Privacy Policy
Last updated: 6 September 2026
This site does not ask you for anything. It has no sign-up form, sets no cookies of its own, and runs no analytics, advertising or tracking of any kind.
Beyond Institutional Thinking is a trading name of James Male, 72 St Mary’s Street, Ely CB7 4HH, United Kingdom, who is the data controller for personal information collected through this website. Contact: james@beyondinstitutionalthinking.com.
What is collected here
Through this website itself: nothing. There is no form, no account, no cookie and no script running on these pages.
Two things still reach third parties when you load a page, and you should know about them:
- Netlify hosts the site and keeps standard server logs, including IP addresses, for security and operations. Those are Netlify’s records under its own privacy policy.
- Google Fonts serves the typefaces. Requesting a font sends your IP address to Google. If you would rather it did not, a content blocker or a browser set to block third-party requests will stop it, and the pages will still read perfectly well in a substitute typeface.
What is collected if you subscribe
Subscriptions are handled by Substack, which collects your email address and, for paid subscriptions, payment details processed by Stripe. We can see subscriber email addresses and basic engagement information through Substack’s dashboard. We never see full payment card details, and we never store them.
Substack is a separate data controller for that information and its own privacy policy applies alongside this one.
What is collected if you write to us
Your message and your address, held for as long as it takes to deal with it and for a reasonable period afterwards.
What it is used for
To send you the publications you asked for, to answer your messages, and to meet legal obligations. Nothing else. Personal information is never sold or rented, and it is not used for advertising, profiling or any purpose you did not ask for.
Legal basis
- Consent — for sending the publications. Withdraw it at any time by unsubscribing; every email carries the link.
- Contract — for administering a paid subscription.
- Legitimate interests — for replying to correspondence and keeping the site secure and available.
How long it is kept
Subscriber records last as long as the subscription, and afterwards only as long as records and legal obligations require. Correspondence is kept while it is relevant.
Your rights
Under UK data protection law you may ask for a copy of the personal information held about you, have it corrected or deleted, restrict or object to its processing, ask for it in a portable form, and withdraw consent. Email the address above and you will get an answer within a month.
Because Substack holds subscriber data as its own controller, some requests are quickest made to Substack directly. If that is the case you will be told so rather than left waiting.
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk.
Transfers outside the UK
Substack, Stripe, Netlify and Google are US companies, and some processing takes place in the United States under the safeguards described in their own policies.
Changes
This policy may be updated. The version on this page is the one in force, and its date is at the top.
Beyond Institutional Thinking is a trading name of James Male, 72 St Mary’s Street, Ely CB7 4HH, United Kingdom. · james@beyondinstitutionalthinking.com