What this site knows about you

• Most public pages can load Google Analytics and Microsoft Clarity, and advertising tags from Meta, LinkedIn and Apollo.io. Each is described below.
• None of them loads until you say yes in the cookie banner. Saying no is one click, and the site works the same either way.
• These tags set cookies, and Clarity can record how you move through a page.
• The interactive tools, this page and the course area load none of them.
• If you fill in a form, download a file, book a call or talk to the assistant, I keep what you gave, because that is the request.
• I do not sell or rent your details to anybody.
• Ask me to delete what I hold and it is deleted, not archived or flagged.

On this page

1. Who is responsible
2. Analytics and advertising tags
3. What this site records itself
4. Cookies and what is stored in your browser
5. Who else processes it
6. How long it is kept
7. Your rights, and what happens when you use them
8. What this site does not do
9. Children
10. Security
11. Changes to this page

Sunil Mathew, operating as The Living Craft, from Bangalore, India. Under India's Digital Personal Data Protection Act 2023, that makes me the Data Fiduciary for everything described here, and you the Data Principal.

A small number of people help me run the website and its marketing. They can read the records described below in my operator console, and they work under my instructions. I answer privacy requests myself.

Reach me at apply@thelivingcraft.ai.

Most public pages can load Google Tag Manager. It is a container: it loads the tags below, and it is where they are switched on and off. It loads only after you allow analytics in the cookie banner. When it does, these companies receive data directly from your browser, including your IP address, because that is how a browser fetches anything.

Where they run, and where they do not

They run on the home page, the programme pages, the consulting pages (the overview, Fractional CAIO, AI Readiness Assessment and Advisory), the field notes, the terms page, and the reading pages: About, Contact, email preferences, the resource and tool index pages, the worksheets, the templates and the guides.

They do not run on:

• the interactive tools and kits: the POC Selection Tool, the Model Selection Tool, the Agent Authority Review, the Change Authority Review, the Run-Cost Model, the Cost-Ceiling Workbook, the Rework Cost Check, the Rule Placement Audit, the Gate Routing Map, the Citation Fit Check, the Agent Memory Audit Kit, the Agent Failure Triage Kit, the Agent Failure Triage Quiz, the Agent Design Check and the Standout Skills Self-Review
• this page
• the page that manages a booked call
• the course area and anything else behind a sign-in

The tools are kept free of them on purpose. Several of them promise that what you type stays in your browser, and a session-recording tag on the same page would break that promise.

Google Analytics

Counts visits and tells me which pages are read, where visitors came from, and roughly where they are, from their IP address. It sets the cookies _ga and _ga_S2XJ61GXDD, which last up to two years and let Google recognise the same browser when it returns. Google keeps the data for the period set in my account, at most 14 months.

Microsoft Clarity

Records how visitors use a page: scrolling, clicks, mouse movement and what was on the screen. I use it to see where a page confuses people. It sets _clck (one year) and _clsk (one day) on this site, and Microsoft sets its own cookies, such as MUID and CLID, on its own domains.

Clarity is designed to hide what you type into form fields. Text shown on the page can still appear in a recording, and that includes a conversation with the assistant once it is on screen. Microsoft keeps recordings for 30 days and summary data for up to 13 months.

Meta Pixel

Meta runs Facebook and Instagram. The Meta Pixel tells Meta that a browser visited a page or took an action here, such as submitting a form. I use this to measure whether advertising brings people to the site, and to show adverts to people who have visited. It sets the cookie _fbp, which lasts about three months.

The pixel runs in your browser, and only if you allowed advertising. Nothing is sent to Meta from this site's servers. The pixel is set up without Meta's "advanced matching", so it does not send Meta your name, email address or phone number from a form.

LinkedIn Insight Tag

Tells LinkedIn that a LinkedIn member visited or took an action here. I use it to measure LinkedIn adverts, to see the kinds of roles and companies that visit, and to show adverts to people who have visited. LinkedIn sets its own cookies. It says it removes direct identifiers within seven days and keeps the rest for up to 180 days.

Apollo.io

Apollo.io keeps a database of businesses and business contacts. Its tag tells Apollo which pages were visited and from which network. Apollo uses that to work out which companies visited, and it may match a visit to people in its database. I use it to see which organisations are interested in this work. Apollo sets its own cookie.

Asking first

None of these tags loads until you say yes. The first time you open a page here, a banner asks. On the interactive tools the answer is saved for the rest of the site, and none of these tags loads on those tools either way. You can accept all, reject all, or choose:

• Analytics: Google Analytics and Microsoft Clarity, and this site's own two cookies that remember where your visit began (described under where your visit came from).
• Advertising: Meta, LinkedIn and Apollo.io. They load through the same container as the analytics tags, so they only run when analytics is also on.

If you reject, or close the page without answering, nothing on this list loads. Your answer is kept in one cookie, lc_consent, for 180 days. After that, or when this list of tags changes, you are asked again.

You can change your answer at any time with "Cookie choices" at the foot of those pages, or with the button below. Turning a category off deletes the cookies its tags set on this site and reloads the page. Cookies a company set on its own domain, such as Microsoft's, can only be removed in your browser or with that company.

Change your cookie choices

You can also block them yourself: most browsers can block third-party cookies, and a content blocker stops the tags from loading at all. Google publishes an opt-out add-on for Google Analytics. Meta and LinkedIn let you turn off adverts based on other websites in your account's advert settings.

When you read a page

This site keeps its own simple record of visits on the home page, the Fractional CAIO page, the AI Readiness Assessment page, and every page under /resources/ and /tools/. Nothing is recorded by this site's own code on any other page: not on this page, the programme pages, the field notes, the other reading pages, or behind a sign-in.

Each recorded event holds:

• which page, and what happened on it: a view, opening the assistant or asking it something, starting a form, a field the form refused (which field and why, never what you typed), following a link to another part of the practice or to a programme (with which button it was), starting to use a tool, reaching a tool's result, or receiving a file you asked for. The tool events name the tool and nothing you entered into it
• a random identifier for that one event, so that an event sent twice is stored once
• whether it came from the live site or a test copy of it, and your answer in the cookie banner at the time
• the host you arrived from, such as linkedin.com, never the full link
• your country, from the hosting layer, and your region only if it is in the page address
• whether the device is a phone or a computer
• a visitor identifier, described next

This identifier is deliberately short-lived. It is a cryptographic hash of your IP address, your browser's user-agent string, a secret held on the server, and today's date. Because the date is part of it, it changes at midnight UTC, and the same person returning next week is an unrelated row. The raw IP address is used to compute the hash and is never written to storage by this site. Automated crawlers are dropped before anything is recorded.

This short-lived identifier is this site's own. The Google Analytics and Clarity cookies described above do recognise a returning browser, for as long as those cookies last.

When you send an enquiry

An enquiry or a request begins a conversation. It is not an application, a payment, a reservation or a confirmed place.

Enquiries are emailed to me through a form-delivery service, and written to my own database so that I have a searchable history. That second copy also records whether the email went through, because a failed delivery used to be invisible.

The current forms ask for these fields, and nothing else on those pages collects personal details. No file upload is offered anywhere on this site, and you are asked not to send confidential company material.

A programme or a career package, or help choosing one

Required: Full name, Email address, Current role, and your agreement to be contacted about this enquiry

Optional: Your role, in your words, when the list does not fit

After the enquiry is saved, you can add optional context, such as your use case, your experience, funding, your target role or interview timing. Nothing depends on it.

Learning for a team

Required: Full name, Work email, Organisation and role, The capability your team needs to develop, and your agreement to be contacted about this enquiry

Optional: Approximate group size, Phone number

Fractional CAIO and AI Readiness Assessment

Required: Full name, Work email, Organisation and role, your current AI priorities or what you need to decide, and your agreement to be contacted about this enquiry. The assessment form also asks for your current AI work or constraints.

Optional: Engagement of interest, on the Fractional CAIO form

Earlier forms, including the cohort application, asked for more: system-design experience, what you wanted to develop, a funding route, organisation and phone. Submissions made through them are kept with those answers, for as long as the table below says.

When a submission or a download request is saved, the server also records that it was saved, with an opaque record number and no personal details. That is how I count enquiries without counting button presses.

Earlier forms also asked one optional question, "How did you first hear about The Living Craft?". Where you answered it, the answer is kept beside your submission and apart from the campaign tags below. It is never sent to an analytics tag.

Where your visit came from

With each submission and each download request I also keep where your visit came from: the campaign tags in the address you arrived on (such as utm_source), the host of the site that sent you, and the page you started on. That tells me which posts and pages bring people here.

If you have not allowed analytics, no cookie is used for this, and only the page the form is on is counted. If you arrived on a guide and sent an enquiry from a programme page, I see the programme page and not the guide.

If you have allowed analytics, this site writes two small cookies of its own on the page where you arrive from another site, a link or a bookmark:

• lc_last holds how this visit began. It is deleted when you close the browser, and the next arrival replaces it.
• lc_first holds how your first visit began. It is written once and kept for 400 days.

Each holds the campaign tags, the page, the host of the site that sent you and the date. Neither holds an identifier, your IP address or anything you typed, and moving between pages of this site never changes them. They are read only when you send a form or ask for a file, and only while your answer in the banner is still yes. Turning analytics off deletes them.

Records are grouped by email address. A download and a later enquiry from the same address sit under one person. You are shown a reference when a submission is saved. Nothing on this site looks a record up by that reference. No card details are collected anywhere on this site, and there is nothing to pay to send an enquiry.

When you download a file

Every file on the resource pages asks for your name, your role and your email address first: the workbooks, the PDFs, the worksheets, the templates and the print copies. I keep your name, your role, your email address, which resource and which file you asked for, when, and where your visit came from, as described above.

A download is not permission to market to you. It starts no email sequence. The address is used to send you that resource once, when email sending is switched on. Today no email is sent by machine at all.

When a file is built from your own answers, such as a scored PDF, your answers go into the file and are not stored. Two tools never send what you type anywhere: the Rule Placement Audit and the Agent Design Check build their files in your browser.

When you tick the marketing box

The download forms carry one optional tick box, in these words:

Yes, send me practical resources and occasional updates about The Living Craft programmes. I can unsubscribe at any time.

It starts unticked and nothing depends on it. Your download is treated the same either way. The enquiry forms ask you to agree to be contacted about that enquiry. That agreement is needed to answer you and is not permission to market to you. A receipt confirming that your request was saved is not marketing.

Earlier forms used other words. The download forms said "Yes, send me practical resources and occasional updates about The Living Craft cohort. I can unsubscribe at any time." The application and enquiry forms said "Email me programme updates and practical resources from The Living Craft. I can unsubscribe at any time." A record made under either keeps those words.

If you tick the box on a download form, we first send one email asking you to confirm. Nothing else is sent until you click the link in it. If you do not click it, you receive nothing more.

What you agreed to is stored with the words you were shown, under a version label. If that sentence is ever reworded, it becomes a new version, and your record keeps pointing at the words you were shown.

No follow-up email is sent today.

When you talk to the assistant

The assistant on the public pages is automated. It is a Claude model from Anthropic, not Sunil. Your question and its answer are sent to Anthropic to produce the reply. Both are stored here with the page you asked from, your country, and some counters about how the answer was produced.

A short session identifier ties one conversation together. It lives in the browser tab's memory, is never written to your device, and is gone when you close the tab.

I read these conversations. They show me what my pages fail to explain. Please do not type anything confidential into a chat box on any website, including this one.

When you book a call

Booking a discovery, scope or cohort call records your name, email address, company, job title, anything you write in the notes field, your timezone, and the time you chose.

The booking is created as an event in my Google Calendar with you as a guest, which sends you the invitation and the video link. So your name, email address and notes are passed to Google as part of the event. Cancelling removes it from both calendars.

The link in your invitation that lets you reschedule carries a secret. Only a hash of it is stored here. Please do not forward that invitation.

If you join the cohort

Participants get an access code for the course area. I store your name, email, which cohort you are in, and a hash of that code. The code itself is never stored, so a copy of the database does not let anyone sign in as you.

The pre-cohort questionnaire and the work you do in the course area are stored against your seat. I read them and use them to plan the sessions. What you post in the cohort's discussion forum is visible to the other participants; everything else is not.

If you allow them, the tags above set their own cookies:

• Google Analytics: _ga and _ga_S2XJ61GXDD, up to two years
• Microsoft Clarity: _clck (one year) and _clsk (one day), plus Microsoft's own cookies on its domains, and one session-storage entry, _cltk, which is cleared when the tab closes
• Meta: _fbp, about three months
• LinkedIn and Apollo.io: their own cookies, described in their policies

This site's own code writes very little:

• lc_consent, which remembers your answer in the cookie banner for 180 days. It holds the two answers and the date, and nothing that identifies you
• only if you allowed analytics: lc_last (until the browser closes) and lc_first (400 days), which remember where a visit began, as described under where your visit came from
• one cookie that keeps you signed in to the course area, if you hold a seat
• one cookie that keeps me signed in to my operator console
• on the Rule Placement Audit only, your rows are saved in your own browser's local storage, so that closing the tab does not lose them. They are never sent to me, and clearing your browser's site data removes them

Both sign-in cookies are signed, marked HttpOnly so that no script can read them, sent only over HTTPS, and restricted to this site.

Each entry says what reaches them.

Vercel

Hosts the site and runs its server code. Sees every request, and supplies the country a visit is recorded with. Vercel also keeps its own aggregate traffic counts on the public pages, including the tools, but not on this page or behind a sign-in.

Supabase

The database behind everything this site records. Reachable only with a server-side key that never reaches a browser.

Web3Forms

Delivers form submissions to my inbox. Receives whatever you typed into the form.

Anthropic

Provides the Claude model behind the assistant. Receives your question and the context needed to answer it.

Google

Tag Manager and Analytics, as described above. Calendar, only when you book a call: it receives the event, your name, your email address and your notes.

Microsoft

Clarity, as described above.

Meta

The Meta Pixel, as described above.

LinkedIn

The Insight Tag, as described above.

Apollo.io

Its website tag, as described above.

GitHub

Holds the site's source code. No personal data from this site is sent there.

Meta and LinkedIn are advertising networks, and Apollo.io is a business-contact database. I do not sell, rent or trade your details to them or to anybody else.

Several of these companies process data outside India, mostly in the United States. The Act allows that, except to countries the Government of India restricts.

What

Kept for

Why that long

This site's visit records

180 days

The identifier has already rotated daily, so an old row answers no question worth keeping it for.

Assistant conversations

365 days

These carry text you typed. A year is long enough to see what my pages keep failing to explain.

Enquiries and applications

Until you ask me to delete it

A real enquiry must not be lost to an automated job. There is a copy in my inbox either way.

Download requests

Until you ask me to delete it

It records what you asked for and that you gave your address for it.

Booked calls

Until you ask me to delete it

A record of a conversation. Cancelled bookings are kept as cancelled rather than erased.

Seats and course work

Until you ask me to delete it

A participant record outlasts the cohort. Withdrawn seats are kept deliberately.

Google Analytics

At most 14 months

The period set in my account, within Google's limit.

Microsoft Clarity

30 days; summaries 13 months

Microsoft's own limits for recordings and for summary data.

Meta, LinkedIn, Apollo.io

Their own policies

Each company sets its own period. Follow the links below.

The first two windows are enforced by the database itself, with a floor that refuses a window shorter than thirty days, so a mistyped number cannot empty a table.

The companies' own policies: Google, Microsoft, Meta, LinkedIn, Apollo.io.

Under the Act you can ask for a summary of what I hold about you, ask me to correct or complete it, ask me to delete it, withdraw a consent you gave, and nominate someone to act for you. Email apply@thelivingcraft.ai and say which. I reply myself, and I aim to do it within thirty days. If you are not satisfied with my answer, you can complain to the Data Protection Board of India.

Deletion means deletion. The row is removed from the database, not flagged as hidden or moved to an archive. Deleting a person also removes their download requests. Deleting a participant also deletes their questionnaire answers and course work. Deleting a booking cancels the calendar event first.

Three honest limits:

• Emails you sent me, and the email copy of any form you submitted, live in my mail account and are deleted there as a separate step.
• This site's own visit records hold nothing that links back to you, so there is nothing of yours in them to return or delete.
• Google, Microsoft, Meta, LinkedIn and Apollo.io hold their data against a cookie or an account, not against your name in my records. Clearing your cookies breaks that link. For anything more, tell me and I will use what their tools allow, or contact them directly through the links above.

• No selling, renting or trading of your details.
• No automated decisions about you. Enquiries and applications are read by me.
• No marketing email without the tick box above, and none at all is being sent today.
• No third-party tags before you say yes, and none at all on the interactive tools, on this page, or behind a sign-in.

This is a professional programme for practising engineers, and it is not intended for anyone under 18. I do not knowingly collect anything from a child. If you believe a child has sent me something, write to me and I will delete it.

Everything is served over HTTPS. The database refuses every key except one held on the server, which is never sent to a browser. Access codes and reschedule links are stored only as hashes. The operator console is password-gated and excluded from search engines.

No system is perfectly secure. If you find a problem here, write to me and I will fix it and tell you what happened.

This page is versioned alongside the code it describes, and it changes when the site does. The date at the top is the date it last changed. There is no archive of earlier versions, and changes are noted here rather than announced by email.

Back to the contents

Last updated 23 October 2026. Questions about any of this, or a request to see or delete what I hold, go to apply@thelivingcraft.ai.