What this site collects, and what it does not.

We store your name where you gave one, your email address, which paper you asked for and when it was sent to you, the page you asked from, and the date you consented — that last one so we can show, if anyone asks, that you were not added without agreeing. You confirm by clicking a link in an email, and nothing is sent until you do.

The lawful basis is your consent, and you can withdraw it at any time: every letter carries an unsubscribe link, or write to contact@judgmentcapital.org and the record is deleted rather than merely marked inactive. We do not sell, rent or share the list, and we do not use it to market anything other than this book and the authors’ own work.

The addresses sit in a Supabase database (EU region) and the letters are sent through Resend. The site itself is hosted on Vercel, which keeps standard request logs.

If a letter reached you and you never gave us your address, this is the part that concerns you. We wrote to a named role at your organisation — a chair, a chief risk officer, a company secretary — because the book is addressed to that work. Your name, your role and the address we used came from public sources: your organisation’s own website, its annual report, or a national companies register. We hold no more than that, and we bought nothing from a list broker.

The lawful basis is legitimate interest: telling people responsible for governance that a book on the subject exists. We balanced it against your interests before sending, which is why we write to a role rather than a personal address, why there are never more than three messages and no fourth, and why there is nothing in them that reports back whether you opened it. You can object, and an objection ends it — write to contact@judgmentcapital.org and the record is suppressed permanently rather than deleted, so that nothing we do later can reach you again by accident.

You also have the right to see what we hold, to correct it, to have it erased, to restrict what we do with it, and to complain to a supervisory authority — in Latvia, the Data State Inspectorate. Ask and we will send you the record itself, including the source it came from and the date we took it.

Nothing is set until you choose. The banner offers three states, and the only cookies that run without your agreement are the ones that remember that choice and keep the site working.

If you allow analytics, two measurement scripts load — Plausible, which does not profile individuals, and Google Analytics with IP anonymisation — so that we can see which arguments people actually read. If you decline, neither loads, and the site works identically.

If you allow marketing, the Google Ads tag loads, so that we can tell which of our advertisements led to an order and stop paying for the ones that did not. It records the visit and, if you order, the order's value and reference; never your name, address or email. Decline marketing and it never loads.

You have the usual rights under the GDPR: access, correction, deletion, portability, and complaint to a supervisory authority (in Latvia, the Data State Inspectorate). For any of them, write to either author. We answer these ourselves; there is no ticket queue.