Privacy.

InStone is a London-based strategy and intelligence agency. This privacy policy explains what information we collect when you use this website or any of our services, how we use it, and the rights you have over it.

For the purposes of UK and EU data protection law, the data controller is InStone Agency Ltd, a company registered in England and Wales under company number 15710657, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

General questions about this policy can be sent to info@instone.one and are acknowledged within 48 working hours. Formal data subject requests (access, deletion, portability) are handled under the process set out in Section 10 below and responded to within the 30-day statutory deadline.

We only collect information you volunteer through one of our forms. We do not purchase data, scrape data, or buy mailing lists.

Depending on what you sign up for, we collect some or all of the following: your name, email address, organisation name and the kind of organisation it is, what you write in the form, the rough budget and timeline if you choose to give them, how you heard about us if you tell us, and the publication, subscription or service you are asking about.

If someone buys a paid subscription with more than one seat, they give us the email address of each person who will receive it. If your address reached us that way, it is used only to send you that brief and its service messages, and you can unsubscribe yourself at any time.

For paid subscriptions and commissioned work, our payment processor additionally collects the billing information required to process your payment. We do not store your card number or payment credentials; that stays with the payment processor.

When you visit this website, our hosting infrastructure logs basic technical data (IP address, browser type, pages visited) for a short retention period, used only for security, debugging, and aggregate traffic understanding.

When you submit one of our forms or rate a brief, we count the requests that come from your IP address, and those made for an email address and its domain, over a rolling period of between an hour and 30 days, to stop automated abuse. Each is hashed with a secret before it is stored, so the record we keep cannot be reversed to identify you or your connection. We never store the raw IP address or email address for this purpose.

We use your information strictly to deliver the service you have asked for. The specific use depends on what you signed up for:

If you subscribe to a Free Brief (RedStone or BlueStone), we send you the brief every Sunday evening and nothing else, unless you separately opt in.

If you subscribe to a Specialist Brief, we send you that brief on its weekly cadence, along with necessary service communications about the subscription (renewal, billing, changes).

If you commission a study or engagement, we use your information to deliver the agreed work and to respond to anything you send us.

If you registered interest in one of our Hub evenings, we contact you about that Hub and no other.

If you submit a brief through our contact form, we respond to it.

If you rate an issue of a brief from the link in the email, we record your score for that issue, to learn which issues readers find useful.

That is the extent of our use of your personal information. We do not sell your personal data to third parties, and we do not share your personal information in identifiable form with advertising networks or data brokers. We may use aggregate, anonymised data to understand how our services are read and to improve them.

We do not use automated decision-making or profiling within the meaning of Article 22 of the UK GDPR. Any decisions that materially affect you (for example, refunds or scope changes on commissioned work) are made by a human.

Under UK and EU data protection law, we rely on the following legal bases to process your information:

Consent, for every email publication. You actively subscribe, and we confirm it before sending anything: after you submit the form we email you a single confirmation link, and nothing is sent until you click it. We record the date and time you confirmed, which is how we can demonstrate your consent rather than merely assert it. You can withdraw it at any time.

Contract, for paid subscriptions, commissioned studies, and engagements. We need to process your information to deliver the service you have contracted us for.

Legitimate interest, for responding to enquiries and for basic website operation. The interests balanced against yours are narrow and necessary: answering questions you have sent us, and keeping the site running.

Legal obligation, where law requires us to retain specific records (for example, accounting records for contracted work).

This website sets no cookies of its own. It keeps three small items in your browser's own storage, each needed for the site to work as you would expect, and none of them sent to us: whether you chose light or dark mode (kept until you change it); that you have seen the note about cookies (kept so it does not reappear); and, while the tab is open, which Specialist Briefs you have ticked (cleared when you close the tab). We do not run any analytics or measurement tool on the website, and nothing is stored for advertising, behavioural profiling or cross-site tracking.

If you pay for a subscription, the payment page is run by Stripe on its own site, under its own cookie and privacy terms.

If we ever add optional analytics, we will ask for your consent first, in a note at the foot of the page, and we will update this section to name the tool and the data it collects. Until then there is nothing optional to decline, because nothing optional is set.

We do not sell any data gathered through cookies, and we do not share personal information with third parties for behavioural advertising or profiling.

Our email publications measure whether a message was opened and whether a link in it was clicked. We use this to understand which coverage readers find useful and whether our email is arriving at all. It is not used to build a profile of you, it is not shared with anyone, and it never affects what you are sent.

Opens are measured with a single transparent image, one pixel square, included in the message. If your email client blocks images, which many do by default, the open is simply never recorded and nothing else changes.

Clicks are measured by routing links through links.mail.instone.one before forwarding you to the destination. The destination is unchanged; only the path to it is measured.

Two honest caveats. Open figures are unreliable by nature: some clients pre-fetch images and register an open you never made, others block them and register nothing. And unsubscribe links are deliberately excluded from measurement, so leaving the list is never counted as engagement.

If you would rather not be measured at all, blocking images in your email client stops open tracking, and you are always free to unsubscribe with one click. If you want us to exclude your address from measurement entirely, email info@instone.one and we will do it.

We rely on a small number of standard infrastructure providers to deliver our services. Each processes data on our behalf under a written data processing agreement, uses your information only for the purpose we contract them for, and is never permitted to use it for their own purposes.

The processors we use as of the last updated date at the top of this policy:

Netlify (US, EEA hosting available): serves this website and stores short-lived request logs used for security and debugging.

Supabase (servers in London): stores our subscriber lists, enquiries, engagement contact details, and the database that backs our internal tools.

Resend (EU-hosted): delivers our publications and transactional email. Stores subscriber email addresses and delivery event history.

Stripe (UK and EU-regulated): processes payment for paid subscriptions and commissioned work. Stores billing details; we do not see or store your full card number.

Google Workspace (Ireland): hosts our team email inbox at info@instone.one and the aliases we send publications from. Receives and stores any replies you send us.

If we add, remove, or replace any processor, we will update this list before the change takes effect. If you want the specific subprocessors that any of the above use internally (for example, cloud hosting under Resend), email info@instone.one and we will tell you.

Separately, a few things on this website are loaded by your browser straight from another organisation's servers, which therefore see your IP address and browser details when they send them, as with any website: the typefaces, from Google Fonts (Google); the paintings beside each essay, from Wikimedia Commons (the Wikimedia Foundation); and, after you rate a brief, one picture from GIPHY. We send them nothing about you, and none of them sets a cookie through this site.

Some of our processors may store or process data outside the United Kingdom and the European Economic Area. Where that happens, we rely on the safeguards that UK and EU law require: adequacy decisions, Standard Contractual Clauses, or equivalent mechanisms.

We do not transfer personal data to jurisdictions without adequate safeguards in place.

We protect your information with the standard technical and organisational measures you would expect from a professional services agency: transport encryption, access control on administrative tools, and principle-of-least-privilege on who can see what internally.

No system is ever completely secure. If a breach occurs that puts your personal data at material risk, we will notify you and the relevant regulator in line with our legal obligations.

Under UK and EU data protection law, you have the following rights over the information we hold about you:

The right to know what we hold, and to be given a copy.

The right to have inaccurate information corrected.

The right to have your information deleted, subject to any legal retention requirement.

The right to restrict or object to our processing.

The right to have your information transferred to another provider in a machine-readable format.

The right to withdraw consent at any time, without needing to give a reason.

To exercise any of these rights, email info@instone.one. We respond within 30 days of receipt and will not charge you for doing so.

You also have the right to complain to the Information Commissioner's Office (ICO) in the UK, or to your local data protection authority in the EU, if you believe we are not handling your information properly. We would prefer you tell us first so we can fix it.

We keep your information only for as long as we need it for the purpose you gave it to us. In practice that means:

Publication subscribers: for as long as you remain subscribed. When you unsubscribe we do not delete your record. We keep your email address with consent marked as withdrawn, so that we have evidence of when consent was given and withdrawn, and so that a later import cannot accidentally add you back. That suppression record is kept until you ask us to erase it outright, which we will do on request.

Enquirers: for two years after your last contact with us, after which we archive or delete.

Engagement and commissioned work clients: for the duration of the engagement, plus the period required by tax, company, and contract law (typically six years under UK rules).

If you ask us to delete your data sooner, we do so, except where we are legally required to retain it.

We update this policy from time to time as our services or the law change. Material changes will be announced to subscribers by email before taking effect.

The date at the top of this page shows when we last updated it. Older versions are available on request.

Questions, requests, or complaints about this policy or how we handle your data can be sent to info@instone.one.

Response times: general enquiries acknowledged within 48 working hours. Formal data subject requests handled within the 30-day statutory deadline (see Section 10).

If you would like this policy in a different format (large print or plain text), email us and we will send it.