Privacy policy

Last updated 15 October 2026

This policy explains what personal data Flippie Labs collects, why, who helps process it, and what your rights are. If anything is unclear, email me and I will explain it in plain language.

What I collect, and when

• Contact form or email enquiry: your name, email address and the message you write, so I can reply and prepare a quote.
• Technical data when you visit: the hosting provider processes your IP address and basic request data to serve the site and protect it from abuse. I do not use this to identify you.
• Nothing else by default. There is no account to create, and I do not ask for a phone number, a postal address or any special-category data.

Legal basis

I process your enquiry to take steps at your request before entering into a contract, and on the basis of the consent you give when you tick the box on the form. You can withdraw that consent at any time by emailing me. Hosting and security logs rest on my legitimate interest in keeping the site running and safe.

Who helps me process it

I use a small number of service providers. Each processes data only to provide its service to me.

• Vercel (United States) hosts this website. The contact form runs as a function in Vercel's Frankfurt region.
• Resend (United States) sends your form enquiry to my mailbox as an email.
• Cloudflare (United States) provides DNS and forwards mail sent to hello@flippielabs.com.
• Google (United States) provides the mailbox where that mail arrives (Gmail).
• Unsplash (United States) serves the cover photos on the blog at /blog. When you open a blog post, your browser loads its photo directly from Unsplash's image servers, which receive your IP address and basic browser details, as with any image request. Unsplash's own privacy policy applies to that request. No other page loads anything from Unsplash.

Fonts, scripts and all other images are hosted on this site itself, so apart from the blog cover photos above, loading a page does not send your IP address to any other service.

Client project data

For client work, data handling is agreed per project in writing, and I sign a data processing agreement (DPA) and an NDA on request. Some AI automation work uses a language model through the API of OpenAI or Anthropic (both United States). Where that applies, the project agreement says so, I use the provider's business API terms, under which your data is not used to train their models, and I choose EU data processing where the provider offers it. I send a model only what the task needs, for example aggregated figures instead of customer-level rows.

Transfers outside the EU

Several providers above are US companies, so personal data can be processed outside the European Economic Area. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. Where a provider offers EU processing, I use it.

How long I keep it

Enquiries that do not become projects are deleted within 12 months. If we work together, I keep what I need for the project and for legal and tax obligations (Dutch law requires business records to be kept for 7 years), then delete the rest. Client project data is returned or deleted at the end of the engagement, as set out in the DPA.

Analytics and cookies

This site sets no advertising or tracking cookies. If privacy-friendly, cookieless analytics are added, they count visits in aggregate and do not identify you, and this page will name the provider.

What I do not do

I do not sell your data, and I do not share it with anyone for marketing. It goes only to the providers listed above, and to authorities where the law requires it.

Your rights

Under the GDPR you can ask me to access, correct, delete or export your data, or to restrict or object to its processing. Email hello@flippielabs.com and I will respond within 30 days. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.