Short version, in plain English.
- This site doesn’t sell anything, doesn’t ask you to sign up, and doesn’t run an email list. Patreon handles the patrons, separately.
- The contact form sends a message straight to me. That’s the only place you’d hand over personal information on the site itself.
- Anonymous analytics are off by default. If you accept cookies, an anonymised count of which pages get visited goes to Google Analytics so I can see what people are reading. Reject and that doesn’t happen.
- Audio plays from Libsyn, the show’s podcast host. Clicking play streams the MP3 from their servers.
- Instagram embeds on the homepage and gallery load only if you accept cookies. Reject and you see placeholders instead.
- Cloudflare keeps the site online and secure. It uses one cookie to spot suspicious traffic. Nothing personal.
That’s everything that matters. The legal detail is below if you want it.
The basics
This page explains how Kol Cambridge handles personal data. Kol Cambridge is run by Samuel Green as a sole trader. The site is hosted in Israel. The show is recorded in Tel Aviv. Most listeners are in the UK, Israel, the US and the rest of the diaspora, so this policy is written to satisfy the UK GDPR, the EU GDPR and the Israeli Privacy Protection Law 5741-1981. Whichever applies to you, you get the rights it gives you.
To reach me about anything in this policy, email [email protected].
Who’s the data controller
The data controller is Samuel Green, trading as Kol Cambridge, with no separate company. Contact: [email protected]. If you need a postal address for a formal data request, write to the email above and I’ll provide it.
What this site collects
Three things, in order of how much data is involved.
1. Server access logs (automatic, every visit). Like every website, the hosting server records the IP address that made the request, the URL, the timestamp, the response code and the browser’s user-agent string. That’s standard web hosting log behaviour, used to spot abuse and fix bugs. Logs are kept for up to 30 days, then rotated out. Legal basis: legitimate interest in running a website safely.
2. Anonymised analytics, only if you accept. If you accept the cookie banner, Google Analytics 4 records anonymised visit data: which pages were viewed, how long the visit lasted, rough country of origin (not city, not IP). IP-anonymisation is on. This is used to see which episodes and posts are read most. Reject and nothing goes to Google. Legal basis: your consent.
3. The contact form. Filling in the form sends me your name, email and message via email. I read it. I reply if a reply makes sense. I don’t add you to any list, share it with anyone, or feed it into any tool. The form (Contact Form 7) doesn’t store submissions in the site’s database. Legal basis: legitimate interest in responding to people who write in.
That’s all the site collects. There’s no account system, no e-commerce, no email signup, no remarketing pixels and no third-party advertising on this site.
Third-party services this site talks to
These are the only outside services your browser communicates with when you load a page:
- Cloudflare — sits in front of the site to keep it fast and to block obvious attacks. Sets one strictly-necessary cookie called
cf_clearanceto confirm you’re a real visitor and not a scraping script, plus__cf_bmfor bot management. Doesn’t set marketing cookies and doesn’t profile you. Cloudflare’s privacy page. - Libsyn (audio host) — when you click play on any episode, the MP3 streams from
traffic.libsyn.com. Libsyn records the request in standard server logs. No iframe is loaded on the page before you click; loading an episode page on its own doesn’t talk to Libsyn. Libsyn’s privacy page. - Google Analytics 4 — only if you’ve accepted analytics cookies. Records anonymised visit data, as explained above. Google’s privacy page.
- Patreon — there’s a button to support the show on Patreon. That’s a link out, not an embed. Patreon only sees you if you click through and visit their site. Patreon’s privacy page.
- Instagram — the homepage and gallery embed recent posts from @kol.cambridge so you can see the show’s covers and behind-the-scenes shots. Instagram embeds load only if you accept the “Embeds” category in the cookie banner. When they load, Instagram (Meta) sets its own cookies for browser fingerprinting and security. Instagram’s privacy page.
Your rights
Depending on where you live, the UK GDPR, EU GDPR or Israeli Privacy Protection Law gives you various rights over your data. They overlap closely. You can:
- Ask what data is held about you (right of access)
- Ask for it to be corrected if it’s wrong
- Ask for it to be deleted (the “right to be forgotten”)
- Ask for it to be exported in a portable format
- Object to specific kinds of processing
- Withdraw consent at any time, where consent is the legal basis (the cookie banner is the place to do this for analytics)
- Lodge a complaint with the regulator in your country:
- UK: Information Commissioner’s Office, ico.org.uk
- EU: your national data protection authority. The EDPB has a list at edpb.europa.eu
- Israel: the Privacy Protection Authority, gov.il
To make any of these requests, email [email protected]. I’ll respond within a month. There’s no fee.
How long data is kept
- Server access logs: 30 days, then rotated
- Contact form messages: kept in my email inbox indefinitely so I can find old threads, unless you ask me to delete them
- Analytics data: Google Analytics retention is set to 14 months
- Cookies on your device: see the cookie policy for individual expiry times
Changes to this policy
If something material changes, I’ll update this page and add a note at the top with the date. The current version is dated below.
Last updated: 25 May 2026.