Privacy
This is a place for writing, learning and conversation. I collect information to keep the website running, respond when you contact me and, with your permission, understand how the site is used so I can improve it. I do not use this website for advertising or remarketing.
Who is responsible
This website is operated by David J. Norris, based in Brisbane, Australia. For questions about your information, contact Privacy@davidjnorris.com. This notice covers davidjnorris.com and the enquiries handled through it. Clinical services have their own privacy information and contact arrangements.
What is collected and why
You can read this website without creating an account or providing your name. The services that deliver and protect the website process technical information, such as your IP address, browser information, requested pages and the time of a request, to deliver pages, investigate faults and maintain security.
If you contact me, I receive your email address, any name you provide, your message and related correspondence. I use these to respond and manage the conversation. You can use a preferred name where practical. Without a working reply address, I may be unable to respond.
Please do not send medical records, patient information or other sensitive personal details through this website. It is not a clinical intake service. If such information arrives unexpectedly, I will limit access and assess whether it should be securely deleted or handled through an appropriate channel.
Cookies and similar technologies
With your permission, I use Google Analytics 4 to understand which pages are read and how people navigate the website. Google receives usage information such as page views, interactions, browser and device details, approximate location and cookie identifiers. I use the reports to improve content, navigation and usability, not for advertising or remarketing.
Analytics is off until you select Accept analytics. Declining does not prevent you from reading the website. You can change your choice or withdraw permission through Analytics settings in the footer. Withdrawal stops future analytics collection; it does not automatically erase information already collected. Contact me about deletion requests.
Cookie Inventory:
_ga: Used by Google Analytics to distinguish users (Expiry: 90 days)._ga_G-SZQG00RYZN: Used by Google Analytics to maintain session state (Expiry: 90 days).fs-cc: Stores your consent preference choices (Analytics / Marketing / Essential) locally in the browser (Expiry: 180 days / 6 months).
Subscriptions and external websites
If you choose to subscribe to Notes on Human Agency, the subscription takes place on Substack. I receive subscriber information to manage the publication and send the updates you requested. You can unsubscribe using the link in an email. Contacting me does not add you to the mailing list.
Substack operates its own platform and processes information under its privacy policy. Other external sites have their own practices. Following a link takes you to that service. This website's approach to tracking does not describe what those services do. Substack Privacy Policy
Who handles information
I use Webflow for website hosting and form processing, Google Analytics 4 for optional website measurement, iubenda for privacy and consent management, and Substack for subscriptions. Authorised support staff have access where needed. Information may also be disclosed where required by law. I do not sell personal information or provide it for targeted advertising.
Overseas handling
These services may process information in the United States and other countries [INSERT VERIFIED RECIPIENT COUNTRIES/TRANSFER ARRANGEMENTS]. I take steps required by applicable law to protect overseas handling. For information about safeguards, contact Privacy@davidjnorris.com.
Keeping information
I keep routine enquiries for up to 12 months after the conversation closes, unless an ongoing engagement or legal requirement justifies longer retention. GA4 user and event retention is two months, with reset on new activity disabled; this does not apply to standard aggregated reports. Subscriber details are retained while subscribed, with limited consent and unsubscribe records retained as needed to demonstrate and respect choices. Technical logs and backups follow provider deletion cycles (30 days for security logs and 90 days for rolling backups).
Security
I use reasonable safeguards to protect personal information, including restricted access and account security. No internet service is completely secure. Please use the contact details above if you believe your information has been mishandled.
Your choices and concerns
You can contact privacy@davidjnorris.com to ask about information held about you, request access or correction, or ask for deletion. I will consider your request under the laws that apply and explain any limits. I may need to verify your identity using only what is reasonably necessary.
If you have a privacy concern, please describe it in an email. I aim to respond within 30 days, or sooner where the law requires. If you are not satisfied, you may be able to contact the Office of the Australian Information Commissioner atoaic.gov.auor the relevant privacy regulator in your country.
International Data Protection Notice (EU / UK)
Where EU or UK data protection law applies, I rely on legitimate interests for security and general correspondence, steps requested before a contract for relevant engagement enquiries, and consent for optional analytics and subscriptions. You may have rights to erasure, restriction, objection and portability, as well as access and correction. You can withdraw consent without affecting earlier lawful processing and complain to your supervisory authority. I do not use your information for solely automated decisions with legal or similarly significant effects.
Changes
I will update this notice when the website or its information practices change. Last updated: 14 September 2026.
