Privacy Policy — AFF Lab

1. What we collect

Visitor analytics. When you load a page we record an anonymised IP address, the page URL, referrer, browser, device type, and approximate location (country/region). Collected via Google Analytics 4 with IP anonymisation enabled and ad-personalisation signals disabled. Used to understand how the site is used.

Booking data. When you book a call we collect your name, email, company, country/market, and any free-text you choose to share. Processed by Cal.com Inc. (data processor) and stored in our calendar + CRM for the purpose of running the call and following up.

Direct correspondence. When you email [email protected] we receive your address and the body of your message.

Client engagement data. For engaged clients, we process additional data necessary to deliver outreach services: your ICP definition, brand assets, sender domain credentials (or your platform login), and the reply log of campaigns we run on your behalf. Processed under a written services agreement.

2. Legal basis

Visitor analytics: legitimate interest (GDPR Art. 6(1)(f)) — running and improving the site. You can opt out via your browser's Do Not Track signal or by blocking the Cloudflare/Google domains.

Booking + correspondence: consent (you initiated the contact) and pre-contract steps (GDPR Art. 6(1)(b)).

Client engagement: performance of contract (GDPR Art. 6(1)(b)) and, where relevant for our own legitimate-interest B2B outreach research, legitimate interest (GDPR Art. 6(1)(f)).

Cloudflare, Inc. — CDN, DDoS protection, edge logs. Data may traverse Cloudflare data centres globally.

Google LLC — Google Analytics 4. We disable ad personalisation. Google may process data in the US under their Standard Contractual Clauses.

Cal.com Inc. — booking platform. Stores name, email, and booking details under their privacy policy.

Microsoft / Bing, Yandex, Seznam — we submit URL lists via IndexNow so search engines index our pages. No personal data is included in those submissions.

Our own infrastructure providers (Hetzner, OVH, CloudPanel) for hosting. No transfers to non-adequate jurisdictions beyond what is listed above.

4. How long we keep it

Visitor analytics: 26 months (Google Analytics default).

Booking + email correspondence: 24 months from last contact, or until you ask us to delete it, whichever comes first.

Client engagement data: for the duration of the engagement plus 24 months after termination, unless our contract specifies otherwise.

Server logs: 30 days at the origin; Cloudflare edge logs per their policy.

5. Your rights

Under GDPR you have the right to: access the data we hold about you, rectify inaccuracies, erase it (subject to our retention obligations), restrict our processing, request portability of data you provided, and object to processing based on legitimate interest.

To exercise any of these, email [email protected]. We aim to respond within 14 days.

You also have the right to lodge a complaint with the Latvian data protection authority: Datu valsts inspekcija, Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv.

6. Security

The site runs over HTTPS with HSTS and TLS 1.2+ only. Origin server is locked behind SSH key auth. Sender infrastructure runs on isolated domains with SPF, DKIM, and DMARC enforced. Access to client engagement data is restricted to the operator running the account.

No security setup is perfect; if you discover a vulnerability please report it to [email protected].

7. Changes

We update this policy when our practices change. Material changes are signposted at the top of this page for at least 30 days. The "Last updated" date below reflects the most recent revision.

8. Contact

For any data-protection question or request, contact [email protected] or write to Sabiedrība ar ierobežotu atbildību "AFF Lab", Lidoņu iela 22-2, Rīga, LV-1055, Latvia. Registration number 44103145453.