Privacy policy

Last updated 24 September 2026

This site sells The Attention Playbook, a video playbook on growing on X. I'm Rob Hallam, a sole trader in the United Kingdom, and I'm the data controller for the personal data described here. You can reach me at rob@theattentionplaybook.com.

The short version: I collect as little as I can, I don't set cookies, the only analytics tool is PostHog (hosted in the EU) and I never sell your data.

1. When you buy: your email, via Whop

Checkout happens on Whop. Whop is the merchant of record: it takes the payment, collects any sales tax or VAT, and holds your card or payment details. I never see your full payment details.

Whop passes me your email address, your name if you gave one, what you bought, the price paid and your order status. I use these to confirm your order, send you access on the delivery date, handle refunds and answer support emails. The legal basis is performing our contract.

Whop's own handling of your data is covered by Whop's privacy policy.

2. When you visit: analytics with PostHog

I use PostHog, hosted in the EU, to count visits and button clicks, so I can see how many people read the page and how many click through to checkout. It is set up to be as light as it can be: no cookies, session recording off, no automatic click tracking and no profile of you as a person. To count a repeat visit once, PostHog keeps a random ID in your browser's local storage; you can clear it any time by clearing your site data. The script is served from this site, not loaded from a third party. PostHog records page views and these events:

• preorder_click: someone clicked a buy button, with the price and sales count shown at the time, and which button.
• purchase: a sale came through from Whop, with the price paid, which product, and whether the bonus was attached.
• price_step_change: the price moved up a step, with the old and new price.
• free_video_play: one of the two free videos was played, and whether the viewer was logged in.
• faq_open: which FAQ question was opened.
• refund_request: a refund was requested, before or after delivery, the watched percentage at the time, and the outcome.
• scroll_depth and curriculum_expand: how far down the page people read, and which modules they open.

These events do not contain your name or email. Like any website, PostHog and my hosting provider see your IP address when your browser connects to them; my hosting provider keeps standard server logs for security and to stop abuse, such as rate limiting. The legal basis is my legitimate interest in running and improving the site.

3. When you watch: playback data

After delivery, the player records how far you get through each lesson: your account, the lesson, the furthest point reached and when. Reading or downloading a transcript marks that lesson as watched. I use this to save your progress and to apply the refund rule fairly (under 10% watched within 7 days of delivery), and to settle any dispute about it. The legal basis is performing our contract and my legitimate interest in preventing refund abuse.

Videos are streamed through a video host using signed, expiring links. That host processes technical data such as your IP address to deliver the video.

4. The two free videos

The two free videos are public. No email or account is needed to watch them. If you watch them here, the only thing recorded is the free_video_play event above. If you watch them on YouTube, Google's privacy policy applies there.

5. Emails

If you buy, I'll send you an order confirmation, your access email on the delivery date and one reminder when the free videos are out. These are part of the order. I won't add you to a marketing list without asking.

6. Who else handles your data

• Whop, for checkout, payment, tax and buyer accounts.
• My hosting provider, which runs this site.
• PostHog, for the analytics above (EU hosting).
• An email delivery provider, to send the emails above.
• A video hosting provider, to stream the lessons.

Some of these are based outside the UK, in which case the transfer is covered by UK adequacy regulations or the standard contractual safeguards those providers offer.

7. How long I keep it

• Order records: for as long as you have access, and then for 6 years, because UK tax rules require it.
• Playback data: for as long as you have access. Refund related records are kept with the order record.
• Analytics events: 24 months, then deleted.
• Support emails: 2 years after the conversation ends.

8. Your rights

Under UK GDPR you can ask me for a copy of your data, to correct it, to delete it, to restrict or object to how I use it, and to move it elsewhere. Email rob@theattentionplaybook.com and I'll answer within one month. If you're unhappy with how I handled something, you can complain to the Information Commissioner's Office at ico.org.uk.

9. Changes

If I change this policy in a way that matters, I'll update the date at the top and, if you've bought, tell you by email.