We collect
almost nothing.

Black Lab Studios, Lda, registered in Portugal under NIF 519267532, at Rua da Alegria, N27, 1 andar, 4000-041 Porto. We're the controller for this site, which means we decide what gets collected here and we're the ones answerable for it.

Write to hello@blacklabstudios.com and it reaches Gui and Bárbara. There's no data protection officer, because a company this size isn't required to appoint one.

The enquiry form, if you fill it in. Your name, your work email, the size of your team and whether you want it on site or remote, plus the challenge you pick on the workshops page. Everything else sits under "Tell us more" and is optional: your role and company, what you've tried, what success looks like, the timeframe, how approval works on your side and how you heard about us.

The open cohort box, if you use it. Some workshop pages ask whether you'd like to hear if the workshop ever runs as an open cohort, one anyone can book a seat on. That takes your email address and nothing else, and it arrives in our inbox labelled with the workshop.

Anonymous page counts. Simple Analytics tells us which pages get read and roughly where readers arrive from. It sets no cookies, keeps no IP address and stores no identifier, so we can see that a page was read and never that you were the one reading it.

Three counts on top of that, all about the enquiry form. Clicking the button that takes you to it, starting to fill it in, and sending it each add one to a tally, so we can see where people stop. None of them carries a name or an answer. Simple Analytics notes which page each one happened on, the same as it does for a page view, and that is all.

The same for links that lead away. Clicking through to another site, or on one of our email addresses, adds one to a tally for that link, so we can see which of them earn their place. What gets recorded is the destination, and the destination is an address we wrote into the page ourselves. Nothing in it is yours.

And for the logo files on the brand page. Downloading one adds one to a tally for that file, so we know which of them people actually use. Again, the only thing recorded is which file it was.

Server logs. Cloudflare hosts this site, and serving you a page means handling your IP address, your browser's user agent and the URL you asked for. That happens on every website you visit. It is kept briefly, for security and for keeping the site up.

Your theme choice. Light or dark is saved in your browser's local storage, on your device. It never reaches us, and clearing your browser data removes it.

No advertising pixels. No heatmaps, no session recording, no fingerprinting, no A/B testing tools. We set no cookies of our own, and the analytics set none either. Cloudflare may set a strictly necessary one to tell people apart from bots.

There's no consent banner on this site because there's nothing to ask consent for, and a banner that asks for nothing is theatre.

For an enquiry, Article 6(1)(b) of the GDPR, steps taken at your request before a contract. You asked us for a proposal, and we need your answers to write one.

For the open cohort box, Article 6(1)(a), your consent. You asked us to tell you about one thing. Change your mind and one email takes it back.

For server logs and for the empty field that catches bots, Article 6(1)(f), our legitimate interest in keeping the site up and the inbox usable. You can object to that, and the section on your rights says how.

The page counts are not on this list, because there is no personal data in them to hold. A count with no cookie, no IP address and no identifier isn't about a person, and we couldn't look you up in it if we tried.

Four companies, and each one is there for a reason. Cloudflare hosts the site and runs the form endpoint. Simple Analytics counts the page views. Resend turns your enquiry into an email. Google does two jobs, because Workspace holds the inbox that email lands in, and fonts.googleapis.com serves the Inter typeface this site is set in.

Two of them hear from your browser before you have done anything at all. Simple Analytics is there on purpose, and it was chosen over the usual names because it throws away the parts that would make it about you. The typeface is the one we'd rather not need, because asking Google for the font means Google sees the address that asked. The other two only come into play once you've sent us something through a form.

All four work on our instructions, under a contract, and none of them are allowed to use your data for their own purposes. Nobody buys this data, because it isn't for sale.

Three of the four are US companies, so data reaching them can be processed outside the European Economic Area. None of that happens on a handshake.

Cloudflare and Google are both certified under the EU-US Data Privacy Framework, and both also carry the European Commission's standard contractual clauses in their processing terms. Resend runs on those clauses, the 2021 set, and stores what it holds in the United States.

Simple Analytics is the fourth, and it is the reason we picked it. It is a Dutch company, its servers are in the Netherlands, and the page counts never leave the European Union.

An enquiry that turns into work becomes part of the paperwork for that work, and Portuguese law makes us keep accounting records for ten years.

An enquiry that doesn't go anywhere is kept for two years, in case you come back and we'd rather not ask you everything twice. Then it's deleted. Ask us to delete it sooner and we will.

An email from the open cohort box is kept until we write to say the cohort is on, or for a year if it never is. Then it's deleted.

Server logs rotate away on our host's schedule, which is a matter of days.

The page counts stay with Simple Analytics for as long as we keep the account. There is nothing in them to delete on your behalf, because there is nothing in them that is yours.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable format, or object to us holding it under legitimate interests.

One email to hello@blacklabstudios.com does all of it, it costs nothing, and we answer within 30 days. We'll only ask you to confirm who you are if we can't otherwise be sure we're not handing your data to someone else.

If we get it wrong, you can complain to the Comissão Nacional de Proteção de Dados, the Portuguese supervisory authority, at cnpd.pt. You can also complain to the authority where you live.

The site is served over HTTPS. The form endpoint checks and length-limits every answer before it does anything with it. We take no payments here, so there are no card details to lose.

We hold no special category data and don't want any, so please keep health, political and similar details out of the free text boxes. If something does go wrong and your data is at risk, we'll tell the CNPD within 72 hours and tell you directly when it affects you.

This notice covers blacklabstudios.com. It stops at the edge of it.

Courses on Dometrain, the newsletter and the writing on guiferreira.me, the AI Powered .NET School and ThatPrompt each run on their own platforms with their own notices. Buy a course from Dometrain and Dometrain holds that data, not us.

Nothing here is aimed at children, and we don't knowingly collect data from anyone under 16. Tell us if you think we have, and it goes.

The date at the top moves when the wording moves. If a change actually matters, meaning we start collecting something new or using it differently, we'll say so on the page rather than quietly swap the text.

The last one that mattered, on 28 October 2026. We added the open cohort box and its email address, and two counts on the enquiry form, for clicking through to it and for starting it. Most of the enquiry also became optional.