Privacy Policy
Version 1.4 · Last updated 6 September 2026
This policy explains the limited personal data used to present The Detail Department, respond to business enquiries and hold relevant one-to-one conversations with prospective clients.
1. Who we are
The Detail Department is the working name of a pre-incorporation business project operated personally by Leon Houlier, currently based in Switzerland. No separate legal entity has yet been incorporated under this name.
For the processing described in this policy, Leon Houlier is the data controller. Privacy enquiries may be sent to leon@detail-department.com.
No data protection officer, EU representative or UK representative has been appointed.
2. Scope of this policy
This policy applies when you visit the public website, submit its contact form, email us, reply to an individual business-development message, or otherwise discuss a possible engagement.
The Detail Department does not currently have clients or contracts and does not currently process personal data inside client advertising accounts. Before that changes, the relevant company details, contracts, data-processing terms, service providers, international transfers and retention periods will be documented and this policy will be updated.
3. What we collect and why
Website visitors
The website is published on Firebase Hosting, a Google Cloud service. As the hosting provider, Google creates standard access and security logs containing an IP address, browser or device information, requested URL, timestamp and error information. These logs are used only to deliver, secure and maintain the website.
Optional website measurement
On marketing pages, “Accept all optional cookies” permits both Google Analytics 4 and advertising measurement. “Choose cookies” lets you enable either category independently, including analytics only. “Reject optional cookies” keeps both off. Public recruitment and missing pages offer “Accept analytics” and keep advertising off. Google Tag Manager is not loaded until you allow at least one category; Analytics is not loaded without an analytics grant.
When accepted, Google Analytics receives the page path, approximate location derived from the IP address, browser and device characteristics, and event timing. We also measure which sections are reached, foreground reading time, detail pages opened, receipt pages viewed and contact actions. Contact-form events distinguish an attempt, an error and a confirmed receipt. An email-link click does not tell us whether you sent an email.
These events contain fixed page and section names, coarse time and scroll measurements, and success or error states. They do not contain your name, email address, message, other form answers, URL query strings or the referring page. Google’s automatic enhanced measurement and Google Signals are disabled. With analytics accepted, public recruitment pages also record role visits, reading progress and application-link clicks. Advertising remains off on recruitment pages. Job applications have their own privacy notice and separate optional measurement choice; website tags never run inside the application. Missing pages are reported only as /404, without the failed address.
Your choices are stored in your browser's local storage as tdd.measurementConsent.v1 and tdd.advertisingConsent.v1. Each contains only “granted” or “denied”. An earlier analytics choice never grants advertising permission. You can change either choice at any time through Cookie settings in the footer. Withdrawing a category clears its accessible first-party measurement cookies and reloads the page with that category disabled. It stops new measurement; it does not erase information previously received by a provider or cookies on another provider's domain.
Optional advertising measurement
Advertising has its own consent choice. When enabled, advertising tags are limited to measuring website visits and confirmed business enquiries for our campaigns on Meta, Google Ads, LinkedIn and X. They do not receive contact-form answers, candidate information or uploaded files. These providers may process browser and device information, network addresses and advertising identifiers under their own privacy policies. Accepting analytics alone never permits these tags.
After advertising consent, the website may store a random browser identifier and the click identifiers supplied by those platforms. These help connect a visit or confirmed enquiry to the campaign that brought you here. They are not derived from your contact details. The first-party tdd_ad_clicks, _fbp and _fbc cookies used by this implementation expire after 30 days from the latest consented visit and are cleared when you withdraw advertising consent. A configured first-party measurement server receives only the event name, page path, a random event identifier, your consent states and these allowlisted advertising identifiers; it may use the request's network address and browser information for platform matching.
Where the GDPR applies, optional measurement is based on consent. Google may process measurement information on global infrastructure under its own privacy and transfer safeguards. Event- and user-level data are retained for up to two months under the current property controls; aggregate reports may persist after detailed data expires. We will review these settings before collecting any additional event or user-level data.
Country suggestion on the contact form
When the contact page opens, your browser makes one request to api.country.is, a free lookup service that returns a two-letter country code for the network address the request came from. The suggestion only pre-selects the optional Country field so you do not have to search a long list. You can change it or clear it before sending, and the enquiry is sent with whatever the field shows.
This is a form convenience, not measurement. It happens whether or not you accept analytics, and it is not affected by the measurement choice. The request is sent without cookies, credentials or a referrer. We do not receive, log or store your IP address from it; the response is read for the country code only, nothing is written to your browser storage, and no record of the lookup is kept unless you choose to send the enquiry. If the request fails, is blocked or does not answer within two seconds, it is abandoned and the field simply stays blank.
Where the GDPR applies, this brief processing is based on our legitimate interest in a contact form that is quick to complete. The service is operated by country.is and processes the request under its own terms.
Website fonts, illustrations and films are served from our own website. Viewing them does not make a request to Google Fonts or to the image and film generation services.
People who contact us
If you use the contact form, we receive your name, work email address, company or brand, the type of support requested and the information you choose to include in your message. Your role, country and timing are optional. If you contact us another way, we may also receive a telephone number or other details you choose to provide. We use this information to respond, understand whether the proposed work is relevant and continue the conversation you requested.
The form is sent through a Google Apps Script mail relay owned by leon@detail-department.com. The relay validates the submission and sends it to that Google Workspace mailbox. It does not create a separate lead database. Basic anti-abuse controls temporarily retain a one-way content fingerprint for up to ten minutes so a retry does not send the same enquiry twice; the fingerprint cannot be used to read the enquiry.
Where the GDPR applies, this processing is based on our legitimate interest in responding to relevant business enquiries and, where appropriate, taking steps at your request before a possible contract.
Individual business-development contacts
We may use limited professional information from company websites, professional networks, conference material or other publicly accessible business sources to identify and contact a small number of relevant media professionals. This may include a name, employer, role, professional contact details, source and a short record of the conversation.
Messages are intended to be individual and relevant, not mass consumer marketing. You may object at any time. If you do, we will stop the outreach and may retain only the minimum information needed to respect that request.
4. What we do not do
- We do not sell personal data.
- We do not make decisions about people using automated profiling.
- We do not currently collect campaign credentials, media plans, audience files or client performance data through this website.
5. Where data is processed
The business is currently operated from Switzerland. Contact-form and email enquiries are handled in Google Workspace, the email service for detail-department.com. The form relay runs on Google Apps Script. Google processes and stores the resulting mail and related service metadata on its own global infrastructure and applies its own terms and transfer safeguards to it.
The website is published on Firebase Hosting, a Google Cloud service, and is served from Google's global content delivery network. Access and security logs are created and held by Google as part of that service.
If analytics is accepted, Google processes measurement requests on its global infrastructure. The public website itself does not create a profile database or combine Analytics data with contact enquiries.
No client campaign data is currently stored in the planned Google Cloud infrastructure or accessed by a Bangalore delivery team.
6. Current service providers and recipients
| Provider | Current purpose | Information involved |
|---|---|---|
| Google Workspace and Apps Script | Validation, delivery and storage of contact-form and email enquiries | Submitted contact details and enquiry content; mail, delivery and normal service metadata; a short-lived one-way duplicate fingerprint |
| Google (Firebase Hosting) | Public hosting and delivery of this website | Access and security log information such as IP address, browser details, requested URL and timestamp |
| Google Tag Manager and Google Analytics 4 | Optional, consent-based website measurement | Page paths, section and interaction names, foreground reading time, scroll depth and contact outcomes; approximate location, browser and device characteristics |
| country.is (api.country.is) | One optional country suggestion for the contact form, independent of the analytics choice | The network address of the request, handled by that service; we receive only a two-letter country code and do not store the address |
We may also disclose information where required by law, to protect legal rights, or with your clear instruction. We do not share sales enquiries with data brokers or unrelated advertisers.
7. Retention
| Data | Retained |
|---|---|
| Website access and security logs | Held by Google under the Firebase Hosting service for its standard log-retention period, unless a longer period is required to investigate a security or reliability incident |
| Analytics measurement data | Event- and user-level data for up to two months under the current property controls; aggregate reporting may persist after detailed data expires |
| Measurement choice | Stored in your browser until you clear local storage or change the choice through Cookie settings |
| Contact-form duplicate fingerprint | Up to ten minutes after submission |
| Enquiries that do not become engagements | Up to 12 months after the last meaningful contact |
| Relevant professional outreach records | Up to 12 months after the last contact, except for a minimal suppression record retained as needed to respect an objection |
| Records needed for legal claims or legal obligations | Only for the applicable legal period |
These are maximum periods, not minimums. Information may be deleted earlier when it is no longer useful or when a valid deletion request applies.
8. Your rights
Depending on the law that applies to you, you may ask whether we process your personal data and request access, correction, deletion, restriction or portability. You may also object to processing based on legitimate interests and withdraw consent where consent is the basis used.
Write to leon@detail-department.com. Please identify the information concerned and the right you wish to exercise. We normally respond within 30 days and may request proportionate information to verify identity.
You may complain to the competent authority where you live or work. For processing in Switzerland, the relevant federal authority is the Federal Data Protection and Information Commissioner.
9. Security
Access to enquiry information is limited to Leon Houlier. Current protections include individual accounts, multi-factor authentication where supported, encrypted connections, device access controls, software updates and the security controls provided by the email service.
The more extensive client-access, evidence-storage, segregation, audit and incident controls described in our operating model are planned controls. They are not represented here as active controls for client work before they have been implemented and verified.
10. External links
The website may link to advertising platforms, professional networks or other third-party websites. Those organisations are responsible for their own websites and processing practices. Their privacy notices apply when you visit them.
11. Children
This is a business-to-business website directed at media and marketing professionals. It is not intended for children, and we do not knowingly collect personal data from children.
12. Changes and mandatory review points
Changes will be published here with a new version number and effective date.
This version reflects Firebase Hosting, the branded Google Workspace account, the contact form through Google Apps Script, its country suggestion, locally hosted media and consent-gated Google Analytics reading and contact events. This policy must still be reviewed before any of the following occurs: a change of hosting, form, country-lookup or measurement provider; collection of additional analytics events; activation of advertising features; access from India; incorporation of the business; signature of a client agreement; or processing of campaign or advertising-account data.