Clever Little Goose LLC — Privacy Policy

Version 2What changed→
Last updated: 19 August 2026
Applies to: Clever Little Goose LLC as a company — anyone who writes to us, works with us, supplies us, buys from us, or visits cleverlittlegoose.com.

This is not the Cred Count policy. If you use our app, the notice that applies to you is at credcount.app/privacy, and it's a much longer document because the app is where the interesting questions are.

This one covers the company: correspondence, suppliers, clients and a website.

The little version

Clever Little Goose LLC is a very small company. Its business activity is, at present, company administration, email and the publication of open-source software.

We have no CRM, no marketing list, no analytics, no advertising, no tracking, and nothing that profiles anybody. We don't buy data and we don't sell it.

If you email us, we have your email. That's essentially the whole of it. This document explains what we do with it, how long we keep it, and what you can make us do about it.

1. Who we are

Clever Little Goose LLC is the data controller for the personal data described here.

• Registered address: 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA
• A limited liability company organised in the State of New Mexico on 15 July 2026 under the Limited Liability Company Act (Chapter 53, Article 19 NMSA 1978), registration number 0008116920.
• Registered with the UK Information Commissioner's Office as a data controller — registration reference ZC213564. It's a public register, so you can look us up at ico.org.uk rather than take our word for any of the above. It isn't a badge and nobody inspected us to grant it: it's a fee every UK data controller has to pay and a public entry naming who is answerable for the data. What it gives you is a regulator who already knows who we are, and a reference to quote if you ever complain about us (§7).
• Privacy: privacy@cleverlittlegoose.com — the right address for anything in this policy.
• Everything else: hello@cleverlittlegoose.com

Both reach the same place. The split exists so that a request with a legal deadline on it doesn't sit behind general correspondence.

Data Protection Officer: we don't have one and aren't required to. We don't monitor anybody at scale and we don't process special category data.

This policy is written for the UK GDPR and the Data Protection Act 2018. If you're somewhere else and your own law gives you rights we haven't listed, you keep them. Nothing here is meant to be a ceiling.

About the products. Cred Count has its own privacy policy at credcount.app/privacy because it raises its own questions; an on-device database, an AI import feature, a shared catalogue. Nothing in this document changes anything in that one, and nothing in that one is affected by this.

What the two do share is the plumbing, and it's worth listing so you can see how short it is: the same controller, the same mail and voicemail provider (Zoho, EU data centre), and the same host, DNS operator and, for this domain, registrar (Hetzner, Germany). Nothing else. No data crosses between them. Your email to this company doesn't reach the app, and the app holds nothing about you to reach this company with.

2. What we actually collect, and when

There are only three ways personal data reaches this company. Here they are.

2.1 You write to us, or we write to you

This is the main one, and for most people it's the only one.

What we get: your email address, your name if it's in your message or your signature, whatever you write, and anything you attach. If you're writing in a business capacity that may extend to your job title, your employer and your phone number, whatever's in your signature block. If we're the ones who started it, we got your address from a public source, an introduction, or from you having given it to us before.

There is also a telephone number, though you won't find it here. The company has one because Apple requires a phone number in an app's licence agreement, so it'll be published with our app rather than on this site. Email is how we'd rather you reached us and it's faster, but it is the company's number, so if you ever do ring it: it reaches a voicemail box, not a person, we don't record calls, we do not transcribe messages or calls. Those settings are off, and the only thing that can exist is a message you chose to leave. Recordings are deleted automatically after 7 days. Voicemail runs on Zoho Voice, on the same European data centre as our mail. If a message needs acting on, what survives is the reply and the email thread, under the retention in (§6) like anything else.

What we do with it: reply, and keep a record of the conversation so we know what was said. That's all. We don't add you to a mailing list, because there isn't one. There's nothing to unsubscribe from because nothing is running.

Who processes it: Zoho, as our processor, under a data processing agreement, on Zoho's European data centre. Our email and calendar are Zoho, and for your correspondence that is the whole list. The website has a host, named in §4, but it never sees a word you send us. We use no document or file service at all, so anything we write lives on a computer here rather than in somebody's cloud. There is no second tool: no CRM, no helpdesk, no marketing platform, no note-taker sitting in meetings. If that changes, this section changes with it.

Lawful basis:

• Ordinary correspondence: legitimate interests (UK GDPR Art 6(1)(f)) — answering people who contact us, and contacting people we need to deal with. Difficult to run a company otherwise, and in most cases you started it.
• If we're working together or negotiating to — supplier, contractor, client, professional adviser: performing a contract with you, or taking steps at your request before entering one (Art 6(1)(b)). Where you're an employee of a company we contract with rather than the contracting party yourself, it's legitimate interests instead: we need to be able to speak to a person.
• Where the law requires us to keep something — tax and accounting records in particular: legal obligation (Art 6(1)(c)).
• Legal claims: legitimate interests. If someone brought or threatened a claim, we'd keep what we needed to defend ourselves. We say so because it's true, not because we're expecting it.

2.2 We do business with you

Suppliers, contractors, professional advisers, clients, and anyone who invoices us or whom we invoice.

What we get: the above, plus the commercial particulars — what was agreed, what was delivered, what was paid, and when. Where you're a sole trader or a partnership, your business details are also personal data, which is why this section exists at all; where you're a company, most of it isn't, and only the details of the individuals we deal with are covered here.

Bank details. If we pay you, we hold whatever we need in order to pay you, for as long as the accounting record has to exist.

Who processes it: Zoho, as above. When there's an accountant or a payments provider there will be more to name here, and this section will name them.

Lawful basis: performing a contract (Art 6(1)(b)), legal obligation for the tax and accounting parts (Art 6(1)(c)), and legitimate interests for the rest of running the relationship.

2.3 You visit cleverlittlegoose.com

cleverlittlegoose.com is a plain website. It sets no cookies, runs no analytics, and loads no fonts, scripts, pixels or trackers from anyone else. Everything the page needs is served from the same place as the page. There isn't a consent banner because there is nothing to consent to, and no "manage preferences" screen because there are no preferences to manage.

That is a deliberate choice and not a difficult one: we don't need to know how many people visited, and the cost of finding out would be putting every visitor's IP address into somebody else's hands before the page had finished loading.

Our host is Hetzner, in Germany 🇩🇪, under a data processing agreement. They keep standard web server logs (IP address, user-agent, the page requested, the time), which are deleted after 7 days. That's how a web server works rather than something we've added.

The address itself has an answer too. Before your browser can reach the page, something has to answer the question "where is cleverlittlegoose.com?" That's DNS, and ours is Hetzner's as well. Same company, same country, same agreement. So is the domain registration.

Worth knowing what DNS actually involves, because it's less than people assume: your browser doesn't ask us directly. It asks whichever DNS resolver it's configured to use (usually your internet provider's), and that resolver asks us. What reaches our nameservers is that somebody's resolver wanted the address, not that you did. None of it reaches us in a form we can see or retrieve.

Lawful basis: legitimate interests (Art 6(1)(f)) — serving the site and keeping it up.

If we ever add a contact form, a booking link, an embedded video or anything else that talks to a third party, this section changes before the feature ships, not after.

2.4 You contribute to one of our open-source projects

Some of our software is published openly, at github.com/CleverLittleGoose. If you open an issue, comment on one, or send a pull request, that is a public act on a public page: your GitHub username, whatever you write, and — on a pull request — the name and email address recorded in your own git commits are visible to anyone, indexed by search engines, and durable. That is how the platform works rather than something we've chosen, and it isn't something we can undo for you.

What we get is what everybody else gets: the page. We keep no separate copy, no contributor list, and nothing that ties a GitHub account to anything else we know about you. If you also email us, the two stay unconnected, because there is nothing joining them.

A word on the email address in a commit, because it surprises people and it is easier to prevent than to fix. Git records an address in every commit you make, and publishing the commit publishes the address. GitHub can give you a private one instead; the setting is in your own account and we can't set it for you. Worth knowing before your first pull request rather than after it.

You never have to use any of this. Everything we publish can be read without an account, and if you'd rather raise something with us privately, email is in §2.1 and reaches the same person.

Lawful basis: legitimate interests (Art 6(1)(f)) — maintaining software we've published, and answering the people who use it.

3. What we don't do

Short, and all of it checkable:

1. No marketing lists, no newsletters, no email campaigns. None exist.
2. No analytics. None on the website, none in anything we ship, and nothing anywhere that tells us who you are or what you looked at. One qualification, because "not anywhere" ought to mean it: GitHub shows us aggregate view and clone counts for our public repositories. We didn't add it and can't turn it off, it counts requests rather than people, and it is described in §4 rather than quietly left out of this list.
3. No advertising, no ad networks, no tracking pixels, no retargeting.
4. No profiling, and no automated decision-making that produces legal effects or anything similarly significant. Nothing here makes a decision about you at all; a person reads your email and replies to it.
5. No special category data — no health, biometric, racial, political, religious or trade union data. We have no reason to hold any and no field that invites it.
6. No selling, renting or sharing data with brokers or "trusted partners." There is no version of this company where that happens.
7. No AI tools processing your correspondence. Our mail is just mail. We don't run it through anything.

4. Who else sees it

Two processors, and only two.

Zoho, as our processor, under a data processing agreement, on its European data centre. That's where our mail and calendar live, so it's the one that touches your correspondence.

Hetzner, also as our processor, also under a data processing agreement, in Germany 🇩🇪. They host cleverlittlegoose.com, answer its DNS, and are the registrar for the domain (§2.3). They see the web server logs described above; they never see your correspondence.

On the registrar part, because it's a different kind of relationship and worth separating: registering a domain means the registrant details (our company name, address and contact) are held by the registrar and the registry under ICANN's rules. That's data about us, not about you, and no part of it involves anything you send us. It's mentioned only because naming Hetzner without saying what all three jobs are would be less than complete.

On GitHub, which is a different kind of relationship again, and separated for the same reason as the registrar. We publish open-source software there (§2.4). GitHub is not on the list above because it is not our processor: it never sees your correspondence, and we send it nothing about you. What sits on those pages is what people put there themselves. Open an issue on one of our repositories and you are acting as a GitHub user, under your own agreement with GitHub. GitHub is the controller of your account, not us, and we read and reply to what you wrote much as we would an email. GitHub is a US company and those pages are hosted in the United States, which is a property of publishing in public rather than a transfer we make on your behalf. If you would rather not be on an American platform, write to us instead (§2.1) and nothing about you goes near it.

Beyond that, only where a specific job requires it and only what that job requires: an accountant or bookkeeper when there is one, a bank or payments provider in order to pay or be paid, a professional adviser if we take advice on a matter you're part of, and a court, regulator or law enforcement body where we're legally obliged. Each of those is a real recipient rather than a hypothetical, and this section will name them by name once they exist.

If we ever sold or restructured the business, records would pass to whoever took it on, and the commitments in this policy would go with them.

5. Where your data goes

Your correspondence is stored in the European Economic Area. Our mail and calendar are Zoho, on Zoho's European data centre, under a data processing agreement with Zoho Corporation B.V. (Netherlands).

And the website is in Germany, with Hetzner (§4). Their agreement with us doesn't merely happen to be European — clause 3(1) of it commits them to processing "exclusively in a member state of the European Union or in another member state party to the Agreement on the European Economic Area." A contractual promise rather than a setting on a control panel.

Which makes this the shortest section in the document. Both of them are in the EEA, the UK recognises the EEA as providing adequate protection, and so nothing here needs a special mechanism. No standard contractual clauses to point at, no adequacy certification to keep an eye on, nothing that could quietly stop applying.

One qualification, because "stored in the EEA" is a claim about storage and shouldn't be read as more. Zoho is a global group, and its data processing agreement permits its companies outside the EEA to reach that mail where supporting the service requires it, under the standard contractual clauses in that agreement. We'd rather say so than let the sentence above imply something stronger than it is.

Hetzner's subcontractor list needs the same treatment, because it names companies in the United States and Singapore and would be alarming without the qualifier that follows it: those apply to customers who chose a server in those places. Ours is in Germany. We'd rather point that out than have you find it and wonder.

You can check all of this without taking our word for it. Zoho publishes its data processing agreement and its list of sub-processors on zoho.com; Hetzner publishes both on hetzner.com. The UK's adequacy regulations for the EEA are on legislation.gov.uk. If you'd like any of it in a form that isn't a link, ask and we'll send it.

On the New Mexico registration. The company is registered in New Mexico. That's where the company is registered; it isn't a statement about where any particular piece of data sits, and every route by which data reaches anyone other than us is described above and named.

6. How long we keep things

Six years for contractual records is the limitation period for a contract claim in England and Wales (Limitation Act 1980, s.5), so it's how long we might need the file if something went wrong, not an arbitrary number.

Your right to erasure doesn't override the retention we're legally required to keep, or anything we need for a legal claim (UK GDPR Art 17(3)(b) and (e)). We'd rather say that here than surprise you with it when you ask.

7. Your rights

You have the right to access your data, to have it corrected, to have it erased, to restrict or object to how we use it, to portability, and to withdraw consent where we've relied on it (we mostly haven't — see §2).

Your right to object

You can object at any time to any processing we base on legitimate interests — correspondence, running our business relationships, and the website's server logs. Email privacy@cleverlittlegoose.com. You don't have to give a reason, and we'll stop unless we can show compelling grounds that override your rights.

How to ask: email privacy@cleverlittlegoose.com and say what you want. You don't need to cite an article or use particular words.

What we need from you. Enough to find you — realistically, the email address you corresponded from. If a request arrives from an address we've never seen, asking us to send someone else's correspondence somewhere, we'll ask a question or two before we do anything, which is the point of the check rather than an obstacle to it (Art 12(6)).

How long we take, and what it costs. We'll respond within one month. If a request is genuinely complex we can extend that by up to two further months, but legally we have to tell you inside the first month and we have to say why. There's no charge. We can only refuse a request if it's manifestly unfounded or excessive, or where the law says the right doesn't apply, and if we ever refuse one we're required to tell you which reason and what you can do about it rather than going quiet.

Complaining. You can complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113 — and you don't need our permission or our involvement to do it. If you're outside the UK and your country has its own data protection authority, you can complain to them instead. We'd rather you came to us first, but it's your right and we're not going to bury it at the bottom of a paragraph.

8. Security, and telling you if it goes wrong

Our mail and calendar are in Zoho, reached over encrypted connections, with two-factor authentication on the accounts. The website is served over HTTPS. There is no separate company database to breach, because there isn't one — the data described in this policy is email and documents.

If a breach put you at real risk, we'd tell you — and unlike the app, we usually can, because if we hold your data at all we almost certainly hold an email address for you. We'd report it to the ICO within 72 hours where the rules require it.

9. Children

This is a business-to-business notice about company administration. We don't knowingly collect personal data about children, and there's no part of the company's activity aimed at them.

10. Changes

If we change how any of this works, we'll update this policy with a new version number and the date at the top to reflect when the change was made. Major version numbers are reserved for when we change what we do. Minor version numbers will tell you if we've made an edit which doesn't change the substance of the policy. The likeliest reason for a major version change is the company starting to use a tool it doesn't use today; an accountant, a payments provider, a CRM. If that happens, this document says so before the tool starts processing anybody's data, not afterwards.

You can find previous versions of this policy at cleverlittlegoose.com/versions/.

Questions, arguments, or a hole in our reasoning: privacy@cleverlittlegoose.com.