Privacy policy

Last updated: 31 July 2026

This policy describes what this site collects, why, how long I keep it and what you can require me to do about it. It is short because the site is simple: a set of static pages with no accounts, no registration, no login and no comment system. There is nothing here to sign up for, which removes most of the reasons a website would hold personal data in the first place. Where I do collect data — server logs, Google Analytics, affiliate referral parameters — I name the tool, the cookie and the retention period below rather than cover it with a general assurance.

Who operates this site

This site is published at erwfl.co.uk and operated by its editorial team, with Smith Jones responsible for content. Data protection enquiries go to [email protected] and are answered by a person, not an automated system.

I am an independent comparison publisher. This is not an advertising network, not an adult content platform and not a party to any transaction you make with a network you find through this site. Once you follow an outbound link you are on that company's property and its policies apply, not ours.

I apply the standards of Regulation (EU) 2016/679 (GDPR) to every reader regardless of location. Applying two different standards by geography creates more risk than it saves, and the GDPR baseline is the stricter one.

What is collected

Nothing you type. There is no contact form, no newsletter signup, no account creation and no comment field on this site. If you email me, I hold that email — your address and whatever you chose to write — and nothing more. I never ask for and never receive payment details, network account credentials, campaign data or identity documents.

Standard server logs. Like any web server, ours records the information a browser sends when it requests a page: IP address, user-agent string identifying browser and operating system, the page requested, the referring URL, and a timestamp. I use this to keep the site running, diagnose faults and identify abusive traffic such as scrapers and denial-of-service attempts. I do not use it to build a profile of you.

Google Analytics 4. This site runs Google Analytics 4 (property G-D9FN4W4VV6, operated by Google LLC) to see which pages are read and for how long, because that determines what I write and update next. It sets first-party cookies in your browser — principally _ga, which expires after two years, and _ga_<container>, which holds session state. GA4 records your approximate location derived from a truncated IP address, device and browser type, referring source, and the pages you view. Google does not expose raw IP addresses to me, and I look at the reports in aggregate rather than tracing individual sessions.

You can opt out at any time. Browser-level cookie blocking, private browsing, and Google's own opt-out browser add-on all prevent GA4 from recording your visit, and the site works identically without it. If your browser sends a Global Privacy Control or Do Not Track signal, that is honoured where the browser enforces it.

No advertising or profiling cookies are set by this site. I run no display ads, operate no retargeting pixels, do not use Google Signals or cross-device tracking in the GA4 property, and do not sell, rent or share data with data brokers or advertising networks for their own purposes.

Outbound affiliate links

Links from Adult Web Traffic to individual networks carry campaign parameters in the URL identifying this site as the referrer and, in some cases, which button you used. That is how affiliate attribution works and it is the mechanism that funds the site. The parameters travel in the link itself and are visible in your address bar; they contain no personal information about you.

Once you follow such a link, the destination company may set its own cookies and collect its own data under its own privacy policy, which I neither control nor can vary. Review the destination's policy before creating an account or depositing funds — this matters more than usual in this category, where funding is typically non-refundable.

I receive no personal information back from those networks. I may see aggregate referral and conversion counts; I do not learn who you are, what you spent or what you ran. The funding model is described further in my editorial policy.

Legal basis for processing

Server logs are processed on the basis of legitimate interest under Article 6(1)(f) GDPR: keeping the site available and secure. The interest is proportionate because the data is minimal, retained briefly and never used to target you.

Google Analytics relies on your consent under Article 6(1)(a), since its cookies are not strictly necessary for the site to function. Declining costs you nothing: every page renders and every link works with analytics blocked. Consent can be withdrawn at any time by clearing cookies for this domain, blocking them in your browser, or installing the opt-out add-on linked above.

Email correspondence is processed under Article 6(1)(b) where you have written to me and expect a reply, and under Article 6(1)(f) where the exchange concerns a correction to published material.

Where any processing depends on consent, that consent can be withdrawn at any time by writing to [email protected], without affecting the lawfulness of what happened before withdrawal.

How long data is kept

I keep server logs for 90 days, which is long enough to investigate an abuse pattern and short enough to limit exposure, then delete them. I keep email correspondence for 12 months from the last message in the thread, then delete it, except where it documents a published correction — I keep that record because the audit trail is the point of it.

Google Analytics user-level and event-level data is set to the shortest retention Google offers, 2 months, after which it is deleted from the property. The aggregate reports that survive that window contain no personal data and I keep them indefinitely.

I retain nothing "just in case". Where a retention period ends, the data is deleted rather than archived.

Transfers outside the EEA and UK

Google LLC is based in the United States, so running Google Analytics means data reaches a processor outside the EEA and the UK. Google relies on the European Commission's Standard Contractual Clauses and its certification under the EU–US Data Privacy Framework to cover those transfers, and Google Analytics 4 truncates IP addresses before storage rather than retaining them in full.

If you would rather no data left your browser at all, block the analytics cookie — the opt-out routes above take under a minute and nothing on this site depends on them.

Your rights

You may request a copy of any personal data I hold about you (Article 15), have inaccurate data corrected (Article 16), have your data deleted (Article 17), restrict how it is processed (Article 18), receive it in a portable machine-readable format (Article 20), or object to processing carried out on the basis of legitimate interest (Article 21).

Send requests to [email protected]. I acknowledge within 72 hours and complete within 30 days. There is no charge. In practice my answer to most access requests is short, because there is very little to hold: without an account there is no identifier tying analytics data to a named person, so an access request usually resolves to the email correspondence I hold and nothing else.

If you are in the EU or UK and believe I have handled your data improperly, you have the right to complain to your national supervisory authority. Doing so does not require you to contact me first, though I would rather have the chance to fix it.

Security

The site is served exclusively over HTTPS with TLS encryption, so traffic between your browser and the server cannot be read in transit. Administrative access is mine alone and protected by two-factor authentication. I keep server software patched, and the static architecture means there is no database of readers to breach — the most effective security measure available is not collecting the data in the first place.

No system is completely secure, and anyone claiming otherwise is overselling. If I ever became aware of a breach affecting personal data, I would notify affected people and the relevant supervisory authority within the 72-hour window the GDPR requires.

Age

This site is intended for advertising professionals aged 18 and over. It is not directed at children, I do not knowingly collect data from anyone under 18, and any such data I discovered would be deleted immediately. If you believe a minor has contacted me, write to [email protected] and I will remove the record.

Changes to this policy

The date at the top of this page shows when I last reviewed it. Substantive changes will be reflected there and in the page's structured data. Because this site collects so little, changes should be rare — swapping analytics tools or hosting arrangements would be the usual reason for one.

Questions about anything on this page go to [email protected]. Other contact routes are listed on the contact page, and the way the site is funded and governed is set out in about and the editorial policy.