[Legal] Privacy
Privacy Notice
Effective November 7, 2026
In short
- We collect only what you send us — through the project form or by email — plus the basic technical data needed to run this site.
- We use it to reply to you and discuss your project. We do not sell it, do not share it for advertising and use no advertising or tracking cookies.
- Write to [email protected] to see, correct or delete your information at any time.
01Who we are
AlfaLab Engineering (“AlfaLab”, “we”, “us”) runs getalfalab.com and is responsible for the personal information described here. For anything about your data, write to [email protected]. We reply within 30 days, usually much sooner.
This notice covers the website and our replies to project requests. If we later work together, the contract for that project sets out how client and project data are handled.
02What we collect
What you give us
- Project requests sent through getalfalab.com/start: your name, work email, company or website (optional), budget and timeline ranges, the services you select and what you write about your project.
- Emails you send us: your address and whatever you choose to include.
Please don’t include sensitive information — health data, financial account numbers, government ID numbers or passwords. We don’t need it.
What is collected automatically
- Delivery and security data. When you open a page, our hosting provider Cloudflare processes your IP address, browser type and the page requested in order to deliver the site and protect it from attacks.
- With a project request we store the country your request came from and a one-way hashed fingerprint of your IP address, used only to limit spam. We do not store your IP address itself, and the fingerprint is erased after one day.
- Visit statistics. Cloudflare Web Analytics counts page views and records the referring site, browser and device type and country. It uses no cookies, does not build profiles and does not follow you across other websites.
04How we use it
| Purpose | Legal basis under the GDPR |
|---|---|
| Reply to your request, ask follow-up questions and prepare a proposal | Steps you asked for before a possible contract — Art. 6(1)(b) |
| Run, secure and improve the website; block spam and abuse | Our legitimate interest in a safe, working website — Art. 6(1)(f) |
| Keep business records if we work together | Legal obligation — Art. 6(1)(c) |
We do not make automated decisions about you, do not profile you and do not send marketing emails unless you ask for them.
06How long we keep it
- Project requests: deleted automatically 24 months after we receive them. Requests marked as spam are deleted within 30 days.
- IP fingerprints: erased after one day.
- Email: kept while we are in conversation and for as long as needed for the purposes above.
- If we work together: records needed for the contract, accounting and taxes are kept as long as the law requires.
We also periodically clear old notifications from our team chat. You can ask us to delete your information earlier at any time.
07International transfers
Our providers may process data in the United States and other countries. When personal information from the EU, EEA, UK or Switzerland is transferred to a country that has no adequacy decision, the transfer relies, where the law requires it, on recognised safeguards such as the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) or the European Commission’s Standard Contractual Clauses.
08California residents
This section adds to the notice above for residents of California under the California Consumer Privacy Act as amended by the CPRA, and the California Online Privacy Protection Act.
What we collected in the last 12 months
| Category | Examples · source · use |
|---|---|
| Identifiers | Name, email address, IP address · from you and your device · to reply to you and secure the site |
| Commercial information | Services, budget and timeline you choose · from you · to prepare a proposal |
| Internet activity | Pages viewed, referring site, browser and device type · from your device · to run and improve the site |
| Approximate location | Country · derived from your IP address · spam prevention and statistics |
| Professional information | Company or website you enter · from you · to understand your request |
We disclose these categories only to the service providers listed in section 5, for the business purposes described above. We do not sell or share personal information, have not done so in the past 12 months, and do not collect sensitive personal information. We have no actual knowledge of selling or sharing information of anyone under 16.
Your rights
- Know what personal information we collect, use and disclose, and get a copy of it.
- Correct inaccurate information and delete your information.
- Opt out of the sale or sharing of personal information — we do neither, so there is nothing to switch off.
- Not be treated differently for exercising any of these rights.
To make a request, email [email protected] with the subject “Privacy request”. We verify requests by confirming that you control the email address in question. You may use an authorized agent, who must show your written permission. We respond within 45 days, as the law allows.
Do Not Track and Global Privacy Control
We do not track visitors across other websites over time, so a Do Not Track signal does not change anything here. We treat a Global Privacy Control (GPC) signal as a valid request to opt out of sale and sharing — even though we do neither.
Shine the Light
We do not share personal information with third parties for their own direct marketing purposes.
09EU, EEA, UK & Switzerland
If the GDPR, UK GDPR or the Swiss Federal Act on Data Protection applies to you, you have the right to:
- access your personal information and receive a copy;
- have it corrected or erased;
- restrict how we use it;
- receive the information you gave us in a portable format;
- object at any time to processing based on our legitimate interests;
- lodge a complaint with your local data protection authority.
Write to [email protected] to use any of these rights; we reply within one month. Giving us your name and email is necessary for us to reply to a project request — everything else in the form is optional.
10Security
The site is served only over encrypted connections (HTTPS with HSTS). Project requests are stored in a private database that is not reachable from the public site; our team inbox has no password to steal — each sign-in uses a one-time link valid for 10 minutes, and sign-in tokens are stored only as hashes. No method of transmission or storage is perfectly secure, but we design every system we run to keep exposure to a minimum.
11Children
This website is for businesses and is not directed to children under 16. We do not knowingly collect their personal information; if you believe a child has sent us information, write to us and we will delete it.
12Changes and contact
If we change this notice, we will update this page and the effective date at the top. For any question or request about your personal information, email [email protected].