How Loopwork handles personal data.

Pivot Ideas Ltd is the data controller.

Loopwork is the brand under which Chris Leo offers AI user‑centred design services and publishes essays. The site is operated by Pivot Ideas Ltd, a company registered in England and Wales, which is the data controller for personal data processed here.

You can reach the data controller at hello@theloopwork.co.uk. That address forwards to Chris's working inbox via Cloudflare Email Routing. No mailbox is kept on the loopwork.co.uk domain.

Five small kinds of data, each with one purpose.

Analytics

The site uses Cloudflare Web Analytics. It records page views, referrers, and rough country-level location. No cookies are set. No data is shared with third-party advertisers. There is nothing to opt out of because there is nothing tracking you across sessions.

Newsletter

If you subscribe to the publication newsletter, your email address is held by Buttondown, the newsletter platform. Buttondown stores your address and tracks opens at the per-email level. You can unsubscribe from any email. That removes you from the list immediately.

Diagnostic and Explorer reports

The Diagnostic and Explorer tools save your completed report to a private Cloudflare KV store, keyed by a random UUID. The URL you receive is the only way to retrieve it. If you ask for the report by email at the end, the email address is used once to send the link and is not retained.

AI assessment

When you use the AI‑assisted variant of a tool, the text you type for one question or one task is sent to the Anthropic API to produce a suggestion. The text is processed transiently for the single call and is not retained by Loopwork or by Anthropic beyond the response. No conversation history is kept.

Inbound email

If you email hello@theloopwork.co.uk, the message is forwarded to a personal inbox via Cloudflare Email Routing and read directly. The email content is treated as confidential and kept only as long as is needed to handle your request.

Retention, in plain numbers.

• Analytics: aggregated counts only, no individual records.
• Newsletter address: held until you unsubscribe.
• Completed reports: kept in KV for twelve months from creation, then deleted. If you want yours sooner, email the data controller with the report URL.
• AI calls: not retained beyond the single response.
• Inbound email: kept while needed to handle your request. Deleted from the working inbox once the matter is closed.

Why each kind of data is processed.

• Analytics: legitimate interest in understanding how the site is used. No personal identifiers are collected.
• Newsletter: consent. You opt in by subscribing. You withdraw by unsubscribing.
• Reports and AI calls: performance of a service at your request. The data is processed only to produce the report you asked for.
• Inbound email: legitimate interest in responding to enquiries.

UK GDPR rights, and how to use them.

Under UK GDPR you have the right to ask what data is held about you, to have it corrected, to have it deleted, to restrict how it is processed, and to receive a copy in a portable form. You also have the right to object to processing where the lawful basis is legitimate interest.

Email hello@theloopwork.co.uk to exercise any of these rights. Requests are handled within one calendar month and are free of charge.

If you are not satisfied with how a request is handled, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

Changes show in the date at the top.

Material changes are noted in the next newsletter. Minor edits update the date silently. There is no version archive. This page is the current statement.