Xolving Labs

Privacy policy

Last updated 17 October 2026

This policy explains what personal data XOLVING LABS S.R.L. collects through xolvinglabs.com, why we collect it, who else handles it, and what you can ask us to do with it.

Who is responsible

XOLVING LABS S.R.L., registered in Iași, Romania, is the data controller. Our full company details are on the legal information page. For anything about your data, email info@xolvinglabs.com.

The contact form

When you send the form, we receive your name, your work email, your company if you give it, the topic you pick and your message. We use them to reply to you and to talk about possible work together. We rely on taking steps at your request before a contract (GDPR Article 6(1)(b)) and on our legitimate interest in answering business enquiries (Article 6(1)(f)).

Before the form sends, Cloudflare Turnstile checks that a person is filling it in. To do that it processes technical data such as your IP address and details about your browser. We rely on our legitimate interest in keeping spam out. Cloudflare also uses some of this data as a controller in its own right to improve its bot detection, as described in the Turnstile privacy policy.

Visiting the site

Cloudflare hosts the site. To deliver pages and block attacks, it processes your IP address and request details such as the page, your browser and the time.

We use PostHog, hosted in Frankfurt, Germany, to see which pages people visit, where they arrive from, roughly where they are, what they click and how far they scroll. PostHog uses your IP address to look up your country and city, then discards it. It stores nothing on your device, so there are no cookies and no local storage. Each page view counts as a new anonymous visitor, so we can't follow you from one visit to the next. Cloudflare Web Analytics also counts page views, without cookies or local storage.

For both, we rely on our legitimate interest in understanding how the site is used so we can improve it. If your browser sends a Global Privacy Control or Do Not Track signal, PostHog doesn't load at all. You can also object by emailing us.

Cookies

This site sets no cookies of its own and stores nothing in your browser's local storage, so there is no cookie banner. We don't use advertising trackers, we don't sell personal data, and we don't make automated decisions about you.

Who receives the data

These companies process data for us under data processing agreements:

  • Cloudflare, Inc., USA, for hosting, Turnstile, storing form messages and Web Analytics. Form messages are stored in Cloudflare's EU jurisdiction.
  • PostHog Inc., USA, for analytics. Data is stored in PostHog's EU cloud in Frankfurt, Germany.
  • Plus Five Five, Inc. (Resend), USA, to deliver form messages to our inbox.
  • Google Cloud EMEA Limited, Ireland, which runs our email through Google Workspace.

Transfers outside the EU

Cloudflare, PostHog and Resend are US companies, and Google may process data outside the EU. These transfers rely on the EU-US Data Privacy Framework, under which Cloudflare, PostHog, Resend and Google are certified, and on the European Commission's Standard Contractual Clauses in each provider's data processing agreement.

How long we keep it

  • Contact form messages are deleted 24 months after you send them. If we go on to work together, we keep the related correspondence for as long as the contract and Romanian law require.
  • PostHog keeps analytics events for one year.
  • Cloudflare keeps request logs for a short period under its own retention rules.

Your rights

Under the GDPR you can ask us for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, ask for it in a portable format, and object to processing based on legitimate interest. Email info@xolvinglabs.com and we will answer within one month.

You can also complain to the data protection authority in the country where you live or work. Because we are registered in Romania, our lead authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), dataprotection.ro.

Changes

When this policy changes, we update this page and the date at the top.