What this site collects, and what it does not

Who we are

This site is run by Shift Left L.L.C., doing business as Shift Left Consultants. We are the controller of the personal data described here. For anything on this page, including deletion requests, email contact@shiftleftconsultants.com.

Browsing the site

We don't profile your visit. There are no cookies, no tracking pixels and no advertising. Fonts are served from this site, not from a third party. The servers that deliver the pages do not keep access logs.

Counting visits

We count visits with our own cookieless analytics, which we run ourselves on Amazon Web Services in Frankfurt, Germany. It sets no cookies and stores nothing in your browser. When a page loads, your browser tells us the page you are on (without its query string, apart from campaign tags), the site that linked you here, and your screen width. The connection also gives us your IP address, your country and your browser's name and version.

Your IP address and browser details are used only to tell visitors apart within one day. They are combined with a random value that changes every day into a one-way code, which is deleted within 48 hours. The IP address and browser details themselves are never stored. What we keep are daily totals, such as how many people read a page or arrived from a given site. The totals do not identify anyone.

Under the GDPR, the legal basis is our legitimate interest in knowing which pages people read.

The contact form

If you send the contact form, we receive what you type into it: your name, your work email, and optionally your company, the challenge you selected, your message, and an assessment report if you choose to share it. The original build file is not attached automatically. We use it only to reply to you and to discuss the work you asked about. We do not add you to a mailing list, and we do not sell or share it.

Before the form is sent, a spam check called ALTCHA runs a short calculation in your browser and confirms it with our server. It uses no cookies and does not identify you.

Under the GDPR, the legal basis is taking steps at your request before a possible contract, and our legitimate interest in answering enquiries.

Who processes it

• Amazon Web Services hosts the site and runs the services that check the form and send it to us by email (Amazon SES), in the United States. It also runs our visit counts, in Frankfurt, Germany.
• Zoho hosts the mailbox the message is delivered to.

Both process the data on our behalf under their standard data processing terms. Because they operate in the United States, your message is transferred there.

How long we keep it

Your message stays in our mailbox for as long as we are corresponding with you or working together, and we delete it on request.

Our email service also writes a log line for each message it sends. That line includes the subject, which contains your email address, but not your message. These logs are currently kept without an automatic expiry. Ask us and we will delete yours.

For visit counts, the daily one-way code is deleted within 48 hours and the daily totals are kept for 25 months.

Your rights

You can ask to see the data we hold about you, correct it, delete it, restrict or object to how we use it, or receive a copy. Email us and we will answer within a month. If you are in the EU or UK and are not satisfied with our answer, you can complain to your data protection authority.

California residents have the same rights to know and delete. We do not sell or share personal information as those terms are defined under the CCPA.