1. Who I am
I am Michael Stout, and I run this site as my private consulting practice: one-on-one AI work with executives and executive teams. For privacy law purposes I am the data controller for michaelstout.ai, which means I decide what is collected here and why.
I am also a director of Xerensys. That matters to you for one practical reason, and I would rather state it plainly than bury it: the Privacy Policy and Data Removal links in the footer of this site open Xerensys’s own policy, hosted at xerensys.ai. Xerensys operates that separate site with its own privacy policy and its own data practices. This policy covers michaelstout.ai only.
2. What I collect
There is no contact form on this site any more, and no way to submit personal data to me through michaelstout.ai itself. Nothing you type here is transmitted anywhere.
Three things are worth naming:
- Analytics, only if you accept them. If you choose “Accept all” in the cookie banner, this site loads Vercel Analytics, which records aggregated usage — page paths, referrer, approximate country, browser and device type. It is designed not to identify individual visitors. If you choose “Essential only”, it is never loaded at all.
- Two values in your own browser, covered in section 4. Neither is ever sent to me.
- Standard server logs kept by my hosting provider — IP address, timestamp, requested URL, browser user-agent — as every web server does. I do not analyse these or build profiles from them.
Booking a call leaves this site. The “Book an intro call” buttons and the Contact link point at a HubSpot scheduling page. Anything you enter there — your name, email and chosen time — is collected on that page by HubSpot, under HubSpot’s own terms, and reaches me from there. This policy does not govern that page.
There is no account system, no login, and no newsletter.
3. Why I collect it, and my legal bases
Analytics exist for one purpose: to understand which pages are read, so I can write better ones. I do not use them to profile you, retarget you, or build a marketing list. Where UK or EU GDPR applies, my legal bases are:
- Consent — for analytics. Nothing analytical loads until you choose “Accept all”, and you can withdraw that at any time from Cookie settings in the footer.
- Legitimate interests — for hosting logs and keeping the site available and secure. I have considered your interests and consider a working, defended website to be what you expect.
- Steps prior to entering a contract — when you book a call to discuss working together.
4. Cookies and local storage
This site sets no advertising cookies and no cross-site tracking of any kind. Two values are stored in your browser’s local storage, and neither ever leaves it:
ms_theme— whether you chose the light or dark version of this site. A display preference, not tracking.ms-consent— your analytics choice and the moment you made it, so you are not asked again on every page.
Clearing your browser data removes both, and you will simply be asked again.
Analytics are opt-in. Until you choose, no analytics code is downloaded. “Essential only” keeps it that way permanently; “Accept all” loads Vercel Analytics as described in section 2. Change your mind at any time from Cookie settings in the footer.
This site loads its typefaces from Google Fonts, which means your browser makes a request to Google’s servers when the page loads. That request carries your IP address to Google under their own terms.
5. Who I share it with
I do not sell your personal data. I do not share it for advertising. Since this site takes no submissions, there is very little to share. Three providers necessarily handle data in order for the site to work:
- Vercel — hosts the site, processes requests, and provides the analytics described above.
- HubSpot — operates the scheduling page the booking links point to.
- Google Fonts — serves the typefaces, and therefore sees your IP address.
Beyond these, I share personal data only if the law requires it.
6. International transfers
I work with people in the United States, Canada, the United Kingdom, and the European Union, and I am frequently in a different country than you are. My hosting, analytics and scheduling providers operate internationally, so data may be stored or processed outside your own country — including in the United States. Where UK or EU GDPR applies, transfers rely on the providers’ standard contractual clauses and equivalent safeguards.
7. How long I keep it
Analytics are aggregated and retained by Vercel under their own retention schedule; I hold no individual-level analytics record and could not single you out of them.
Correspondence that follows a booking I keep for twelve months from our last contact. After that I delete it unless we have an ongoing working relationship, or unless I am required to keep it longer — for example for tax or legal reasons. You can ask me to delete it sooner. See your rights, below.
8. Your rights, including data removal
Wherever you are, you can ask me to show you what I hold about you, correct it, or delete it. Email me and I will action it. I do not charge for this, and I aim to respond within 30 days.
Depending on where you live you may also have these specific rights:
- UK — access, rectification, erasure, restriction, portability, and objection under UK GDPR. You can complain to the Information Commissioner’s Office (ico.org.uk) if you are unhappy with how I have handled your data.
- EU/EEA — the same rights under EU GDPR, and you can complain to your national data protection authority.
- United States — depending on your state, the right to know what is collected, to have it deleted, to correct it, and to opt out of sale or sharing. I do not sell or share personal data as those laws define it, and I do not discriminate against anyone who exercises a privacy right.
- Canada — access and correction under PIPEDA, and you can complain to the Office of the Privacy Commissioner of Canada.
To exercise any of these, email admin@xerensys.com.
9. Children
This site offers executive training and advisory services. It is not directed at children, and I do not knowingly collect personal data from anyone under 16. If you believe a child has sent me something, tell me and I will delete it.
10. Security
The site is served over HTTPS. Because it has no form and no mail path, there is no submission from this site to intercept.
One honest limitation applies once we are talking: ordinary email is not end-to-end encrypted, and a scheduling page is a third party’s system. Please do not send classified, privileged, or otherwise sensitive material through either. If that is what you need to discuss, say so in a short note and we will arrange a secure channel.
11. Changes, and how to reach me
If I change this policy I will update the effective date at the top. Material changes will be obvious rather than quiet.
For any privacy question, correction, or deletion request, contact me at admin@xerensys.com. Postal address for formal requests: Paul Street, London, EC2A 4NA, England.