1. Who I am
Spencer Kitson — operator and writer, based in Johannesburg. I run spencerkitson.com in personal capacity (not as a business). The site is a place for my writing on payment rails, stablecoins, and the South African fintech landscape.
For privacy questions, email privacy@spencerkitson.com. I aim to reply within 5 days and resolve within 30.
2. What I collect
If you subscribe to the newsletter:your email address (required) and your name (optional). If you also tick the optional “allow tracking” box at signup, your email opens and link clicks. If you don’t tick that box, no opens or clicks are tracked.
If you just visit the site: standard request logs with your IP address and user-agent string stored as one-way hashes, not the raw values. These are used for security and operations only.
If you interact with the cookie banner: your accept/reject choice, the banner version you saw, and a hashed visitor identifier. No raw IP or user-agent stored.
I don’t collect payment information, location data, biometric data, children’s data, or any “special” categories (race, religion, health, etc.).
3. Why I collect it
To send you the newsletter you subscribed to, and only that.
To keep the site running and protect it from abuse.
That’s the whole list. I don’t use this data for advertising, profiling, or any third-party purpose.
4. Who else sees it
A small set of operators help me run the site. The full list lives at /subprocessors with each one’s purpose and region.
I don’t sell your data. I don’t share it with advertisers. If the list of operators changes, I update that page; material changes also prompt the cookie banner to reappear so you can re-consent.
5. How long I keep it
Active subscribers: until you unsubscribe, or until you go silent for 60 days plus a 14-day re-engagement window — at which point the record is purged automatically.
Unsubscribed records:kept for 30 days as an audit trail (so a duplicate signup doesn’t accidentally re-add you), then purged. The email is overwritten with a non-reversible tombstone.
Cookie consent records: 365 days, then expired automatically.
Audit log entries: retained as long as needed for accountability; entries store hashed identifiers, never raw PII.
6. Your choices
Unsubscribe at any time — every email has a one-click unsubscribe link in the footer. No login, no preference panel; one click, done.
Ask what I have on file — email privacy@spencerkitson.com from the address you subscribed with. I’ll reply with everything I hold, within 30 days.
Correct or delete — same address. Corrections take effect right away; deletion is honoured within 14 days, with a tombstone audit-log entry kept for accountability.
Withdraw tracking consent— if you originally ticked the optional tracking box, you can untick it later by emailing me. Future emails won’t include a tracking pixel and won’t rewrite links through the redirector.
8. When this last changed
Version 1, effective 2026-04-26. Material changes prompt a re-consent banner and a one-line note in the next newsletter. Earlier versions are kept on request.