Privacy policy

Who is responsible for your data

XXXXX (trading as Aliyah Labs) is the data controller for the personal data described here — meaning we decide why and how it is processed.

Company

XXXXX

Registration

XXXXX

Address

XXXXX, XXXXX XXXXX, XXXXX

Email

hello@aliyahlabs.com

What we collect

When you submit the contact form, we receive only what you type into it:

• Your name
• Your company name
• Your email address
• The description of your problem or project
• The budget range and timeline you select

What we do not collect

We do not ask for payment details, identity documents, or any special category of data such as health, ethnicity, religion or political opinion. Please do not include information of that kind in the enquiry box.

We do not build a profile of you, and no automated decision-making or profiling takes place.

Server logs

Our hosting provider records standard technical information for every request — IP address, timestamp, page requested, browser and operating system. This is generated automatically by the infrastructure, is used only to keep the site running and secure, and is not linked to your enquiry or used to identify you.

Why we are allowed to process it

Under the GDPR every use of personal data needs a lawful basis. Ours are:

• Steps taken at your request before entering a contract (Article 6(1)(b)) — replying to your enquiry and scoping the work.
• Legitimate interests (Article 6(1)(f)) — keeping a record of business enquiries, and keeping the site secure and available. We have weighed this against your interests and consider it proportionate, because the data is limited to what you chose to send us.
• Legal obligation (Article 6(1)(c)) — where tax or accounting law requires us to retain records of work we have done.

How long we keep it

Enquiries are kept while the conversation is active and for 24 months afterwards, so we can pick up where we left off if you come back. After that they are deleted.

If we go on to work together, the records become part of the engagement and are kept for as long as tax and accounting law requires — commonly seven years. Server logs are kept for a short period only, as set by our hosting provider.

You can ask us to delete your enquiry sooner. See "Your rights" below.

Who else sees it

We do not sell your data, and we do not share it for advertising. It is handled by the providers we use to run the studio, each under a data processing agreement that forbids them from using it for their own purposes:

• Vercel Inc. — Website hosting and delivery. Processing location: United States (EU data processing region available). Transfer safeguard: EU Standard Contractual Clauses / EU-US Data Privacy Framework.
• XXXXX — Email delivery for enquiries. Processing location: XXXXX. Transfer safeguard: XXXXX.
• XXXXX — Where enquiries are stored once received (CRM, inbox, project tool). Processing location: XXXXX. Transfer safeguard: XXXXX.

Transfers outside the EEA

Some of the providers above operate outside the European Economic Area. Where that is the case, the transfer is covered by the safeguard named alongside them — typically the European Commission's Standard Contractual Clauses, or an adequacy decision. You can ask us for a copy of the relevant safeguard.

Cookies and tracking

This website sets no cookies and stores nothing in your browser. It runs no analytics, no advertising pixels and no session recording, and it loads no scripts, fonts or embeds from third-party servers — the typefaces are served from this domain, so no request is made to Google or anyone else while you browse.

That is why you have not been shown a cookie banner: there is nothing to consent to. The cookie policy sets this out in full.

Your rights

Under the GDPR you can ask us to:

• Give you a copy of the personal data we hold about you (access).
• Correct it if it is wrong or incomplete (rectification).
• Delete it (erasure).
• Restrict how we use it while a question about it is resolved.
• Send it to you, or to someone else, in a portable format.
• Stop processing it where we rely on legitimate interests (objection).

How to exercise them

Write to hello@aliyahlabs.com. We will respond within one month, as the GDPR requires. There is no charge, and we will not ask you to justify the request.

If you are not satisfied with how we have handled it, you can complain to your national data protection authority. Ours is XXXXX. You may also complain to the authority in the country where you live or work.

Security

The site is served over HTTPS. Enquiries are transmitted encrypted, and access to them is limited to the people who need it to reply to you. No system is perfectly secure, but the amount of data involved here is deliberately small — the best protection is not collecting what we do not need.

Changes to this policy

If this policy changes, the date at the top changes with it. Where a change materially affects how we handle data you have already sent us, we will tell you directly.