Privacy Policy & Disclaimer.

Everything on this site is written by me in a personal capacity. It represents my own opinions and experience, not those of my employer, my colleagues, or any client, and nothing here should be read as an official position of any organisation I work for or with.

I work in risk advisory by day and write about AI here at night. Where the two subjects overlap, as they often do, I am writing as myself and drawing on publicly available material. I do not write about my employer's work, clients, or internal matters.

The courses, projects and writing here are educational. They are not legal, regulatory, compliance, audit, financial or investment advice, and they do not create any professional relationship between us.

Some of what I write touches on governance and regulatory frameworks because that is the world I work in. Those frameworks change, they differ by jurisdiction, and your situation is not mine. If you are making a decision that carries real consequences, talk to someone qualified who knows your circumstances.

My courses ask you to install software, run commands and publish things to the internet. I have tested what I describe, but I cannot test it on your machine, your account or your network, and tools change after I write about them.

Read what you are about to run before you run it. That is genuinely good practice rather than a formality, and it is a habit I teach in the courses themselves. Everything here is offered as is, with no warranty, and you are responsible for what you choose to do on your own systems and accounts.

This site does not collect anything about you. To be specific about what that means:

• No analytics of any kind, and no tracking pixels
• No cookies, and nothing stored in your browser
• No forms, accounts, sign ups or comments
• No advertising, and nothing sold or shared with anyone
• No third party requests. Fonts are served from this site rather than loaded from Google, so visiting a page contacts nobody but this domain

There is no consent banner here because there is nothing to consent to. If that ever changes, so will this page.

This site is hosted by Vercel. Like every web host, their servers record standard technical information when a page is requested, which typically includes your IP address, the page you asked for, the time, and your browser type. That happens for delivery, security, and to keep the site running, and it is the only personal information involved in an ordinary visit. I do not use it to build a profile of you and I do not combine it with anything else.

Where that data sits matters, so I will be specific. Vercel serves this site from a global network, and requests from Canada are usually handled close by, but Vercel is a company based in the United States and technical log data may be stored or processed outside Canada. While it is outside the country it is subject to the laws of wherever it sits, which can include lawful access by foreign courts and government agencies. That is true of most of the web, and I would rather say it than leave you to assume otherwise.

My email address is published on this page and on the About page. If you write to me, I will have whatever you send: your address, your name if you give it, and the content of your message. I use it to reply to you and for nothing else. I will not add you to a mailing list, because there is not one, and I will not pass your message on.

Email is not a secure channel. Please do not send me anything confidential, and particularly not anything belonging to your employer or your clients.

I do not send newsletters or marketing email, and you cannot be subscribed to anything here. If I ever add a newsletter, it will be express opt in, it will say clearly who it is from, and every message will carry a working unsubscribe link, as Canada's anti spam legislation requires. I will not import addresses from people who emailed me.

I am in Ontario, Canada, so the relevant federal law is the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA governs how organisations handle personal information in the course of commercial activity. This site is free, sells nothing and runs no commercial operation, so it sits outside that threshold. Ontario has no separate private sector privacy law of its own, so nothing further applies at the provincial level.

I have written this policy to the PIPEDA standard regardless. Whether a technical exemption applies is far less useful to you than simply knowing what happens to your information, which is the point of the page.

Readers elsewhere are welcome and their law travels with them. If you are in the United Kingdom or the European Union, the UK GDPR and the GDPR give you rights over your personal information regardless of where I am. If you are in Quebec, British Columbia or Alberta, those provinces have their own private sector privacy statutes. In every case the practical answer is the same, because the only personal information I am ever likely to hold is an email you chose to send me.

You have the right to ask what personal information I hold about you, to have it corrected, to have it deleted, and to object to how it is used. To do any of that, or to have our correspondence deleted, email me and ask. I will not charge you and I will not make it difficult.

If you are not happy with how I have handled something, you can complain to a regulator. In Canada that is the Office of the Privacy Commissioner of Canada. In the UK it is the Information Commissioner's Office, and in the EU it is your national data protection authority.

This site is written for adults and is not directed at children. I do not knowingly collect information about anyone, which includes children.

This site links out to other people's work: courses, essays, tools, and my own projects on other domains. Once you follow a link you are on someone else's site, under their terms and their privacy practices, not mine. A link is a recommendation to read something, not an endorsement of how that site handles your data.

The same goes for my profiles on LinkedIn and Instagram, which are run by those companies under their own rules.

If I add anything that changes the answers here, such as a newsletter, a community, or analytics, I will update this page and change the date at the top before it goes live rather than after. Until then, what is written above is what happens.