Privacy

Who is responsible for your data

I am Jamil Abduljalil, sole trader, trading as OwnerKit from Ghana. I am the data controller for everything described on this page. Postal address: 10 Steel Works Rd, Tema, Ghana. You can reach me through the contact form, which comes directly to me.

Data you give me

When you buy, the checkout runs on Gumroad. Gumroad collects your email address and your payment details under its own privacy policy and acts as the merchant of record; I never see your card number. Gumroad shows me your email address, what you bought, when, and the country the tax was worked out for, which is what I need to answer a question or issue a refund.

Apart from the contact form (below), I collect your email address directly only when you join one of two lists on this site, and each is used only for what its own box says:

• The “keep me posted” box under the free construction workbook: updates when the workbook changes, and now and then a note about its paid version — about one email a month at most.
• The free worksheet box (home page, product pages, the Pro waiting list): the weekly cash review worksheet, and occasional notes about the weekly cash review, at most once a week. Nothing about the construction workbook is sent to this list.

You can stop either by replying with one word. The same day, I delete your address from the list and add it to a suppression list, so that you are not added again by mistake; the suppression entry is deleted six months later. Our emails to each other stay in my mailbox. To limit repeat use, the sign-up form, the contact form and the download button keep your IP address in the server’s working memory only; it is never written to storage.

When you send a message through the contact form I store the message, your address, and a salted one-way hash of your IP address (not the address itself) to spot abuse. Once a month I delete from the site every message more than three months old; the copy in my mailbox stays there as our correspondence. The legal basis is performing our contract for anything you bought, and your consent for anything you opted into.

If you write to me

If you write to me first — a comment or a message on LinkedIn, Facebook or Reddit, an email, or the contact form — I keep a short record so I can answer you and follow up: your name, your handle or email address, where and when you wrote, one line on what you asked, whether you opened the free file, whether I offered you the founding price and whether you took it, whether you bought, and whether you agreed to be quoted. It sits in a private spreadsheet on my own computer and is shared with no one. The basis is my legitimate interest in answering you (and our contract, if you buy). I delete the row when the conversation ends, and in any case six months after our last exchange — except that if you let me quote you, I keep that row, including how to reach you, for as long as the quote is published, because advertising rules require me to be able to show that a quote is genuine. I publish only the words you approved, with your first name and trade, and you can withdraw that permission at any time. You can object to any of this, and I will delete it. The only emails I send first are described in the next section.

If I email you first

I write a small number of emails, one at a time and by hand, to construction companies in the United States, the United Kingdom and Ireland, about the construction workbook. Nobody else gets one. In the UK and Ireland I write only to limited companies, limited liability partnerships and public limited companies that I have checked on the public company register, and only to a general company address, such as an info@ address — never to a named person’s address. In the United States I may also write to an address that the company publishes for a named person.

I find each address myself, on the company’s own website, and the email says where. I note the company’s name, website, country, legal form and register number, the address I wrote to, where I found it, one line about the company’s work taken from its own website, the date I wrote and whether you replied. That record is in a private spreadsheet on my own computer, shared with no one. I send one email and no follow-up. I never buy or rent lists, never use software to collect addresses or to send these emails, and never pass the addresses to anyone.

Whatever happens next, your company’s website domain and the date go on a list of companies I must not email first again, so that no company hears from me twice. If you do not reply, I delete the rest of the record 30 days after I wrote. If you reply, your email becomes a conversation and is kept as described under “If you write to me”. If you ask me to stop — reply “stop”, or anything that says so — I stop the same day: I delete the record and put the address I wrote to on that list as well. A stop entry is kept for good, so that the address is never emailed again; the rest of the list is deleted when I stop sending these emails. Where UK or Irish data protection law applies, the basis is my legitimate interest in offering a business tool to businesses that may need it, and you can object at any time by replying to the email or through the contact form.

The free workbook download counter

Each download of the free construction workbook adds one to a counter, filed under the page it was downloaded from (the demo page, or one of its copies used in LinkedIn, Facebook, Reddit, email and advertising links). The counter stores a timestamp and the page name, and nothing else: no cookie, no device identifier, no IP address, no user agent. It tells me how many times the file was taken, and from where; nothing in it identifies anyone, and I do not combine it with anything else.

Where the data is

I am established in Ghana. My own records of conversations and of the emails I send first — the spreadsheet described above — are on my computer in Ghana; everything else is held by the providers named below, mostly in the United States. Ghana has no UK or EU adequacy decision.

On UK and EU representatives: a controller outside the UK or the EU has to appoint a representative there unless its processing of UK or EU data is occasional, low-risk and does not involve special-category data on a large scale. OwnerKit is one person selling a spreadsheet, and what it holds about people in the UK or the EU is the email address of anyone who asked for updates and the messages people send it (the UK and Irish companies I email first are written to only at a general company address, which does not identify a person) — so I have not appointed one, and this sentence is here so that you know the position rather than having to guess it. If you think that is wrong, write to me and say so.

Who else touches it

Gumroad (Gumroad, Inc., United States) is the merchant of record and handles your purchase as a controller in its own right, under its own privacy policy: it holds your payment details, delivers the files and processes refunds; I never see your card. Three providers process data on my behalf. Netlify hosts the site and stores the list addresses, the contact-form messages, the download counter and the records of orders placed through the earlier card checkout. Zoho (Zoho Mail) hosts the OwnerKit mailbox: the notes to the list and the emails described under “If I email you first” are sent from it, and replies and stop requests arrive in it. Google runs the relay that forwards contact-form messages and order notifications into a mailbox I answer from, and may hold a forwarded copy of the OwnerKit mailbox; the message is stored on Netlify either way. An order record holds your reference, your email address, what you bought, the amount, when you paid and when you first downloaded — kept for seven years, because tax records have to be.

Your rights

You can ask me for a copy of what I hold, ask me to correct it, ask me to delete it, ask me to restrict what I do with it, or object to it — through the contact form. I answer within one month. I do not sell your data, and I share it only with the providers named above. There is no automated decision-making. If you are unhappy with how I have handled it you can complain to your national data protection authority: in the UK that is the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/, in the EU it is the supervisory authority for your country, and in Ghana it is the Data Protection Commission.

Cookies and tracking

This site sets no analytics cookies, no advertising pixels and no third-party trackers, and the download counter above uses none of them. When you follow a buy button to Gumroad, your browser tells Gumroad only that you came from this site’s address — not which page, and nothing about you. If any of this ever changes, a consent banner will appear before anything is set, and this page will say so.