Privacy.

InStone is a London-based strategy and intelligence agency. This privacy policy explains what information we collect when you use this website or any of our services, how we use it, and the rights you have over it.

For the purposes of UK and EU data protection law, the data controller is InStone Agency Ltd, a company registered in England and Wales under company number 15710657, with its registered office at Amisha Court, 161 Grange Road, London, SE1 3GH.

General questions about this policy can be sent to info@instone.one and are acknowledged within 48 working hours. Formal data subject requests (access, deletion, portability) are handled under the process set out in Section 10 below and responded to within the 30-day statutory deadline.

We only collect information you volunteer through one of our forms. We do not purchase data, scrape data, or buy mailing lists.

Depending on what you sign up for, we collect some or all of the following: first and last name, email address, organisation name, role, the form field you complete when subscribing or enquiring, and the subscription or engagement you have signed up for.

For paid subscriptions and commissioned work, our payment processor additionally collects the billing information required to process your payment. We do not store your card number or payment credentials; that stays with the payment processor.

When you visit this website, our hosting infrastructure logs basic technical data (IP address, browser type, pages visited) for a short retention period, used only for security, debugging, and aggregate traffic understanding.

When you submit one of our forms, we count submissions against your IP address for a rolling hour to stop automated abuse. The address is hashed with a secret before it is stored, so the record we keep cannot be reversed to identify you or your connection. We never store the raw address for this purpose.

We use your information strictly to deliver the service you have asked for. The specific use depends on what you signed up for:

If you subscribe to a Free Brief (RedStone or BlueStone), we send you the brief every Sunday evening and nothing else, unless you separately opt in.

If you subscribe to a Specialist Brief, we send you that brief on its weekly cadence, along with necessary service communications about the subscription (renewal, billing, changes).

If you commission a study or engagement, we use your information to deliver the agreed work and to respond to anything you send us.

If you register interest in a Hub, we contact you about that Hub and no other.

If you submit a brief through our contact form, we respond to it.

That is the extent of our use of your personal information. We do not sell your personal data to third parties, and we do not share your personal information in identifiable form with advertising networks or data brokers. We may use aggregate, anonymised data to understand how our services are read and to improve them.

We do not use automated decision-making or profiling within the meaning of Article 22 of the UK GDPR. Any decisions that materially affect you (for example, refunds or scope changes on commissioned work) are made by a human.

Under UK and EU data protection law, we rely on the following legal bases to process your information:

Consent, for every email publication. You actively subscribe, and we confirm it before sending anything: after you submit the form we email you a single confirmation link, and nothing is sent until you click it. We record the date and time you confirmed, which is how we can demonstrate your consent rather than merely assert it. You can withdraw it at any time.

Contract, for paid subscriptions, commissioned studies, and engagements. We need to process your information to deliver the service you have contracted us for.

Legitimate interest, for responding to enquiries and for basic website operation. The interests balanced against yours are narrow and necessary: answering questions you have sent us, and keeping the site running.

Legal obligation, where law requires us to retain specific records (for example, accounting records for contracted work).

This website currently uses only essential cookies and equivalent local storage, the minimum needed for the site to function, such as remembering whether you have chosen light or dark mode and recording your preference on the cookie banner itself. We do not currently run any analytics or measurement tool, and we do not set any cookie for advertising, behavioural profiling, or cross-site tracking.

If we ever add optional analytics in the future, we will re-surface the banner at the bottom of the page so you can decide whether to consent, and we will update this section to name the tool used and the data it collects. Until that happens, there are no optional cookies to decline because we do not set any.

We do not sell any data gathered through cookies, and we do not share personal information with third parties for behavioural advertising or profiling.

Our email publications measure whether a message was opened and whether a link in it was clicked. We use this to understand which coverage readers find useful and whether our email is arriving at all. It is not used to build a profile of you, it is not shared with anyone, and it never affects what you are sent.

Opens are measured with a single transparent image, one pixel square, included in the message. If your email client blocks images, which many do by default, the open is simply never recorded and nothing else changes.

Clicks are measured by routing links through links.mail.instone.one before forwarding you to the destination. The destination is unchanged; only the path to it is measured.

Two honest caveats. Open figures are unreliable by nature: some clients pre-fetch images and register an open you never made, others block them and register nothing. And unsubscribe links are deliberately excluded from measurement, so leaving the list is never counted as engagement.

If you would rather not be measured at all, blocking images in your email client stops open tracking, and you are always free to unsubscribe with one click. If you want us to exclude your address from measurement entirely, email info@instone.one and we will do it.

We rely on a small number of standard infrastructure providers to deliver our services. Each processes data on our behalf under a written data processing agreement, uses your information only for the purpose we contract them for, and is never permitted to use it for their own purposes.

The processors we use as of the last updated date at the top of this policy:

Netlify (US, EEA hosting available): serves this website and stores short-lived request logs used for security and debugging.

Supabase (EU-hosted): stores our subscriber lists, engagement contact details, and the database that backs our internal tools.

Resend (EU-hosted): delivers our publications and transactional email. Stores subscriber email addresses and delivery event history.

Stripe (UK and EU-regulated): processes payment for paid subscriptions and commissioned work. Stores billing details; we do not see or store your full card number.

Google Workspace (Ireland): hosts our team email inbox at info@instone.one and the aliases we send publications from. Receives and stores any replies you send us.

If we add, remove, or replace any processor, we will update this list before the change takes effect. If you want the specific subprocessors that any of the above use internally (for example, cloud hosting under Resend), email info@instone.one and we will tell you.

Some of our processors may store or process data outside the United Kingdom and the European Economic Area. Where that happens, we rely on the safeguards that UK and EU law require: adequacy decisions, Standard Contractual Clauses, or equivalent mechanisms.

We do not transfer personal data to jurisdictions without adequate safeguards in place.

We protect your information with the standard technical and organisational measures you would expect from a professional services agency: transport encryption, access control on administrative tools, and principle-of-least-privilege on who can see what internally.

No system is ever completely secure. If a breach occurs that puts your personal data at material risk, we will notify you and the relevant regulator in line with our legal obligations.

Under UK and EU data protection law, you have the following rights over the information we hold about you:

The right to know what we hold, and to be given a copy.

The right to have inaccurate information corrected.

The right to have your information deleted, subject to any legal retention requirement.

The right to restrict or object to our processing.

The right to have your information transferred to another provider in a machine-readable format.

The right to withdraw consent at any time, without needing to give a reason.

To exercise any of these rights, email info@instone.one. We respond within 30 days of receipt and will not charge you for doing so.

You also have the right to complain to the Information Commissioner's Office (ICO) in the UK, or to your local data protection authority in the EU, if you believe we are not handling your information properly. We would prefer you tell us first so we can fix it.

We keep your information only for as long as we need it for the purpose you gave it to us. In practice that means:

Publication subscribers: for as long as you remain subscribed. When you unsubscribe we do not delete your record. We keep your email address with consent marked as withdrawn, so that we have evidence of when consent was given and withdrawn, and so that a later import cannot accidentally add you back. That suppression record is kept until you ask us to erase it outright, which we will do on request.

Enquirers: for two years after your last contact with us, after which we archive or delete.

Engagement and commissioned work clients: for the duration of the engagement, plus the period required by tax, company, and contract law (typically six years under UK rules).

If you ask us to delete your data sooner, we do so, except where we are legally required to retain it.

We update this policy from time to time as our services or the law change. Material changes will be announced to subscribers by email before taking effect.

The date at the top of this page shows when we last updated it. Older versions are available on request.

Questions, requests, or complaints about this policy or how we handle your data can be sent to info@instone.one.

Response times: general enquiries acknowledged within 48 working hours. Formal data subject requests handled within the 30-day statutory deadline (see Section 10).

If you would like this policy in a different format (large print or plain text), email us and we will send it.