Last updated 28 August 2026
Who is responsible
Ampersand Lab is operated by Aaron as sole controller of any personal data it processes. Contact: elinglesdexunqueira@gmail.com.
What is collected
If you only read the site
No account, no tracking cookies, no profiling, and no information that identifies you.Page views are counted for basic analytics: the page path, referrer site, browser, operating system, date and time. These are recorded locally on the server by Nanolytics and not shared with any third party. No data leaves the server.
The web server also keeps short-lived operational logs in the ordinary course of serving requests.
What is recorded for page views
For each page view, the following is recorded locally:
| Item | Details |
|---|---|
| Page path | The URL path, e.g. /catalog. Query strings are stripped, so tokens in a link are never recorded. Where a path contains a lesson booking reference, that reference is replaced before recording, so a page view cannot be traced to a particular booking. |
| Referrer site | The site the visitor arrived from, e.g. https://www.google.com. Only the site address is recorded, never the full link. |
| Browser | The browser name from a fixed list: Firefox, Chrome, Safari, Edge, Opera, Internet Explorer, Unknown. |
| Operating system | The OS from a fixed list: Windows, macOS, Linux, Android, iOS, Unknown. |
| Date and time | When the page was viewed. |
Not recorded: IP addresses, cookies, visitor identifiers, or any way to link two page views to the same person. If your browser sends "do not track" or Global Privacy Control, you are not counted at all.
If you create an account
- Identity
- Your name and email address, and whether the address has been verified.
- Authentication
- A hashed password. The plain password is never stored.
- Sessions
- A session record with its IP address and browser user-agent, used to keep you signed in and to limit abuse.
- Learning progress
- Which lessons you have marked complete, so your dashboard can show it.
If you book a lesson
- Booking
- The service, start and end time, and your timezone.
- Payment
- Payment status and the reference returned by the payment provider. Card details are handled entirely by the provider and never reach this server.
- Calendar
- If you connect a calendar, its access credentials are stored encrypted and used only to check availability and write lesson events.
- Classroom
- A record that a session took place. Lessons are not recorded.
Legal basis
- Contract — Article 6(1)(b)
- Account, booking, payment and classroom data, needed to provide the lesson you asked for.
- Legitimate interest — Article 6(1)(f)
- Session records and rate limiting, to keep accounts secure. Page view counting, to understand which lessons are most used. Weighed against your interests and limited to what is necessary for each purpose.
- Legal obligation — Article 6(1)(c)
- Retaining payment records for the period tax law requires.
- Consent — Article 6(1)(a)
- Currently used for nothing. If optional processing is ever added, it will be opt-in and refusal will not affect access.
Cookies
Only strictly necessary cookies are set: a session cookie once you sign in, and a CSRF token. Both are essential to operate an account, so under the ePrivacy Directive they do not require consent.
There are no analytics, advertising or third-party cookies. Page counting does not add a consent requirement either: the ePrivacy Directive requires consent for storing or reading information on a visitor's device. Nothing is stored on your device — no cookie, local storage, or device identifier — so there is no consent requirement.
Sharing
Personal data is not sold, rented or shared for marketing. It is disclosed only to:
- the payment provider you choose, to take payment;
- your calendar provider, if you connect one;
- the email provider used to send verification, password reset and lesson reminder messages;
- a public authority where the law requires it.
The platform is self-hosted in Germany on infrastructure operated by the controller.
How long it is kept
- Account
- Until you delete it. Deletion is available on your profile page and removes your profile and progress.
- Sessions
- Until expiry or sign-out.
- Bookings and payments
- Retained for the period tax and accounting law requires, then deleted.
Your rights
Under the UK GDPR and EU GDPR you may:
- Access — ask for a copy of your data.
- Rectify — correct anything inaccurate; your profile page covers most of it.
- Erase — delete your account, which you can do yourself at any time.
- Restrict — ask that processing be paused while a dispute is resolved.
- Port — receive your data in a machine-readable form.
- Object — object to processing carried out under legitimate interest.
- Withdraw consent — where processing relies on consent.
Email elinglesdexunqueira@gmail.com to exercise any of these. A response is due within one month. You also have the right to complain to your national supervisory authority.
Security
- All traffic is served over HTTPS; plain HTTP is redirected.
- Passwords are hashed, never stored in readable form, and must be at least 12 characters.
- Calendar credentials are encrypted at rest.
- Card details never reach this server.
- Databases are not reachable from the public internet.
Breach notification
A personal data breach that is likely to result in a risk to your rights will be reported to the supervisory authority within 72 hours of becoming aware of it, and to you directly where the risk is high.
Children
The platform is intended for adult learners and accounts are not knowingly created for children under 16. If you believe a child has created an account, contact the address above and it will be removed.