Privacy policy — Evolution Lab

Who is responsible for your data

The data controller is [full name or business name], [address], Spain, tax number [NIF]. Below we call ourselves “we” or “Evolution Lab”.

For any question about your data, write to EvolutionCodeLab@gmail.com.

What we collect

Contact details. Your e-mail when you sign up for an open session or apply. With it we see the language of the page and the tier you chose.
What you tell us yourself. Your name and answers in the application, your e-mails and Telegram messages.
Payments. Stripe processes payments. We see your name, e-mail, the amount, the country and the payment status. We never see or store your full card number.
Taking part in a cohort. Your Zoom name, your messages in the cohort chat, your answers in questionnaires and the observation tracker.
Session recordings. Sessions are recorded so participants can watch them later. A recording includes whatever you share: your name, voice and camera image. You can turn your camera off and change your Zoom name.
Signing in to the participant area. The e-mail we send your sign-in code to, and the time you last signed in. So you don't have to enter a code every time, the site keeps a technical sign-in marker in your browser. It is used only for the participant area and does not track you.
Site statistics. [Analytics service, e.g. Plausible] counts visits without cookies and without data that could identify you: which pages and sections were viewed, which buttons were pressed, in which language. The site uses no advertising or tracking cookies.

Sensitive answers

In questionnaires and the tracker you may write about your wellbeing and health, your state and your beliefs. These are special categories of data, so we ask for them only with your explicit consent. You decide what to share: you can skip any question that feels too personal.

Only the authors see these answers. We never publish them or show them to other participants without your separate consent.

Why we use data, and on what basis

Purpose	Legal basis
Sending the session link, reminders and the recording	Your request: you signed up
E-mails about cohorts and Lab news	Your consent. You can unsubscribe in every e-mail
Reviewing your application, running the cohort, giving access to materials	Our agreement with you as a participant
Letting you into the participant area with an e-mail code and keeping it secure	Our agreement with you as a participant
Understanding which parts of the site people read and where it is hard to use	Legitimate interest; no names or e-mails involved
Taking payment, bookkeeping and tax reporting	Legal obligation
Publishing a testimonial on the site	Separate written consent; published with initials only
Answering your e-mails, protecting the site and accounts	Legitimate interest

Who we share data with

We never sell or rent out your data. Only the services the Lab cannot run without process it:

[E-mail service, e.g. Brevo]: e-mails about sessions and cohorts, sign-in codes for the participant area.
[Sign-in service, e.g. Supabase]: participant area sign-in by code, the cohort participant list.
[Analytics service, e.g. Plausible]: cookieless visit statistics.
Stripe: payments.
Zoom: live sessions.
Telegram: the cohort chat.
Google: e-mail, questionnaires, the schedule spreadsheet and participant-area files (Google Drive).
[Hosting]: running the site.

Each of them processes data on our instructions and under its own privacy policy.

Transfers outside the EU

Some of these services store data in the United States and other countries outside the EU. In that case your data is protected by the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework.

How long we keep data

Mailing list: until you unsubscribe.
Sign-in data: while your access to the cohort materials lasts. Sign-in codes are valid for [10 minutes] and are not kept after use.
Site statistics: only as totals, with nothing about individual people.
An application that did not lead to participation: [12 months].
Participant data, recordings and questionnaire answers: while your access to the cohort materials lasts, or until you ask us to delete them.
Payment and accounting records: as long as [Spanish] tax law requires.

We remove parts of recordings that show you on request, where technically possible.

Your rights

At any time you can:

find out what data we hold about you and get a copy;
correct inaccurate data;
ask us to delete your data;
restrict or object to processing;
receive your data in a format you can take to another service;
withdraw consent; this does not affect anything done before you withdrew it.

Write to EvolutionCodeLab@gmail.com. We reply within one month.

If you think we have breached your rights, you can complain to the Spanish Data Protection Agency (AEPD, aepd.es) or to the data protection authority in your country.

Age

The Lab is for people aged 18 and over. We do not knowingly collect children’s data.

Changes

If this policy changes, we will update the date at the top of this page. We will tell you about significant changes by e-mail.