Privacy Policy

Plain-English summary (provided for convenience, and not part of the Policy): we collect your email only when you give it to us, we never sell or rent your data, our spreadsheets run on your machine where we cannot see them, and every email we send has a one-click unsubscribe. When we report a signup to Meta for advertising measurement, we send a one-way hash of your email, never the address itself. Questions: hey@heywork.shop.

1. Introduction

In this Privacy Policy, "Hey Workshop," "we," "us," and "our" mean Hey Workshop, the operator of heywork.shop (the "Website"). We are committed to respecting your privacy. This Privacy Policy sets out how we collect, use, store, and disclose your personal information. It is written against what the Website actually does, and we intend to be held to it.

By providing personal information to us, you consent to our collection, use, and disclosure of your personal information in accordance with this Privacy Policy. We may change this Privacy Policy from time to time by publishing changes to it on the Website, as indicated by the "Last updated" date at the top of this page. We encourage you to check this page periodically to ensure that you are aware of our current Privacy Policy. Where a change materially affects you, we will take reasonable steps to bring it to your attention rather than relying on a quiet edit.

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable, such as a name, email address, or online identifier.

2. What Personal Information We Collect

We collect deliberately little. The categories of personal information we collect are:

• Email address. Collected only when you voluntarily provide it: to unlock a free resource, to receive a quiz report, or to subscribe to our newsletter.
• Signup context. A tag recording which form, page, or quiz you signed up through, and, where you arrived from a tagged marketing link, the campaign parameters (UTM values) associated with your visit.
• Quiz results. If you complete a quiz, we store the outcome (your result band, score, and identified focus area) against your subscriber record so that the follow-up email you requested makes sense. Your individual answers are processed in your browser; we store the result, not the raw answers.
• Purchase information. When you buy a product, Gumroad, Inc. (the merchant of record) informs us of the product purchased and the purchasing email address so we can deliver onboarding email and support. We never receive or store your payment card details.
• Technical and usage information. Standard web log information (such as IP address, browser type, and pages requested) held by our hosting provider, and aggregated, privacy- preserving page-view analytics.

We do not collect your name, postal address, telephone number, date of birth, or payment details. Data you enter into our spreadsheet and document products remains on your own device or in your own cloud accounts; those products contain no telemetry, and we have no ability to access their contents. Values you type into interactive tools on the Website (for example, quiz worksheet widgets) are stored in your browser's local storage on your device and are not transmitted to us.

3. How We Collect Personal Information

We collect personal information: (a) directly from you, when you submit a form on the Website; (b) automatically, as you use the Website, through server logs and the analytics and advertising technologies described in Section 7; and (c) from Gumroad, when you make a purchase.

4. Why We Collect, Use, and Disclose Personal Information

We collect, hold, use, and disclose personal information for the following purposes:

• to deliver the resource, report, or newsletter you requested;
• to send you relevant email about our content and products, which you can stop at any time (see Section 5);
• to provide onboarding, updates, and support for products you have purchased;
• to operate, protect, improve, and optimise the Website and our products, including analytics and research;
• to measure the effectiveness of our marketing, including determining which campaigns and pages result in signups; and
• to comply with our legal obligations and enforce our agreements.

We do not use personal information for automated decision-making that produces legal or similarly significant effects, and we do not sell personal information for money to anyone.

5. Direct Marketing and Opt-Out

Where you have provided your email address, we may send you direct marketing communications about our content, products, and services. Every marketing email we send contains a functioning one-click unsubscribe link, and an unsubscribe takes effect immediately. You may also opt out at any time by contacting us at hey@heywork.shop. We do not operate an SMS or telephone marketing program, and we do not provide your email address to third parties for their own marketing purposes.

6. To Whom We Disclose Personal Information

We disclose personal information only to the service providers required to run the business, and only for the purposes described in this Policy:

• Kit (ConvertKit LLC), our email service provider, which stores our subscriber list and sends our email;
• Vercel Inc., our hosting provider, which serves the Website and maintains server logs and aggregated analytics;
• Gumroad, Inc., the merchant of record for all purchases;
• Meta Platforms, Inc., for advertising measurement as described in Section 7, on a hashed basis only; and
• Substack Inc., which hosts our newsletter archive, if you choose to subscribe there.

We may also disclose personal information to professional advisers; to any person to whom our assets or business (or any part of them) are transferred, in which case this Policy will continue to apply; to specific third parties where you authorise it; and to government agencies, regulatory bodies, and law enforcement agencies where required, authorised, or permitted by law. That is the complete list. We do not sell, rent, or trade personal information.

7. Cookies, Analytics, and Advertising Technologies

Analytics. We use Vercel Web Analytics to count page views. It is designed to be privacy-preserving, does not use cookies, and does not track you across other websites.

Advertising measurement (the Meta pixel). The Website includes the Meta (Facebook) pixel so that we can tell whether advertising we pay for results in visits and signups. The pixel sets cookies (such as "_fbp") and reports page-view and signup events to Meta Platforms, Inc. When our server confirms a signup to Meta's Conversions API, it transmits a one-way SHA-256 hash of your email address, never the address itself, together with the event identifiers needed to deduplicate the report. We do not transmit your quiz answers, the contents of anything you type into our tools, or any other personal details to Meta. Meta's use of the data it receives is governed by Meta's own privacy policy.

Local storage. Interactive tools on the Website save your inputs to your browser's local storage so that your work is still there when you return. This data stays on your device and is not transmitted to us.

Your controls. You can disable cookies and blockable trackers through your browser settings or a tracker-blocking extension. The Website is built to function fully with tracking blocked: every free resource still unlocks, and every purchase still completes.

8. Security

We hold personal information in electronic form in the systems of the service providers listed in Section 6, each of which maintains its own physical, administrative, and technical safeguards. We take reasonable steps to protect personal information from misuse, interference, and loss, and from unauthorised access, modification, or disclosure, including limiting access to systems holding personal information on a need-to-know basis. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data Retention

We retain your email address and associated subscriber record until you unsubscribe or ask us to delete it, after which it is removed from our active mailing systems. Server logs are retained on our hosting provider's standard rolling schedule. Purchase records are retained by Gumroad in accordance with its own legal obligations, including tax law.

10. Children

The Website is directed to people running or starting a business and is not intended for children. We do not knowingly collect personal information from anyone under 16 years of age. If you believe a person under 16 has provided us personal information, contact us at hey@heywork.shop and we will delete it.

11. Third-Party Links

The Website contains links to websites operated by third parties, including Gumroad, Substack, our social media profiles, and cited research sources. Those links are provided for convenience. We are not responsible for the privacy practices of, or any content on, those linked websites, and the privacy policies that apply to them may differ substantially from this Policy. We encourage you to read them before using those websites.

12. International Transfers

The service providers listed in Section 6 store and process data in the United States and may process data in other jurisdictions in which they operate. Where personal information is transferred across borders, it is handled under the applicable provider's safeguards for international transfers, and this Policy continues to describe the limits of what we collect and share.

13. Access, Correction, and Deletion

You can request access to the personal information we hold about you, request correction of inaccurate information, or request deletion of your information entirely, in each case by contacting hey@heywork.shop. We may need to verify that a request comes from the holder of the relevant email address before acting on it. We will respond within a reasonable period, and within any period required by applicable law. If we cannot comply with a request in full (for example, because Gumroad is legally required to retain a purchase record), we will tell you why. These rights are available to everyone, regardless of where you live, and exercising them is free of charge unless a request is manifestly unfounded or excessive.

14. Additional Provisions for the European Economic Area and United Kingdom

If you are located in the European Economic Area or the United Kingdom, our legal bases for processing your personal information under the General Data Protection Regulation (GDPR) are: (a) consent, where you have provided your email address to receive something from us, which you may withdraw at any time; (b) performance of a contract, in respect of purchases and product delivery; and (c) legitimate interests, in respect of security, service operation, and the measurement described in Section 7, where those interests are not overridden by your rights.

In addition to the rights in Section 13, you have the right to object to processing, the right to restriction of processing, the right to data portability (a copy of the information you provided in a structured, machine-readable format, which for most subscribers is an email address and a set of tags), the right to withdraw consent at any time, and the right to lodge a complaint with your local supervisory authority. To exercise any of these rights, contact hey@heywork.shop.

15. Additional Provisions for California Residents

This section applies to visitors and customers who reside in the State of California, and is provided in connection with the California Consumer Privacy Act, as amended (the "CCPA"). In the preceding twelve (12) months we have collected the following categories of personal information, as described in Section 2: identifiers (email address and IP address); internet or other similar network activity (page views and signup events); and commercial information (records of products purchased, as reported to us by Gumroad). We collect them from you directly, automatically as you use the Website, and from Gumroad, and we disclose them for business purposes only to the service providers listed in Section 6.

We do not sell personal information for monetary consideration. The use of the Meta pixel described in Section 7 may constitute "sharing" for cross-context behavioral advertising as defined by the CCPA; you may opt out of such sharing by using a tracker blocker, enabling the Global Privacy Control signal in your browser, or emailing hey@heywork.shop with the subject "Do Not Share," and we will take reasonable steps to exclude your data from such measurement. You also have the rights to know, to access, to correct, to delete, and to non-discrimination for exercising your rights, each of which may be exercised as described in Section 13. We do not offer financial incentives in exchange for personal information, and we do not knowingly sell or share the personal information of consumers under 16 years of age.

16. Making a Complaint

If you believe we have breached applicable privacy law, or you wish to complain about how we have handled your personal information, contact us at hey@heywork.shop with a description of your complaint. We will acknowledge it and respond within a reasonable period. If you consider our response unsatisfactory, you may refer your complaint to the data protection or consumer protection authority in your jurisdiction.

17. Contact Us

For further information about this Privacy Policy or our practices, to access or correct your personal information, or to make a complaint, contact us at hey@heywork.shop. A person reads and answers every message.