Privacy Policy

The controller of your personal data is the Ala Lab studio, which owns the alalab.work website.

For any question about your data — to see it, correct it or delete it — send a request through the form on the main page and start the text with “Data request”. We reply within 30 days.

You can also write to us by email: hello@alalab.work. A data request can be sent by email too — put “Data request” in the subject.

Requests sent through the form

When you send a request, we receive your name (how to address you), a contact for the reply (Telegram, Discord or email), the project type and the description of your idea. We need this to reply, clarify the task and quote a price and timeline. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). Please do not put unnecessary personal data in the description — it is not needed to estimate a mod.

Along with the request we receive the language of the page it was sent from and where you came to the site from: the tags of the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), if you opened the site through a tagged link (our ads and links in ChatGPT answers carry them, for example), and the domain of the site that referred you — without the address of the page itself. While you move between pages of the site, these tags and the domain travel in the page address; nothing is saved in your browser. The language lets us reply in your language; the source shows us which channels bring clients. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

The request goes to the studio on Telegram and is saved at the same time in our leads database on a server in the EU, so that it cannot get lost in a conversation and we can see how far the work has got. The database holds the same things as the request itself: your name, a contact, the project type, the description of the idea, the page language and the source tags. The IP address is not written to it. Only the owner of the studio has access: getting in takes a check at the door and a password.

Emails

If you write to hello@alalab.work, we receive the email itself: the sender’s address, the text and any attachments you add. Cloudflare Email Routing accepts the emails and forwards them to the studio owner’s mailbox (Gmail), where we read them and reply. We need them only to reply and discuss an order. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Please do not send unnecessary personal data — it is not needed to estimate a mod.

Technical data

Every time a page is opened, the server receives the IP address, browser details (user agent), the page address, the time of the request and the address you came from. These are ordinary web server logs: we need them to keep the site running, find errors and protect the form from spam and brute force — the number of requests from one IP is limited. Legal basis: our legitimate interest in running the site securely (Art. 6(1)(f) GDPR).

Visit statistics

We see anonymised Cloudflare Web Analytics statistics: how often pages were opened, where visitors came from, their country and device type. It works without cookies and does not track you on other websites. Legal basis: our legitimate interest in knowing whether the site works (Art. 6(1)(f) GDPR).

If you click “Accept” in the cookie banner, Google Analytics is switched on as well: it shows us which pages are opened, how long people stay on them, where visitors come from, their country and city, device and browser, how far they scroll and which links to other sites they follow, and the fact that a request was sent — without its content. Google Analytics does not store IP addresses; advertising features and Google signals are off. Legal basis: your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time with the “Cookie settings” link at the bottom of the page. Until you click “Accept”, the site does not load Google Analytics and sends it nothing.

We do not use your data for advertising and do not make automated decisions about you.

The site relies on four services. Each receives only what it needs to do its job:

• Cloudflare, Inc. (USA) — DNS, attack protection, site delivery and web analytics. Every request to the site passes through Cloudflare. It also receives emails sent to hello@alalab.work and forwards them to the studio’s mailbox. Cloudflare policy
• UAB Cherry Servers (Lithuania) — the server the site runs on; the data centre is in the Netherlands (EU). Cherry Servers policy
• Telegram — requests from the form are delivered to the studio’s private Telegram chat. Telegram policy
• Google Ireland Limited (Ireland; for visitors outside the EEA — Google LLC, USA) — Google Analytics statistics, only if you clicked “Accept” in the cookie banner. Through Gmail (Google LLC, USA) the studio also receives the emails sent to hello@alalab.work. Google policy

Your data is not shared with or sold to anyone else.

• Requests — while we discuss and work on the order, then as long as needed for support after release. If no order follows, we delete them within 12 months at the latest: the server does that by itself, once a day. Sooner if you ask.
• Requests that could not be delivered to Telegram right away — wait on our server in the EU and leave the queue as soon as they are delivered and written to the leads database, within 30 days at the latest.
• Emails to hello@alalab.work — while we correspond and work on the order, then as long as needed for support after release. If no order follows, we delete them within 12 months of the last email at the latest. Sooner if you ask.
• Web server logs — 14 days, then deleted automatically.
• Data held by Cloudflare — under Cloudflare’s rules (link in “Third-party services”).
• Google Analytics statistics — Google keeps visit data linked to a browser identifier for no longer than 14 months; after that only aggregate figures remain in the reports. Google Analytics cookies stay in your browser for 6 months or until you decline statistics.

The website’s server is in the EU. Cloudflare, Telegram and Google (the mailbox and, if you agreed to statistics, Google Analytics) may also process data in other countries, including the USA. Cloudflare and Google do so on grounds provided by the GDPR (such as the EU Standard Contractual Clauses and the EU-US Data Privacy Framework), Telegram under its own privacy policy; see the policies of these services for details.

The site sets its own cookie alalab_lang only when you choose a language yourself in the menu or in the language suggestion. It remembers your choice for a year so that next time alalab.work opens straight in that language. It holds only the language code (for example, de): it is not used for tracking and is not passed to anyone. The cookie is set by your own action and serves only this setting, which is why we do not ask for consent to it. You can remove it by clearing the site data in your browser settings.

A second cookie of our own, alalab_consent, remembers your answer in the cookie banner (“Accept” or “Decline”) for 6 months so we don’t ask on every page. It holds only that answer and is not used for tracking.

Only if you clicked “Accept” does Google Analytics set its cookies _ga and _ga_DPK4XZTR5V for 6 months: they hold a random identifier that lets Google tell repeat visits apart. If you click “Decline” or nothing at all, these cookies are not set. You can change your mind at any time with the “Cookie settings” link at the bottom of the page; if you decline, the site deletes the Google Analytics cookies itself. The site stores nothing else in your browser.

One exception is not ours: if Cloudflare’s protection finds a connection suspicious, it may show a short check and, after it, set the technical cookie cf_clearance so it doesn’t ask again. It is only for protecting the site from attacks, isn’t used for tracking, and needs no consent.

The site works over HTTPS only. The server accepts requests only through Cloudflare, the form is protected from spam and brute force, only the owner of the studio has access to the requests and to the panel that keeps them — getting into it takes a check at the door and a password — and service keys are stored encrypted on the server. No one can rule out every risk on the internet, but we do everything reasonable to keep your data away from others.

At any time you can:

• find out what data we hold about you and get a copy;
• correct inaccurate data;
• delete your request and the conversation about it;
• restrict or object to processing;
• receive your data in a portable format;
• lodge a complaint with the data protection authority of your country (for EU residents).

To use any of these rights, send a request through the form on the main page, as described in section 1. We reply within 30 days.

The site is open to everyone, but a request means discussing paid work. If you are under 16, please send the request together with a parent or with their consent. If we learn that we received a child’s data without parental consent, we will delete it.

We update this policy when the way the site works changes. The current version is always on this page, and the date of the last update is shown at the top.