Privacy
What I store, and why
Last updated 3 August 2026
The short version. One cookie, from Google Analytics, and only if you tick accept when the bar appears. Say no and nothing is set. No ad pixels, no Meta pixel, no LinkedIn tag, no session recording, and nothing that follows you to other sites.
The rest is a single table of events on my own database, and it exists so I can tell which parts of the site work. Here is all of it.
Who is asking
Merlijn Linschooten, trading as Merlijn Consultancy, based in the Netherlands. I am the controller of everything described here, and I am one person, so the answer to "who has access" is me. Reach me at info@merlijnconsultancy.com.
What the site records on its own
On every page, without you doing anything:
- Which page you landed on, and where you came from if a link told me.
- Which buttons and links you click.
- A random session id, kept in your browser's session storage so one visit reads as one visit. It is not a cookie, it carries no name, and it disappears when you close the tab.
- Your IP address reaches my server, as it does with any website. I do not store it in the events table. It is used in memory to stop one machine hammering the API, and my hosting provider keeps its own request logs.
Lawful basis: legitimate interest. Running a site badly and never finding out is not a strategy, and none of the above identifies you.
What the diagnostic records
If you run the diagnostic at /diagnostic, I also keep:
- The three choices you make in the opening sentence.
- Every question you were asked and every answer you gave, in full.
- The scorecard that came out of it.
- Your email address and your URL, but only if you type them in.
Lawful basis for the conversation: legitimate interest again, and you can stop at any point by closing the tab. Lawful basis for your email: you handed it over to get the read, which is a request you made of me. I use it to reply to you personally. That is the whole point of the thing.
The marketing emails
There is one checkbox at the email step, and it starts unticked. Leave it alone and you will never hear from a list. Tick it and you get the occasional deep tech marketing read, a few times a year.
Lawful basis: consent, and only consent. Which means three things. Ticking it is never a condition of getting your score, so you lose nothing by leaving it. Every one of those emails carries a one-click unsubscribe. And you can withdraw at any time by replying to any of them or emailing me, with no effect on anything else described here.
I keep a record of what you agreed to: the exact sentence that was next to the checkbox, its version, and when you ticked it. That is so I can show what was actually consented to rather than asking you to take my word for it.
Cookies, and the one that exists
There is exactly one, and it only appears if you accept it. On your first visit a bar asks whether Google Analytics may run. Accept and Google sets its cookie and receives data about your visit, including your IP address. Decline and no script loads, no cookie is set, and nothing is sent. The bar does not come back either way.
Lawful basis: consent. Which is why nothing loads before you answer, rather than loading and asking afterwards, and why the two buttons are the same size. A choice where one option is easier than the other is not a choice.
Changed your mind? Clear my choice and ask me again. Your browser will also drop it if you clear site data.
The first-party events described above are not covered by that bar, because they set no cookie, never leave this domain, and go to nobody but me.
Who else touches it
Five companies, each doing one job:
| Who | What they do with it |
|---|---|
| Vercel | Hosts the site and runs the code. Sees the requests, keeps its own logs. |
| Neon | Hosts the database the events table lives in. |
| Anthropic | Runs the model that reads your answers during the diagnostic and writes the scorecard. Your answers are sent to it to do that. |
| Resend | Delivers the one email that goes to me when you finish. No email is ever sent to you by a machine. |
| Analytics, and only if you accepted the bar. Receives your IP address and what you did here. Decline and no analytics script loads and no cookie is set. One exception worth naming: the two teardown samples load a typeface from Google, so opening one reveals your IP to them whatever you chose. Every other page serves its own fonts. |
Some of them process data outside the European Economic Area. Where that happens it runs on the European Commission's standard contractual clauses. I do not sell anything to anyone, and there is no advertising network involved at any point.
How long I keep it
Analytics events: two years, then they go. Diagnostic conversations and email addresses: two years from your last visit, which is about as long as a conversation stays plausibly alive. If you become a client, the contract takes over and the usual business record rules apply.
Your rights, in plain words
- Ask me what I hold about you, and get a copy.
- Ask me to correct it.
- Ask me to delete it. I will, and I will tell you when it is done.
- Ask me to stop using it, or object to the legitimate interest basis above.
- Ask for it in a portable format.
One email to info@merlijnconsultancy.com does any of these. No form, no ticket, no verification ritual beyond checking you are who you say you are. I aim to answer within a few days and the legal ceiling is one month.
If I get it wrong, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. I would rather you told me first.
Changes
If this page changes in a way that matters, the date at the top changes with it.