Privacy notice

The controller for personal data processed in connection with this website is Andrew J. Cousins, operator of Decision-Space Integrity. Decision-Space Integrity is the name of this project and website, not an incorporated company.

Contact for anything in this notice: enquire@decisionspaceintegrity.com.

• The site's own pages set no cookies and use no browser storage (no localStorage, sessionStorage or similar).
• The site's own source contains no analytics, advertising or tracking code. The hosting platform previously injected an analytics beacon at the edge; that feature was disabled and its absence verified on 31 August 2026. See the verified position below.
• There are no forms: the site collects nothing you type. Contact happens only by email that you choose to send.
• The site runs almost no JavaScript; one page uses a small first-party script for visual presentation only, which collects nothing and makes no network requests.

These statements are backed by an audit of the site's source code (see the repository document docs/privacy-data-flow-audit.md). Behaviour that exists only at the hosting layer, such as any protective cookie the host might set during an attack-mitigation challenge, is controlled by the hosting provider rather than by this site's code, and is noted below.

What was previously observed. Inspection of the deployed site on 22 August 2026 found that Cloudflare was injecting a Web Analytics beacon script — static.cloudflareinsights.com/beacon.min.js, carrying a data-cf-beacon site token — into pages at the edge. That script was never present in this site's source, and the pages never requested it; the hosting platform added it after the page left the repository.

That injection varied by request characteristics. An ordinary command-line request did not receive the beacon, while a browser-equivalent request did. A single clean fetch is therefore not evidence of absence, and any check that uses only a default client will report a false negative.

Resolution. Cloudflare Web Analytics was disabled for this site on 31 August 2026. Absence was then verified on 31 August 2026 by requesting /, /paper and /privacy twice each — once with a default command-line agent and once with a browser-equivalent agent and browser request headers. Under both, every page returned zero references to cloudflareinsights, zero data-cf-beacon attributes and zero external analytics scripts.

The site's Content-Security-Policy sets script-src 'none' on every route but one. That is defence in depth, not the basis of this statement: the test applied here is that the script tag is not served at all, not merely that a browser would refuse to run it.

What this does not cover. This concerns the optional Web Analytics feature only. It is separate from the ordinary request processing every web host performs — your IP address, user agent and request details are still handled by the hosting layer to deliver pages and protect the service against abuse, as described under Hosting above. Disabling Web Analytics does not remove that processing, and this notice does not claim it does.

• Hosting and security request processing — legitimate interests (UK GDPR Article 6(1)(f)): operating and protecting a public website.
• Font requests — legitimate interests (Article 6(1)(f)): presenting the site legibly and consistently.
• Email correspondence — legitimate interests (Article 6(1)(f)) in responding to enquiries; where your enquiry is about evaluating or piloting the product, processing is also a step taken at your request prior to entering into a contract (Article 6(1)(b)).

Email correspondence is kept for as long as it is needed to deal with your enquiry and any follow-up, and afterwards only where there is a continuing reason to keep it — an ongoing evaluation or working relationship, a record of what was agreed or disclosed, or a legal obligation. When none of those criteria applies any longer, correspondence is deleted. Fixed retention periods have deliberately not been invented for this notice; retention is criteria-based as described.

The third parties involved are infrastructure providers acting for their stated purposes: Cloudflare, Inc. (hosting and delivery) and Google LLC (font delivery), plus the provider that hosts our mailbox for email you send us. These providers operate global infrastructure, so requests and correspondence may be processed outside the United Kingdom; where that happens it takes place under the provider's published data-protection terms and applicable transfer safeguards. We do not claim that data never leaves the UK.

Links to external sites (for example GitHub, DOI/OSF and arXiv) transfer no data when the page loads; if you follow such a link, the destination site processes your visit under its own privacy terms.

Under the UK GDPR you have the right to request access to, correction of, or deletion of personal data we hold about you; to object to or ask us to restrict processing; and to data portability where it applies. Because the only personal data we ordinarily hold is correspondence you have sent us, these requests are usually simple to fulfil. To exercise any of them, email enquire@decisionspaceintegrity.com.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.

If the site starts doing anything not described here — for example, adding a form, analytics, or any cookie — this notice will be updated first, and a consent mechanism will be added where one is required. The "Last updated" date above reflects the current version.