubscribe link. Unsubscribing takes effect within ten business days, usually instantly.
• Preventing fraud and chargeback abuse.

Who else sees it

The companies that do the actual delivering.

• Substack (newsletters and My Tea Diary). Lulu (printing, shipping and book checkout). PopCall (calls and messages). Resend (delivers the contact form to me and sends the drops list and order emails). Vercel (hosts the site).
• Each of them has its own privacy policy and processes your data on its own servers, some outside the United States.
• Lawyers, accountants and payment providers when a dispute, a chargeback or the tax year requires it.
• Law enforcement or a court, if legally compelled.
• A buyer, if the business is ever sold. You would be told.

Cookies

A few, none of them clever.

The site itself sets no tracking cookies and runs no analytics or ad pixels.

Substack, PopCall and Lulu set their own cookies when you use their pages.

Your browser can block or clear cookies.

The site still works without them.

Your choices and rights

Ask and it gets done.

• Unsubscribe from any email with the link at the bottom of it.
• See, correct or delete what I hold about you by asking through the contact form. Pick “Billing, order or refund question” and say it is a privacy request. I answer within 30 days, usually much faster, and I will verify it is you before changing or sending anything.
• Substack, Lulu and PopCall data is deleted through their own account settings or support. I can point you to the right page.
• California residents have the right to know what is collected, to delete it, to correct it, and to not be discriminated against for asking. I do not sell or share personal information as California defines those words. Requests go through the contact form or to hi@ashleighro.com.
• EU and UK residents have the rights above plus the right to object, to restrict processing, to data portability and to complain to your local supervisory authority. The legal bases are contract (delivering what you bought), consent (marketing email, which you can withdraw), and legitimate interest (running and protecting the site).
• Retention. Order and billing records are kept seven years for tax. Contact form messages are kept two years. Newsletter data is kept until you unsubscribe, then handled by Substack’s retention rules.