Privacy Policy

This policy explains how I, Neil Patrick Bostick, handle personal data on npb.com (the "site"). The site is small and collects little: what you choose to send me through the contact form, standard analytics, and the technical logs every web host keeps. For any question or request, use the contact form.

1. What I collect

• Contact form. Your name, email address and reason for contact, your message, and, if you choose to add them, your phone number and LinkedIn profile URL.
• Analytics. The site uses Google Analytics 4, which sets cookies and collects information such as pages viewed, referring site, approximate location derived from your IP address, device and browser type, and time on page.
• Server logs. The hosting provider automatically records technical data such as IP address, browser type, the page requested and the time, for security and reliability.

I do not ask for sensitive information, and please do not send any. The site has no user accounts, no payments and no advertising.

2. How I use it, and legal bases

• To read and reply to your message, and to follow up on what you asked about: my legitimate interest in responding to people who contact me, or steps you ask for before entering into an agreement.
• To understand how the site is used and improve it: my legitimate interest, or your consent where the law requires consent for analytics cookies.
• To keep the site secure and stop abuse of the form: my legitimate interest.
• To meet legal obligations and respond to lawful requests.

If your message concerns one of the businesses I run, such as an M&A, domain or investment enquiry, I may pass it to that business so it can respond, and it will then handle your details under its own privacy policy. I will not add you to a mailing list because you used the contact form.

3. Who receives it

Only service providers that process data on my behalf:

• website hosting, which serves the site and keeps server logs;
• an email delivery provider, which delivers contact form submissions to my inbox (form messages are emailed, not stored in a database on the site);
• email hosting for my inbox, where your message and my reply are kept;
• Google, as the provider of Google Analytics.

I may also disclose information if the law requires it or to protect rights and safety.

I do not sell your personal information, and I do not use it for cross-context behavioural advertising. Google Analytics is used for site measurement only. Because Google receives analytics data, some state privacy laws could treat that as "sharing"; you can stop it at any time by blocking cookies for this site or installing Google's Analytics opt-out browser add-on.

4. Cookies

The only cookies on the site are the Google Analytics cookies (names beginning with "_ga"), which distinguish visitors and sessions and usually last up to two years. The site itself sets no other cookies. You can delete or block cookies in your browser settings; the site works fully without them.

5. Retention

Contact form messages stay in my email for as long as they are useful for the conversation and my records, and I delete them on request unless I need to keep them for a legal reason. Google Analytics data is kept for the retention period set in the analytics account (no more than 14 months for detailed data). Server logs are kept for the short period set by the hosting provider.

6. Security and international transfers

The site is served only over encrypted HTTPS connections, and access to my inbox and to the site's accounts is restricted. No method of transmission or storage is completely secure. I am based in the United States and my service providers process data in the United States and elsewhere. Where data comes from the EU, UK or Switzerland, transfers rely on safeguards such as Standard Contractual Clauses or the provider's certification under the EU-US Data Privacy Framework.

7. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to receive a copy of it, to object to or restrict its use, to withdraw consent, and to complain to your data protection authority. California residents also have the right to know what is collected, to opt out of sale or sharing, and not to be treated differently for using these rights. To make a request, use the contact form and say what you would like; I may need to confirm your identity, and I will respond within the time the law requires.

8. Children

The site is not directed to children, and I do not knowingly collect personal data from anyone under 16. If you believe a child has sent me information, let me know and I will delete it.

9. Do Not Track

There is no agreed standard for browser Do Not Track signals, so the site does not respond to them. You can control analytics with the cookie and opt-out choices above.

10. Changes

I may update this policy by posting a new version with a new date at the top. See also the Terms of Use.