Catherine Ives-YimIndependent Technical Adviser

Privacy

Privacy notice

What this site collects, why, where it is kept and how to have it removed.

This notice covers ives-yim.org.uk, including the AI Ladder Check, the Technology Risk Snapshot, the Strategic Deficit Check and the CRA Readiness Check, the Technical Leadership Check and the occasional letter. The controller is Catherine Ives-Yim, independent technical adviser, Leeds. Contact: [email protected]. Last updated 5 October 2026.

Reading the site

The site sets no cookies and uses no analytics or advertising trackers. Fonts and scripts are served from this site only. The site is hosted and delivered by Cloudflare, which processes your IP address and the pages you request in order to deliver the site and protect it from attacks, and keeps short-lived logs for security and troubleshooting. The lawful basis is my legitimate interest in running a secure website.

The questionnaire tools

All the questionnaire tools work the same way. Your answers stay in your browser. So that you can pick up where you left off, your progress is saved in your browser’s local storage on your device. It is never sent to me, and starting again or clearing this site’s data in your browser removes it. This storage is strictly necessary for the check to work, so it does not need consent. Nothing is sent anywhere unless you choose one of the two options below.

AI-written briefing (optional). If you ask for it, your answers (no name or contact details) are sent to a small service hosted by Supabase in the EU (Ireland), which passes them through OpenRouter to an AI model provider that does not use the data for training. The briefing is kept for 7 days so it can be included if you then ask for your result by email, and is then deleted. The lawful basis is my legitimate interest in providing the briefing you asked for.

Email me my result (optional). If you ask for your result by email, I keep your name, email address, organisation and role (if given), your answers and your result. The email is sent through Resend, an email delivery service. A copy goes to me, and I may contact you once about your result. The lawful basis is your consent, which you give by ticking the box, and you can withdraw it at any time.

Ask my writing

If you use Ask, your question (and, for follow-up questions, your earlier questions and answers in the same visit) is sent to a service hosted by Supabase in the EU (Ireland), which passes it with the text of my published articles through OpenRouter to an AI model provider that does not use the data for training. The question, and any optional context you add (your role, organisation type and size, and a short note), is kept for 30 days so I can see what people ask and improve the site, then deleted. So that a retrieval (RAG) answer is ready if you choose to compare, each question is also turned into a numerical search fingerprint inside the same Supabase service to find matching passages, and a second answer is written from them; the fingerprint is not kept, and the second answer is only shown if you ask for it. Please do not include personal or confidential details. The lawful basis is my legitimate interest in answering your question and improving the site.

The MCP server. The read-only MCP server at /mcp/ lets an AI assistant read the articles and score an assessment. It records a count of calls per hour against a one-way hash of the calling address, kept for two days, for the rate limit. Assessment answers sent to it are scored and returned, not stored. No names, email addresses or conversation content reach it.

Abuse protection. To prevent misuse, the Ladder Check, Snapshot, Strategy Check, CRA Check and Ask services record a one-way hash of your IP address (not the address itself) for up to 30 days. Ask also uses Cloudflare Turnstile, which checks silently in your browser that you are a person and not an automated script before your first question; it looks at browser and network signals and does not identify you or show you a puzzle. Cloudflare processes this under its Turnstile Privacy Addendum. The lawful basis is my legitimate interest in keeping these services available and preventing abuse.

The occasional letter

If you sign up on the Follow page, I keep your email address, when you signed up and confirmed, and the page you signed up from. Nothing is sent until you confirm by opening the link in the confirmation email and pressing Confirm; an unconfirmed sign-up is deleted after 7 days. Emails are sent through Resend. Every letter has a one-click unsubscribe; once you unsubscribe, your address is deleted within 30 days. To limit misuse of the form, a one-way hash of your IP address and of the email address is kept for 2 days. The lawful basis is your consent, which you can withdraw at any time.

Who processes your data, and where

I use these service providers, each under its own data processing terms:

  • Cloudflare delivers the website and runs the Turnstile bot check on Ask. It is a US company with a global network, so your requests may be handled outside the UK.
  • Supabase hosts the Ladder Check, Snapshot, Strategy Check, CRA Check and Ask services and their data, in the EU (Ireland).
  • OpenRouter and the AI model provider it routes to (currently Anthropic, the maker of Claude) are based in the US. They process your answers or questions to write a response and do not use them for training.
  • Resend sends emailed results and the occasional letter. It is a US company.

Where personal data goes outside the UK, it is protected by the UK’s adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or by the International Data Transfer Addendum to the EU standard contractual clauses in the provider’s data processing terms.

How long it is kept

Details from emailed results are kept for up to 12 months and then deleted automatically. Stored briefings are deleted after 7 days, and questions asked through Ask after 30 days. Letter subscriptions are kept until you unsubscribe.

Your rights

You can ask for a copy of your details, ask me to correct them, or ask me to delete them, at any time: reply to the email you received, or write to [email protected]. I do not sell or share your details. Nobody is added to the letter unless they sign up and confirm it themselves. If you are unhappy with how your data has been handled, you can complain to the Information Commissioner's Office (ico.org.uk).

Booking a call

Booking links go to Calendly, which has its own privacy notice.