Last updated 6 November 2026
Privacy
This page explains what this site collects about you, why I collect it, who else handles it and how long I keep it. Everything here is true of how the site works today.
If anything is unclear, email me at hello@niccjohnson.com and I'll explain.
Who is responsible for your data
I am. I'm Nicc Johnson, and in GDPR terms I'm the data controller for everything this site collects. I'm based in Spain.
For anything about your data, including the requests further down this page, email hello@niccjohnson.com. It comes straight to me.
What I collect, and why
It depends on what you do here. Each part below says what I keep, what I use it for and the legal basis for it.
Where the basis is your request, I mean the GDPR's basis for doing what a person has asked for, such as sending them a file.
When you browse the site
The site counts its own visits. It uses no cookies and no outside analytics company.
It records each page you view, and a few actions, such as opening a form or reaching its next step. For each one it keeps the page address, the page you came from, any campaign tags in the link and the country your visit came from.
It also records the description your browser sends of itself, and the browser, system and device type read from it. Some actions add a choice you made, such as a revenue band or your Business Health Check result. Never your name, your email or anything you type.
Your IP address is never stored. The country comes from a header my host adds to each visit. Two random IDs link your page views together. One lasts for your visit. The other changes every day, so it can't follow you from one day to the next.
The legal basis is my legitimate interest in seeing which pages work. The counter isn't built to tell me who you are.
If you join The Drop by email
Your email address, where you joined and when. I use it to send you a welcome email, then The Drop every week. I also keep a record of which issue went to which address, so nobody gets the same one twice. If a send fails, I note that too.
Every email carries your own unsubscribe link, and mail apps get a one-click unsubscribe button too.
The legal basis is your consent, which you give by signing up. Unsubscribing withdraws it.
If you join The Drop on WhatsApp
You message JOIN to my WhatsApp number, then reply YES to confirm. I keep your phone number, your WhatsApp profile name, where you joined and the messages we exchange.
Each week I send The Drop there. WhatsApp reports back whether it was delivered and read, and I keep that too. If you reply to an issue, your message and our last few messages come to me by email, so I can answer you.
If you never reply YES, your number and messages are deleted after 48 hours. Send STOP at any time and the messages stop.
The legal basis is your consent, which you give by replying YES. Sending STOP withdraws it.
If you get the Claude Builder Kit
The kit unlocks when you join The Drop, by email or on WhatsApp, so everything above applies. Your download link carries a code worked out from your email, or your number on WhatsApp. Never the address or number itself.
If you tell me which skill you'd like next, I keep your request, the category you picked and your email, so I can send you the skill.
The kit's health check skill sends your answers to this site to be scored. Nothing from it is stored.
The legal basis for The Drop is your consent. For a skill request, it's your request.
If you take the Business Health Check
Your answers are scored in your browser. They aren't stored anywhere unless you do one of two things.
If you go on to book a call, your result travels with the booking, as described below.
If you ask me to email your result, I keep your email, your answers, your result and your spend check answers if you gave them. I send your result, then four short notes over the next two weeks, as the line by the button says. The notes stop if you unsubscribe, book the free call or book the FOG® Diagnostic, and I stop them by hand once you reply. I get a copy of each result by email, so I have the context if you write back.
The legal basis for the result email is your request. For the four notes, it's your consent, which you give by asking for your result with that line in view. The link in every note withdraws it.
If you ask for Introduction to the FOG®
Your email, the page you asked from and any campaign tags in the link. I email you a link to the PDF. It doesn't add you to any list.
The legal basis is your request.
If you answer Find your path
Find your path, on the Work page, asks six questions. What your business does, roughly what it brings in a month, how big the team is, what's in the way, whether your next move is clear, and your email. I keep your answers, the offer they point to, the page, any campaign tags and whether my email went out.
Then I email you a breakdown of your options. From €20K a month, you're also offered a call, with your answers added as notes on the booking. Under €20K, the email brings free tools instead.
The legal basis is your request.
If you ask for the case study deck
Your name, what your business does and your email, plus the page and any campaign tags. I use them to email you the deck.
The legal basis is your request.
If you book a call
The booking popup asks what your business does, what it brings in a month, how big the team is, what's in the way and whether your next move is clear. Then your name, email and website. If you took the Business Health Check first, your answers and result come too. I keep all of it, with the page you booked from and any campaign tags, so I can prepare for our call.
The calendar is run by Cal.com, a US company, and what you enter there is kept by Cal.com in the United States. The EU's standard contractual clauses in Cal.com's data processing agreement cover that transfer. Your name and email are filled in for you, and your answers go in as notes on the booking.
When you book the free call, Cal.com tells this site your email and the booking time. I keep that record, so any Business Health Check notes you're getting stop, and start again if you cancel the call.
If your business brings in under €20K a month, the popup offers free tools instead of a call. If you leave your email for them, I keep it with what your business does and its revenue band, and email you the tools.
When you book the 90-minute FOG® Diagnostic and it's paid, Cal.com tells this site your name, email, time zone and booking time. The site then emails you a short brief to fill in before we meet. If it ever finds no payment, it holds the brief and tells me instead.
The legal basis is taking the steps you asked for before we work together.
If you pay me
If you book the FOG® Diagnostic directly, a short form first asks for your name, email, website and monthly revenue. I keep these as a lead before you pay, with the page you booked from and any campaign tags, so I can follow up if the payment doesn't go through. The legal basis is taking the steps you asked for before we work together.
Then the 90-minute calendar opens with your name and email filled in, and your website, revenue band and the page you booked from as notes on the booking. You pick a time, then pay on Cal.com's booking page, which takes the payment through Stripe. Your card details go to Stripe and never reach me or this site.
Once the booking is paid, Cal.com tells the site. I keep a record of it with your email, the amount, the currency, the date and the references Cal.com and Stripe give the booking and the payment. I also get an email about it with your name, email address, booking time and the notes on your booking. That record is how the site knows your pre-call brief can go out.
Cal.com and Stripe also handle your payment under their own privacy notices.
The legal basis is our contract. I keep the payment record because tax law requires it.
If you email me
If you email me, or reply to one of my emails, I keep our conversation so I can answer and follow up.
The legal basis is my legitimate interest in replying to you.
Keeping the forms safe
To stop the forms being misused, I limit how often one connection can use them. To do that, I keep a fingerprint of your IP address with what you send. It's made with a one-way hash, and the address itself is never stored.
The fingerprint still counts as personal data, so it's kept and deleted with the rest of your entry. The legal basis is my legitimate interest in protecting the forms.
Cookies and browser storage
This site sets no cookies of its own, and there's no cookie banner. It keeps four small things in your browser.
- _a_sid, in session storage. The visit counter's ID for your visit. It renews after 30 minutes without activity and goes when you close the tab.
- _a_sts, in session storage. The time of your last page view, so the visit ID knows when to renew.
- _a_vid, in local storage. The visit counter's daily ID, with today's date. A new one replaces it on your first visit each day.
- fogLocatorAudit, in session storage. Your Business Health Check result, held between finishing the check and booking a call, so the booking can bring it along. It's cleared once you book.
- fogCheckout, in session storage. Your name, email, website and revenue band from the buy form, kept while the 90-minute calendar is open. If you close it without booking, the free call is offered with them filled in. It's cleared once you book the session or the free call, or close the offer, and goes when you close the tab.
Clearing this site's data in your browser removes all four.
Some pages show things from other companies. Those can set their own cookies, or see your IP address, when they load. Each handles that under its own privacy notice.
- Spotify, the playlist on The Drop page. Spotify may set its own cookies when the player loads.
- YouTube, the TEDx talk on the About and Press pages. It uses YouTube's privacy-enhanced player, which YouTube says sets no cookies until you press play.
- Cal.com, the booking calendar. Its script only loads when you open the calendar, and it may set its own cookies then.
- Google Fonts, on the Vinyl Collection pages. Those pages load their fonts from Google, so Google sees your IP address. Track previews there use YouTube's privacy-enhanced player and only load when you pick a track.
Everywhere else, the site serves its own fonts, so no font company sees your visit.
Who else touches it
I keep the list short. These companies handle data for this site, each for one job.
- Vercel, hosts and runs the site. Every visit passes through it, and its server logs can include what you send through a form.
- Supabase, the database where the site keeps what it collects.
- Resend, sends every email from this site.
- Kapso, connects the site to WhatsApp for The Drop.
- WhatsApp, run by Meta, carries The Drop's messages.
- Cal.com, runs the booking calendar.
- Stripe, takes payments.
- ImprovMX, forwards email sent to hello@niccjohnson.com to my inbox.
- My email provider, holds your emails to me and the notes the site sends me.
- Spotify, YouTube and Google Fonts, the embeds described above.
Stripe, WhatsApp and the embed companies also use some data for their own purposes, under their own privacy notices.
I don't sell your data, and I don't share it with anyone for their marketing.
Where it lives, and for how long
My database runs on Supabase, in its Paris region, inside the EU. Some of the other companies above are based outside the EU, so some of your data may be handled outside it too. Email me and I'll tell you which safeguards cover it.
This is how long I keep each kind.
- The Drop, by email or on WhatsApp, until you leave. After that I keep your address or number marked as unsubscribed, so a form can't sign you up again by mistake. Ask, and I'll delete it completely.
- Unconfirmed WhatsApp signups, 48 hours, then deleted automatically with their messages.
- Messages and send records, for The Drop by email and on WhatsApp, up to 24 months.
- Health check results, form answers and booking details, up to 24 months, so I can pick a conversation back up where it stopped.
- Visit counts, up to 24 months, then deleted.
- Payment records, as long as tax law requires.
- Emails between us, up to 24 months after we were last in touch.
- Vercel's server logs, for the limited time Vercel keeps them.
Unless the law says I must keep something, I'll delete it sooner if you ask.
Your rights
Under the GDPR you can ask me to show you what I hold about you, correct it, delete it, or give it to you in a form you can take elsewhere. You can ask me to limit what I do with it or object to it, and you can always object to marketing. Where I rely on your consent, you can withdraw it at any time. Withdrawing doesn't affect what I did before.
One email to hello@niccjohnson.com is enough. No form, no process. I'll answer within one month.
If you want to complain
You can complain to your local data protection authority (in Spain, the AEPD). I'd be grateful for the chance to put it right first, so please email me too.
Automated decisions
The booking popup and Find your path both ask what your business brings in a month. Under €20K a month, they offer free tools instead of a call. That's the only automated decision on this site.
It has no legal effect, you can still email me, and I read every booking myself. The Business Health Check works out a phase from your answers, but that only shapes the result and notes you see.
Changes to this notice
If I change what this site collects, I change this page in the same release and move the date at the top. I won't quietly widen what I do with data you've already given me.