Data & Privacy
Last updated: August, 30 2026
This site collects the minimum data needed to do its work — your email if you sign up for the Field Guide, your message if you reach out through the contact forms. We don't sell it, share it, or use it to track you across the web.
The 90% Code argues for data sovereignty. The site practices it.
The detail is below, in plain language and in the form privacy law requires.
What we collect
If you sign up for the Field Guide: your email address, and optionally your name if you choose to share it. We use this to send you the Field Guide and, occasionally, updates related to the book and the work — book launch, talks, new resources. You can unsubscribe at any time using the link at the bottom of every email.
If you submit a contact form (Speaking, Workshops, Lab, Press, or general inquiry): the information you provide — typically name, email, organization, and message. We use this only to respond to your inquiry.
If you purchase or pre-order a book: we collect the information needed to process and fulfil your order, including your name, email address, billing and shipping address, products ordered, order value, and transaction details. Payment card information is processed by Stripe; we don't receive or store your full card details. Shipping information may be shared with Easyship and the carrier used to deliver your order.
If you visit the site: Squarespace, Google Analytics, and, where you consent to non-essential cookies, advertising tools such as Meta Pixel and Google Ads may collect information about how you use the site — including pages viewed, referring source, approximate location, device and browser information, and actions such as viewing a book, adding it to cart, or completing a purchase. These services may use cookies or similar identifiers to measure site performance and advertising effectiveness.
If you use the AI Trust Score (score.the90code.com): your answers to the nine assessment questions and your email address, plus anything you write if you leave feedback. There's a separate section on this below, because the Trust Score runs on different infrastructure from the rest of the site.
If you sign up through a LinkedIn ad: when you request the Field Guide via one of our ads on LinkedIn, LinkedIn passes us the details you submit in their form — your name and email — under LinkedIn's own privacy policy. We use these the same way as any Field Guide sign-up: to send you the guide and occasional related updates. You can unsubscribe at any time.
Cookies: the site uses cookies for essential functionality, analytics, and, where you consent, advertising measurement and retargeting. You can accept or decline non-essential cookies through the cookie banner. Declining non-essential cookies does not prevent you from using the site or purchasing the book.
What we don't do
We don't sell your personal information or give data brokers access to it.
Where you consent to advertising cookies, Meta and Google may receive limited information about your visit and actions on the site so we can measure advertising performance and reach people who have previously interacted with The 90% Code. We don't give advertisers access to our customer or subscriber lists except where we deliberately use a platform feature for advertising and the appropriate consent and privacy protections apply.
Who else touches your data
To operate the site, we use a small set of trusted service providers. Each handles a specific function and is bound by their own privacy policies and applicable data protection law:
Squarespace — website hosting, ecommerce, contact forms, customer records, and order management
Squarespace Email Campaigns — Field Guide delivery, subscriber list management, and any email updates we send
Google Workspace — email and file storage (admin@the90code.com)
Google Analytics — anonymous usage analytics
LinkedIn — lead generation forms for visitors who sign up for the Field Guide through our LinkedIn ads
Lovable and Supabase — hosting and database for the AI Trust Score (score.the90code.com), stored in the United States
Resend — delivery of Trust Score reports and notifications
Stripe — payment processing for book purchases and the full Trust Score report
Anthropic — generation of the written summary on your Trust Score results page, processed in the United States
Easyship and shipping carriers — shipping labels, delivery, tracking, and fulfilment of book orders
Meta — advertising measurement and audience creation through Meta Pixel, where you consent to advertising cookies
Google Ads — advertising measurement and campaign attribution, where you consent to advertising cookies
We don't share your data with anyone beyond these providers, and we only share what's needed for them to do their function.
The AI Trust Score
The Trust Score is a separate application from this website, so it's worth its own explanation.
What it collects. Your answers to the nine assessment questions, and your email address so we can send you the report. If you leave feedback, whatever you write in the comment box. If you choose to pay for the full report, Stripe processes the payment and we never see your card details.
What we use it for. Your answers generate your Trust Profile, which we email to you. We look at answers across all respondents to see whether the questions are working as intended and to improve the framework. During the pilot, feedback shapes how the tool develops.
Where it lives. The tool runs on Lovable Cloud, which hosts the database on Supabase infrastructure in the United States. Emails are sent through Resend. Payments run through Stripe. When your report is created, we send your answers, your scores, and your biggest-gap response (including anything you typed in the optional free-text field) to Anthropic, a US-based AI company, whose model writes the personalised summary on your results page. We don't send Anthropic your name or email address. These providers process data on our behalf and aren't permitted to use it for their own purposes. We don't use your answers to train AI models, and neither do they — Anthropic's terms exclude API data from model training. If the summary can't be generated, your report still works.
Updates are separate. The Trust Score asks, with an unticked box, whether you'd like occasional updates about the book. That's a separate decision from taking the assessment. If you tick it, you can unsubscribe from any email we send, and unsubscribing doesn't delete your assessment. If you don't tick it, we only email you your report.
Deletion. Email admin@the90code.com and we'll delete your assessment and any feedback you left. We'll confirm within 30 days, usually sooner. Your email address may remain in our email provider's delivery logs for up to 30 days before expiring automatically. If you've emailed us directly about the pilot, that correspondence sits in our inbox and we'll delete it on request too.
How long we keep it
Email subscribers: as long as you remain subscribed, plus a short period after unsubscribe for our records. You can request full deletion at any time.
Contact form submissions: kept for as long as needed to respond to your inquiry and follow up. Typically deleted within 12 months of last contact unless an ongoing relationshipexists.
Analytics data: retained according to Google Analytics' default retention settings (currently 14 months).
Book orders: order and transaction records are retained for as long as reasonably necessary to fulfil orders, handle returns and customer service, and meet accounting, tax, and legal requirements.
AI Trust Score assessments: we keep your email address for 12 months after you complete the assessment, then remove it. Your answers are kept after that in anonymised form, with nothing linking them to you, so we can keep improving the framework. You can request full deletion at any time before or after that.
Your rights
Depending on where you live, you have specific rights over your data. These include:
Access — ask us what data we hold about you
Correction — ask us to fix anything inaccurate
Deletion — ask us to remove your data
Portability — receive your data in a usable format
Withdrawal — withdraw consent for processing at any time
Objection — object to specific uses of your data
These rights apply in different ways depending on your jurisdiction — including under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA), the EU's General Data Protection Regulation (GDPR), and California's Consumer Privacy Act (CCPA).
To exercise any of these rights, email admin@the90code.com with the request. We'll respond within 30 days.
International transfers
This site is operated from Canada. Some of your data is stored in the United States: website hosting and email through Squarespace and Google, and the AI Trust Score database, which is hosted in a US region, along with the AIsummary generation, which Anthropic processes in the US. Canada is recognised as providing adequate protection under EU law. The United States is not, in general, which means data stored there is subject to US law and to access requests under it. We use providers who commit contractually to protecting your data, and we keep what we store to the minimum the tool needs. Ecommerce, payment, advertising, analytics, and shipping providers may also process information outside Canada depending on their infrastructure and the location of the customer or shipment.
Children
This site isn't directed at children under 13. We don't knowingly collect data from anyone under 13. If you believe a child has submitted information to us, email admin@the90code.com and we'll delete it.
Changes to this policy
We may update this policy as the site evolves or as legal requirements change. The "Last updated" date at the top will reflect any change. Substantive changes will be communicated to email subscribers.
Contact
Questions about this policy or your data: admin@the90code.com