Privacy Policy | The Explainable Broker

Scope

This notice follows the public experience.

This notice explains how The Explainable Broker handles information connected with the website, The Readout newsletter, article comments, the case-submission form, and scheduling. It does not govern a separate client or employment relationship, which would come with its own agreements and notices.

The Explainable Broker is created by Scott Iwanowski. Privacy questions and requests can be sent to [email protected].

Information the site may receive

What arrives depends on what you choose to do.

Subscribe or read

Email address, subscription status, preferences, delivery and engagement activity, and device or network information handled through Beehiiv.
Submit a case

The fields you complete, such as email, role or organization context, the generalized question, and your publication-permission choice, plus a case reference and security signals.
Schedule time

Name, email, time zone, meeting selection, availability, and anything you add to the booking form, handled through Cal.com and connected calendar or meeting services.
Comment or respond

Your Beehiiv account or profile information, the content you post, reactions, and related timestamps or moderation information.
Use the site

IP address, browser and device details, approximate region, referring page, pages or features used, timestamps, diagnostic events, and security signals.

How information is used

Use follows the reason it was provided.

Deliver The Readout and manage subscriptions, preferences, and unsubscribes.
Review a case, decide whether to follow up, and consider an anonymized version only when the selected permission allows it.
Arrange and prepare for a requested conversation.
Operate comments and other reader features.
Protect the site and forms from spam, fraud, automated abuse, and security threats.
Measure basic performance, diagnose errors, and improve the website and its content.
Comply with legal obligations and enforce the site’s terms.

Where a law requires a legal basis, the basis may be your consent, steps taken at your request, a legitimate interest in operating and protecting the service, or a legal obligation. Consent can be withdrawn for future activity, although withdrawal does not undo processing that was lawful before it was withdrawn.

Case submissions and permission

The form is for a decision pattern—not a person’s record.

Do not submit PHI, diagnoses, claim-level facts, member names, identifying information, confidential employer files, or material you are not authorized to share. If sensitive information is sent by mistake, contact Scott promptly so it can be located and handled appropriately.

A case submission is for consideration. It does not promise an analysis, publication, or response. The form’s permission choice controls whether an anonymized case may be considered for publication. Choosing “Private only” means the submission should not be published.

If a general inquiry later becomes a conversation about professional services, any additional information and its use will be addressed through the documents for that separate relationship.

Cookies and similar technologies

A page can remember more than a cookie.

The site and its providers may use cookies, local storage, session storage, pixels, scripts, and similar technologies. Some are needed to deliver or protect a feature. Others help measure performance, diagnose errors, collect feedback, or connect a social or scheduling feature.

Core operation: Beehiiv uses first-party browser storage such as language, visit_token, last_resource_guid, page_view, and beehiiv_anonymous_user_id to publish the site, remember state, and understand readership. Cloudflare may use __cf_bm or cf_clearance for delivery and security. The case form may use __Host-appgarden-visitor as part of its operation.
Security and abuse prevention: Cloudflare Turnstile protects the case form. On Beehiiv-hosted pages, HUMAN Security (also associated with PerimeterX or PX Cloud) and Stytch may process browser, device, network, and interaction signals or store identifiers to distinguish ordinary activity from automated or abusive traffic. HUMAN/PerimeterX may use cookies such as _pxvid, _px3, and pxcts, along with local or session storage.
Performance and diagnostics: Cloudflare Web Analytics provides aggregate traffic information and is designed to operate without cookies or local storage. Sentry may receive technical error, page, browser, device, and request context when something fails.
Feedback and support: Beehiiv loads Birdie for platform support and troubleshooting. Birdie may receive browser, device, activity, cookie, and IP information along with any feedback you choose to provide.
Social features: Article pages connect to sharing or embed technology from X (formerly Twitter) and Bluesky. Those providers may receive device, browser, network, and interaction information under their own privacy practices.
Scheduling: The scheduling page connects to Cal.com when the scheduling tool is loaded. Cal.com may use cookies or storage to operate the booking flow, remember settings, and protect the service. The page also requests presentation code from unpkg.com, which receives the ordinary technical data sent with a web request.

Where the site presents Beehiiv’s consent panel, “Necessary” technologies remain on and you may accept, reject, or customize the optional “Marketing” and “Data Processor” categories that the panel supports. Your choice is stored in your browser and may remain there for up to about 1,000 days unless you clear or update it. The panel controls configured Beehiiv pixels; it does not currently stop Beehiiv readership measurement, Birdie, HUMAN/PerimeterX, Stytch, Sentry, Cloudflare services, the Cal.com scheduling tool, or X/Bluesky article code from loading. Browser controls may therefore be needed in addition to the site’s consent tool.

At the date of this notice, no separate Meta, X advertising, TikTok, Google Analytics, Google Tag Manager, or AdSense pixel is configured in Beehiiv for this site.

Service providers and disclosure

A small site still has a working stack.

Information is disclosed when needed to operate the requested feature, protect the service, comply with law, or complete a business transition. The Explainable Broker does not rent contact information or sell it as a mailing list.

Beehiiv

Website hosting and features, subscriber records, newsletters, delivery and engagement reporting, accounts, and comments.

Airtable

Storage and review of case submissions and their permission choices.

Cloudflare

Network delivery, website analytics, case-form hosting, security, and Turnstile abuse prevention.

Resend

Operational failure alerts containing technical error details and, when available, an opaque case reference—not the submitter’s email, IP address, case narrative, or confidential files.

Cal.com

Appointment availability, bookings, reminders, and related scheduling data.

Security and diagnostics

HUMAN Security, Stytch, and Sentry help Beehiiv detect abuse, understand device signals, and diagnose errors.

Birdie

Feedback and support tools available through the Beehiiv-hosted experience.

X and Bluesky

Social-sharing and embed features that may appear on article pages.

These providers process information under their own contracts and privacy notices. Information may also be disclosed when reasonably necessary to respond to lawful process, protect rights or safety, or investigate misuse.

Your choices

The practical controls are close to the action.

Email: use the unsubscribe or preference link in any publication email.
Cookies and storage: use the site’s consent control when shown, or your browser settings to block or clear cookies and site data. Blocking core storage may prevent forms, login, comments, or scheduling from working correctly.
Social features: avoid social buttons or use browser privacy controls if you do not want a social platform to receive the related request.
Scheduling: contact Scott by email instead of using the Cal.com booking flow.
Case submission: choose the permission option that matches your intent, or schedule a conversation without submitting a case.

Retention and security

Keep what has a job. Remove what does not.

Information is kept only as long as reasonably needed for the purpose described here, including follow-up, recordkeeping, security, resolving disputes, and legal obligations. Subscription information may remain in Beehiiv after an unsubscribe so the preference can be honored. Case, scheduling, diagnostic, and security data may follow different provider retention schedules. Information may also remain temporarily in backups.

Reasonable technical and organizational safeguards are used, including access limits and abuse controls. No website, email, or cloud service can guarantee perfect security. Please do not use the site to send information that requires a secure clinical, legal, or client-file channel.

Privacy rights

Ask what is there, or ask for a change.

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of personal information, object to certain uses, or withdraw consent. To make a request, email [email protected] with “Privacy request” in the subject line. Enough information may be requested to verify the person making the request and locate the relevant records.

A request will be handled in line with applicable law. Some information may be retained when required for security, legal, recordkeeping, or suppression-list purposes.

Other details

A few boundaries worth naming.

Children. The site is intended for adults working with employee benefits decisions and is not directed to children under 13. Personal information from a child is not knowingly sought.

Data location. The site and its providers operate in the United States and other countries. Information may therefore be processed outside the place where you live, subject to the safeguards used by the relevant provider and applicable law.

Changes. This notice may be updated as the site, service providers, or legal requirements change. The date below will be revised when a new version is posted.

Privacy should be explainable, too.