privacy notice

Who is responsible

iku labs is run by João Magalhães, an individual based in Portugal ("we"), who is responsible for the personal data described here. To ask anything about your data or to use your rights, use the contact form or send a direct message on Instagram to @ikulabs.

What we collect and why

• Contact form. Your name, email and message, and, if you choose to answer them, four optional choices: what you want to build, where it is now, when you'd like to start and a rough budget range. We use them to reply to you and to talk about a possible project. The budget range helps us see early whether a project fits and organise our replies; you can skip it. We do not store your IP address with your message.
• Instagram. If you message us on Instagram, we use what you send to reply. Instagram is run by Meta under its own privacy policy.
• Visiting the site. Our host, Cloudflare, processes your IP address and basic technical data (such as the browser and the page requested) to deliver the site and protect it, whether or not you send anything.
• Limiting abuse. When you send the form, your IP address is used to limit repeated submissions. It is held in the server's memory, normally for about an hour. It is not written to our logs or stored.

Legal basis (GDPR)

• Replying to you and discussing a project: our legitimate interest in answering people who write to us (art. 6(1)(f)). If you write in your own name asking for a project, also steps before a contract, at your request (art. 6(1)(b)). The budget range relies on legitimate interest only.
• Delivering and protecting the site and limiting abuse: legitimate interest (art. 6(1)(f)).
• If we work together: the contract (art. 6(1)(b)) and our tax and accounting obligations (art. 6(1)(c)).

We do not rely on your consent for any of this; sending the form is not consent.

Your right to object. Where we rely on legitimate interest, you can object at any time, on grounds relating to your situation, through the contact form or on Instagram. We then stop using the data we keep about you, for example by deleting your message, unless we have compelling legitimate grounds or need it for legal claims. The technical processing Cloudflare does to deliver the site to every visitor cannot be switched off for one person while you keep using the site.

What we don't do

We don't use your data for marketing, add it to a mailing list or sell it. No decision about you is made automatically. A person reads every message.

Who receives it

• Cloudflare: hosts the site, receives the form and stores the messages. It acts for us as a processor. For its own network security it may also act as a controller (see Cloudflare's privacy policy).
• Authorities, where the law requires it.

Outside the EU

Cloudflare's network operates worldwide, including in the United States, so your data may be processed and stored outside the EU. For these transfers we rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards.

How long we keep it

• Form messages: set to be deleted automatically after 12 months from when we receive them, unless it becomes a project, in which case what we need for it is kept for that project.
• Spam caught by the form is not stored.
• If we work together: for the length of the contract, then for as long as tax and accounting law requires and while claims linked to the contract can still be made.
• Cloudflare's technical logs: kept by Cloudflare for the period set in its own documentation and privacy policy, not by us. We keep no copy of them.
• Instagram: we delete conversations on our side when no longer needed; Meta keeps its own copy.

Cookies. This site sets no cookies, stores nothing in your browser and runs no analytics. It loads nothing from other websites.

Your rights

You can ask to access, correct or delete your data, to restrict its use, to object, and, where it applies, to receive it in a portable format. Use the contact form or Instagram (@ikulabs); we reply within one month, which the law allows us to extend in some cases. You can also complain to the Portuguese data protection authority, the CNPD (cnpd.pt), or to the authority where you live or work.

What to send us

We need your name, email and message to reply. Please don't include health or other sensitive data, or details about other people, unless it's really needed.

Changes

Each version is dated. The English and Portuguese texts say the same thing and share the same version date. We keep earlier versions.