Privacy statement
This statement covers two different situations: you visiting this website, and an AI system we build and run for a client. The roles and the rules are not the same, so they are kept apart below.
01Who is responsible
The Creativity Lab is a digital studio based in Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 42039477. For this website we are the controller: we decide why and how the limited data described below is processed.
For an AI system we build and operate for a client, the roles flip. The client decides what the system does with whose data, which makes them the controller and us the processor, working on their written instructions.
We do not have a statutory data protection officer. Every privacy question reaches the same small team, at hello@thecreativitylab.nl.
02What this website does not do
Most privacy statements begin with a long list of what a site collects. This one begins with what it does not, because we checked the source code rather than trusting our memory of it.
- There are no accounts, no logins and no visitor profiles. The site is a set of static pages.
- There is no analytics. No Google Analytics, no tag manager, no privacy-friendly alternative, nothing. We do not measure your visit.
- There are no tracking pixels, no advertising or remarketing technology and no A/B testing tools.
- This website sets no cookies at all.
- There is no database behind it. Nothing you type into this site is stored on a server of ours.
03When you contact us
The contact form and the systems call request do not submit to a server, because there is no endpoint connected to them. When you press send, the site assembles what you filled in and opens a message in your own mail application, addressed to hello@thecreativitylab.nl. You send it yourself, and you can edit or delete it first.
What reaches our mailbox is therefore an ordinary email: your name, your email address, your company if you filled it in, the focus and friction and timing you selected, your description of how the work runs today, and for a call request your preferred day and moment.
We use it to answer you and, if it turns into a project, to prepare that project. The legal basis is our legitimate interest in replying to a business enquiry, and where you are asking us to quote or start work, the steps taken before entering a contract.
The day options shown in the booking pane are generated in your browser from today's date. They are not live availability, no scheduling provider is connected, and nothing is reserved automatically. A person confirms the moment by email.
The newsletter field in the footer is not connected to any mailing platform today. Submitting it does nothing and stores nothing, so no subscription exists and no address is collected.
04The AI Concierge
The AI Concierge is the chat panel in the corner of this site. It is worth being precise about it, because the word AI usually implies that something is being sent somewhere.
It is a scripted, deterministic engine that runs entirely inside your browser. There is no language model behind it, no API key, no server and no network request of any kind. Nothing you type into it is transmitted to us or to anyone else, and we cannot read it.
Your conversation and the engine's state are kept on your own device in session storage, under the key cl-concierge-ai, limited to the last forty messages so that closing and reopening the panel does not lose the thread. Your browser discards it when you close the tab.
Because nothing is sent, there is no prompt log on our side to request, correct or delete. If you want the conversation gone sooner, close the tab or clear your browser storage for this site.
Please do not use the Concierge for confidential information, passwords or anything sensitive. Not because we would read it, but because it is a demonstration panel rather than a monitored support channel, and nobody is on the other end.
05What is stored in your browser
None of the following are cookies, and none of them are sent to a server. They are small values your browser keeps so the site behaves sensibly. This is the complete list.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
cl-cookie-consent | Local storage | Your cookie choice, so we do not ask again on every page | 12 months |
tcl-lang | Local storage | Whether you prefer English or Dutch | Until you clear it |
cl-concierge-ai | Session storage | Your AI Concierge conversation, last 40 messages, on your device only | Until the tab closes |
pt | Session storage | A flag that keeps the page transition smooth between pages | Until the tab closes |
clm-act | Session storage | Whether the menu has already been opened once this session | Until the tab closes |
06Third parties this page connects to
A page that loads content from another company's servers reveals your IP address to that company, even when no cookie is involved. This site makes no such connection: every typeface, image and video it uses is served from our own domain. One thing is left to name, and we would rather name it than let you discover it in a network tab.
- Our hosting provider keeps standard technical server logs, such as IP address, timestamp, requested page and browser type, for security and reliability, as essentially every host does.
Server logs are unavoidable for any site that is reachable at all. Beyond them, nothing on this page reaches a third party, so there is nothing here for a content blocker to stop.
07Data inside the AI systems we build
This is the part that matters most for clients, and the part a website privacy statement usually skips. When we build automation, an agent, a chat or voice interface, a workflow, an integration or a dashboard, personal data flows through it, and how that is handled is agreed in writing before anything is switched on.
The agreement comes first
Every engagement that involves personal data runs under a written processing agreement. It records what we may process, for which purpose, for how long, which sub-processors are involved, where the data is hosted, and what happens at the end of the engagement. We process only on the client's documented instructions.
Prompts, uploads and API traffic
Where a step uses a language model, the text sent to that model is the prompt, and it usually contains part of the underlying record: an enquiry, a document, an order, a customer note. Anything a user uploads for the system to read is treated the same way. Which provider receives that traffic, and in which region it is processed, is chosen together with the client and named in the agreement.
Logs
Systems we build keep operational logs, because an automated process that keeps no record cannot be debugged, audited or explained to a regulator. Those logs commonly include what ran, when, whether it succeeded, and the input and output of an AI step. Retention is configured per project and kept as short as the client's obligations allow.
Training
We do not use client data to train models of our own. Where a model provider offers a setting that excludes submitted data from their own training, we select it. Where a provider does not offer that, we say so before it is used rather than after.
We do not promise zero retention. A provider may hold traffic briefly for abuse monitoring, and a working system keeps logs. What we can promise is that the retention is written down, bounded and known to you before it starts.
Access and special categories
Access to a client environment is limited to the named people who need it for the work, and removed when the work ends. Special categories of data, such as health or biometric information, are processed only where the agreement explicitly provides for it and the extra safeguards are in place.
08How long things are kept
- An enquiry that does not become a project
- Up to 12 months in our mailbox, then deleted
- Client and project records
- For the duration of the engagement plus seven years, because Dutch tax law requires it for administration
- Data inside a system we run for a client
- The period set by that client in the processing agreement
- Technical server logs
- A short technical period at our hosting provider, for security and reliability
- Your AI Concierge conversation
- Nothing on our side, because nothing is sent
09Where data goes
The font and media requests described above may be handled by providers that process data outside the European Economic Area, under the transfer safeguards those providers publish. For client systems, the hosting region and the model provider's region are chosen per project, and we prefer to keep processing inside the European Economic Area where the project allows it.
10Your rights
Under the General Data Protection Regulation you can ask us for a copy of the personal data we hold about you, have it corrected, have it deleted, have its processing restricted, object to it, or receive it in a portable form. Where processing rests on consent, you can withdraw that consent at any time.
One email to hello@thecreativitylab.nl is enough. We answer within a month and will ask a question or two if we need to be sure who we are talking to.
If your data sits inside a system we operate for a client, that client is the controller. Send the request to them and we will support them in handling it; we are not allowed to act on their data on our own initiative.
You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens. We would appreciate the chance to fix it first, but that is your call, not ours.
11Security
This site is served over HTTPS and has no database, no login and no visitor records, which removes most of what an attacker would come for. Access to client environments is limited to named people and protected by strong authentication.
We take security seriously, and we will not claim to be unbreachable, because no one honestly can. If you believe you have found a vulnerability, tell us at hello@thecreativitylab.nl and we will treat it as urgent.
12Changes to this statement
When the site changes, this page changes with it, and the date at the top moves. If we ever add analytics, a scheduling embed or a lead endpoint, this statement is updated before that goes live, not after.
The Creativity Lab is a digital studio in Amsterdam. For any question about this statement, or to exercise a right, write to hello@thecreativitylab.nl and a person will answer.
