Your data, and what we actually do with it.

01Who is responsible

The Creativity Lab is a digital studio based in Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 42039477. For this website we are the controller: we decide why and how the limited data described below is processed.

For an AI system we build and operate for a client, the roles flip. The client decides what the system does with whose data, which makes them the controller and us the processor, working on their written instructions.

We do not have a statutory data protection officer. Every privacy question reaches the same small team, at hello@thecreativitylab.nl.

02What this website does not do

Most privacy statements begin with a long list of what a site collects. This one begins with what it does not, because we checked the source code rather than trusting our memory of it.

• There are no accounts, no logins and no visitor profiles. The site is a set of static pages.
• Analytics is Google Analytics 4, and only with your permission. Before you agree, nothing loads and nothing is sent. After you agree we see which pages are read, in which language, and whether they lead to an enquiry, never who you are: no name, no email address, no phone number, no form field, no chat message. Withdraw and the measuring stops on the spot.
• There are no tracking pixels, no advertising or remarketing technology and no A/B testing tools.
• This website sets one functional cookie of its own, cl-lang, and only when you choose a language. Google Analytics 4 sets cookies only after your permission, and only in order to measure.
• There is no database behind it. Nothing you type into this site is stored on a server of ours.

03When you contact us

The contact form and the systems call request do not submit to a server, because there is no endpoint connected to them. When you press send, the site assembles what you filled in and opens a message in your own mail application, addressed to hello@thecreativitylab.nl. You send it yourself, and you can edit or delete it first.

What reaches our mailbox is therefore an ordinary email: your name, your email address, your company if you filled it in, the focus and friction and timing you selected, your description of how the work runs today, and for a call request your preferred day and moment.

We use it to answer you and, if it turns into a project, to prepare that project. The legal basis is our legitimate interest in replying to a business enquiry, and where you are asking us to quote or start work, the steps taken before entering a contract.

The day options shown in the booking pane are generated in your browser from today's date. They are not live availability, no scheduling provider is connected, and nothing is reserved automatically. A person confirms the moment by email.

04The AI Concierge

The AI Concierge is the chat panel in the corner of this site. It is worth being precise about what happens to what you type in it.

When the Concierge answers with a language model, your message, the earlier messages of the conversation, the choices you made in it and the page you are on are sent to our server, and from there to Anthropic, whose model writes the answer. If that does not work, a scripted engine in your browser answers that turn instead.

A copy of your conversation and the engine's state is also kept on your own device in session storage, under the key cl-concierge-ai, limited to the last forty messages so that closing and reopening the panel does not lose the thread. Your browser discards it when you close the tab.

For a question about a conversation you had with the Concierge, or to exercise a right, write to hello@thecreativitylab.nl. If you want the copy in your browser gone sooner, close the tab or clear your browser storage for this site.

05What is stored in your browser

Only cl-lang below is a cookie, which means it is the one value your browser sends back to us on its own. The rest stays where it is, apart from what you write to the AI Concierge: that is sent to our server and on to the language model, as described above. They are small values your browser keeps so the site behaves sensibly. Allow analytics and Google Analytics 4 adds two real cookies on top of this list, named _ga and _ga_ followed by the property id, kept for at most 26 months and removed again when you withdraw.

06Third parties this page connects to

A page that loads content from another company's servers reveals your IP address to that company, even when no cookie is involved. This site makes no such connection: every typeface, image and video it uses is served from our own domain. One thing is left to name, and we would rather name it than let you discover it in a network tab.

• Our hosting provider keeps standard technical server logs, such as IP address, timestamp, requested page and browser type, for security and reliability, as essentially every host does.

Server logs are unavoidable for any site that is reachable at all. Beyond them, nothing on this page reaches a third party, so there is nothing here for a content blocker to stop.

07Data inside the AI systems we build

This is the part that matters most for clients, and the part a website privacy statement usually skips. When we build automation, an agent, a chat or voice interface, a workflow, an integration or a dashboard, personal data flows through it, and how that is handled is agreed in writing before anything is switched on.

The agreement comes first

Every engagement that involves personal data runs under a written processing agreement. It records what we may process, for which purpose, for how long, which sub-processors are involved, where the data is hosted, and what happens at the end of the engagement. We process only on the client's documented instructions.

Prompts, uploads and API traffic

Where a step uses a language model, the text sent to that model is the prompt, and it usually contains part of the underlying record: an enquiry, a document, an order, a customer note. Anything a user uploads for the system to read is treated the same way. Which provider receives that traffic, and in which region it is processed, is chosen together with the client and named in the agreement.

Logs

Systems we build keep operational logs, because an automated process that keeps no record cannot be debugged, audited or explained to a regulator. Those logs commonly include what ran, when, whether it succeeded, and the input and output of an AI step. Retention is configured per project and kept as short as the client's obligations allow.

Training

We do not use client data to train models of our own. Where a model provider offers a setting that excludes submitted data from their own training, we select it. Where a provider does not offer that, we say so before it is used rather than after.

Access and special categories

Access to a client environment is limited to the named people who need it for the work, and removed when the work ends. Special categories of data, such as health or biometric information, are processed only where the agreement explicitly provides for it and the extra safeguards are in place.

08How long things are kept

An enquiry that does not become a project

Up to 12 months in our mailbox, then deleted

Client and project records

For the duration of the engagement plus seven years, because Dutch tax law requires it for administration

Data inside a system we run for a client

The period set by that client in the processing agreement

Technical server logs

A short technical period at our hosting provider, for security and reliability

Your AI Concierge conversation

Not set out in this statement yet; ask us at hello@thecreativitylab.nl

09Where data goes

The font and media requests described above may be handled by providers that process data outside the European Economic Area, under the transfer safeguards those providers publish. For client systems, the hosting region and the model provider's region are chosen per project, and we prefer to keep processing inside the European Economic Area where the project allows it.

10Your rights

Under the General Data Protection Regulation you can ask us for a copy of the personal data we hold about you, have it corrected, have it deleted, have its processing restricted, object to it, or receive it in a portable form. Where processing rests on consent, you can withdraw that consent at any time.

One email to hello@thecreativitylab.nl is enough. We answer within a month and will ask a question or two if we need to be sure who we are talking to.

If your data sits inside a system we operate for a client, that client is the controller. Send the request to them and we will support them in handling it; we are not allowed to act on their data on our own initiative.

You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens. We would appreciate the chance to fix it first, but that is your call, not ours.

11Security

This site is served over HTTPS and has no database, no login and no visitor records, which removes most of what an attacker would come for. Access to client environments is limited to named people and protected by strong authentication.

We take security seriously, and we will not claim to be unbreachable, because no one honestly can. If you believe you have found a vulnerability, tell us at hello@thecreativitylab.nl and we will treat it as urgent.

12Changes to this statement

When the site changes, this page changes with it, and the date at the top moves. If we ever add analytics, a scheduling embed or a lead endpoint, this statement is updated before that goes live, not after.