Legal
Privacy notice
What we collect when you use this site, why we collect it, and what you can ask us to do about it. Written to be read, not to be survived.
Last updated 19.08.26 · Version 1.0 · Draft for legal review
Who we are
Aria Labs is a company registered in Romania and based in Bucharest. We are the data controller for the personal data described in this notice.
For anything in this notice, including our full company registration details, write to hello@arialabs.eu. We'll send them to anyone who asks. We have not appointed a data protection officer, because we are not required to.
This notice covers arialabs.eu only. Our ambassador programs run on separate subdomains and have their own notices. See the KBK Fest 2026 program for that one.
What we collect
When you send us a message
Your name, your email address and what you wrote. Nothing else, and nothing we didn't ask for.
When you just visit
Our hosting provider records standard server logs: IP address, the page requested, timestamp, browser and operating system. These are generated automatically by the web server, not by anything we added.
Cookies
We don't set any. There is no advertising, no advertising pixel, no session cookie, no cross-site identifier. That's also why you don't see a cookie banner: we don't need your permission for something we don't do.
How the page is used
We count what people do on this site: which sections were on screen and for how long, how far down the page you got, which cards and questions you opened, which links and buttons you clicked, which form fields you started filling in (never what you typed), whether the form was sent, and the campaign tag on the link you arrived from, if it had one. We also record where on the page clicks land, so we can see which parts draw attention.
This is measured with PostHog, an analytics service hosted in the EU. Your browser loads it from our own domain and sends its measurements back the same way, and we pass them on to PostHog. PostHog therefore receives your IP address and your browser's description of itself. It uses them to name your browser and device and to tell one visit from another within a day, and deletes the IP address before anything is stored. The country we record is worked out from your device's time zone, not from your IP address. It runs in its cookieless mode: nothing is written to your device. We don't record your screen or replay your visit.
None of it is linked to your name or email, including if you write to us through the form. Your browser's Do Not Track or Global Privacy Control setting switches all of it off.
Why, and on what legal basis
Messages you send us
To reply to you, and to work out whether what we do is useful to you.
Legitimate interests, GDPR 6(1)(f): answering someone who contacted us. Ask us to delete the thread and we will.
Server logs
Keeping the site up and defending it against abuse.
Legitimate interests, GDPR 6(1)(f): running a secure website.
How the page is used
Working out which parts of the site answer the question and which parts waste your time.
Legitimate interests, GDPR 6(1)(f): improving our own website. Nothing is stored on your device, which is why this needs no cookie banner, and nothing is used to identify you or to follow you to other sites.
Material you share for work
Only ever under a signed non-disclosure and data use agreement, and only for your own question.
Contract, GDPR 6(1)(b). It stays yours, it never informs anyone else's answer, and it is not pooled with another client's material.
We don't make automated decisions about you and we don't profile you. What we do professionally is read markets, not people, and that applies to visitors to this site as much as to anyone's audience.
Who else sees it
Only the providers we need to operate. Each one is a processor acting on our instructions under a data processing agreement.
- the company that hosts this website
- the service that delivers the contact form to us
- our email provider
- PostHog, which measures how the site is used, as described above, in the EU
- Google Fonts, which serves the typefaces this site uses, and which therefore receives your IP address when a page loads
Ask us and we'll name the specific provider behind any of those, and tell you which country it processes data in.
We don't sell your data. We don't share it with advertisers. We never use it to inform work for anyone else.
Transfers outside the EU
We prefer EU-hosted providers. Where a provider processes data outside the European Economic Area, that transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision. Ask us and we'll tell you exactly which providers those are and which mechanism applies.
How long we keep it
- Messages: up to 24 months from your last contact with us, then deleted. If we start working together, the engagement agreement takes over.
- Server logs: a short window set by our hosting provider, weeks rather than months, after which they are overwritten. Ask us for the figure that applies today.
- Email threads: as long as the conversation is live, then archived and reviewed annually.
- Page-use measurements: kept with our server logs and deleted on the same schedule. They contain no identifier, so there is nothing in them to look you up by.
What you can ask us for
Under the GDPR you have the right to:
- get a copy of the personal data we hold about you
- have it corrected if it's wrong
- have it deleted
- restrict or object to how we use it
- receive it in a portable, machine-readable format
- withdraw consent at any time, without affecting anything we did lawfully before you withdrew it
Email hello@arialabs.eu. We'll respond within one month. There's no charge unless a request is clearly excessive, and we'll say so before doing anything.
If you think we've handled your data badly, tell us first. We'd rather fix it. You also have the right to complain to the Romanian supervisory authority, the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), at dataprotection.ro, or to the authority in your own EU country.
Security
The site is served over HTTPS. Access to messages is limited to the people at Aria Labs who need it, which today is a named handful rather than a department. We hold no security certifications, and this page will say so if that changes.
Children
This site is aimed at people working professionally in music. It isn't directed at children and we don't knowingly collect data from anyone under 16. If you think we have, write to us and we'll delete it.
Changes
If we change this notice we'll update the date at the top. If a change materially affects people who've already contacted us, we'll email them rather than quietly editing the page.