Privacy notice

This notice covers agentshed.io. It is written for UK GDPR. If a playbook tells you how to handle your own customers' data, that is guidance for your business. This notice is about people who use this website.

Who is responsible

The controller is Milo Cosemans, based in the United Kingdom. Contact: hello@agentshed.io. There is no separate company named on this page. If that changes, this notice will name the company and the company number.

What we collect

• Newsletter. The email address you type into a signup form, and the place on the site the form sat (for example the homepage or the end of a playbook).
• Feedback and contact. Whatever you type: a message, an optional name, an optional email, the page you were on, and which step you flagged.
• Server logs. A normal web host keeps IP addresses and request lines for security and debugging, for a short period. Visit counts are separate, and are described under Vercel Web Analytics and Plausible below. We do not build an advertising profile.
• A honeypot field. Forms include a hidden company field. If it is filled, the submission is treated as automated and dropped.

We do not ask for an account, and we do not buy mailing lists.

Why, and the lawful basis

• Newsletter. Consent. You can withdraw it by unsubscribing. The email we send, once Beehiiv is connected, will include that link. If you signed up before Beehiiv was connected, email hello@agentshed.io and the address will be deleted from any copy we control. A writable disk also keeps a private file. Vercel cannot write that file, so the line exists only in the function log.
• Feedback and contact. Legitimate interests: running and correcting the library. If you include an email, we use it to reply.
• Security logs. Legitimate interests: keeping the site available and diagnosing abuse.
• Visit counts. Legitimate interests: seeing which guides are opened. Vercel Web Analytics does this on the hosted site. Plausible does it only if that domain setting is filled in. Neither is an advertising tag.

We do not use your details to train a model.

Who else receives it

• Beehiiv, if BEEHIIV_API_KEY and the publication ID are set, receives the newsletter address to run the list. Beehiiv is a US company. Sending an address there is an international transfer. We rely on the provider's transfer mechanism, typically standard contractual clauses, and you can choose not to subscribe. Their own privacy notice describes their role.
• An email webhook, if one is configured, receives the same feedback JSON so it can be read. Until that is set, feedback is written to the host log and, where the disk allows, to a private file on the server. On Vercel the disk is read-only, the skipped write is logged, and the form still succeeds.
• Vercel Web Analytics. The layout loads Vercel's script. Their privacy notice, read on 25 October 2026 at vercel.com/docs/analytics/privacy-policy, says a data point is not stored against an IP address, and also says a visitor is identified by a hash of the incoming request that is discarded after 24 hours. A point can include the URL, the route pattern, the referrer, filtered query parameters, a coarse location, the device type, the operating system, and the browser. This notice repeats both points rather than smoothing them. The count is not tied to the email address you type into a form. The script does not send page views while the site is running in development.
• Plausible, only if a domain is configured in the site settings. Plausible is a cookieless analytics tool operated in the EU. It is intended to count visits without building an advertising profile. If it is not configured, the script is not on the page.
• The host. The site is built to run on Vercel. Vercel processes requests as a processor for hosting. Their terms describe that. Web Analytics is a separate product from that hosting role, and it is named above.

We do not sell personal data.

How long we keep it

Newsletter addresses stay on the list until you unsubscribe, or until we delete the list. Feedback is kept long enough to fix the page and then deleted or reduced to a note that does not need your name. Security logs follow the host's ordinary retention. Vercel says the visitor-session hash is discarded after 24 hours. This notice does not guess how long the aggregated charts stay in the Vercel project. Local development logs in .data/ are not part of the public site, and that directory is never written on Vercel.

Your rights

You can ask for a copy of your personal data, a correction, erasure, restriction, or to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it. You can complain to the Information Commissioner's Office at ico.org.uk. We would like to hear from you first, at the email above, so we can fix it.

Children

The site is written for people running a business. It is not aimed at children, and we do not knowingly collect their data.

Changes

The date on this page is the date of the current text. Material changes will be dated, not slipped in quietly.