Privacy Policy

1. Who we are

The controller of your personal data is YUKARI LABS SRL, a private limited company registered in Belgium under enterprise number 1033.402.366 (VAT BE1033402366), with its registered office at Cantersteen 47, 1000 Brussels, Belgium.

For any privacy question or request, email us at contact@yukarilabs.com.

2. Contact form

When you submit the contact form, we collect:

• your first and last name;
• your email address;
• the title that best describes you (your role);
• how you heard about us (optional);
• your message.

We use this data to answer your request and to follow up with you about it, for example to discuss a potential project. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) where your request concerns our services, and otherwise our legitimate interest in replying to messages sent to us (Art. 6(1)(f) GDPR).

Your submission is delivered to our business inbox as an email. We do not use it for newsletters or marketing lists.

3. Bot protection (Cloudflare Turnstile)

To protect the contact form against spam and abuse, we use Cloudflare Turnstile, provided by Cloudflare, Inc. Turnstile runs in the background without asking you to solve a puzzle. To tell humans from bots, it collects signals from your device and browser (such as your IP address, browser and device characteristics, and how the page is loaded). When you submit the form, our server sends the Turnstile token and your IP address to Cloudflare to verify it. Our legal basis is our legitimate interest in keeping the form secure and free of spam (Art. 6(1)(f) GDPR).

Cloudflare processes this data as described in Cloudflare's Turnstile Privacy Addendum, which applies in addition to this policy.

4. Website analytics

We measure visits with Umami, a privacy-friendly analytics service. Umami does not use cookies and does not build profiles of individual visitors. It records aggregated information such as the pages viewed, the referring website, browser, operating system, device type and approximate country. Our legal basis is our legitimate interest in understanding how our website is used (Art. 6(1)(f) GDPR).

5. Hosting and technical data

Our website is hosted by Vercel. As with any website, the servers process technical data needed to deliver pages to you, such as your IP address, browser user agent, the requested page and the time of the request, including in server logs used for security and troubleshooting (Art. 6(1)(f) GDPR).

Some images on our service pages are loaded directly from Unsplash's image servers, which receive your IP address and browser information as part of that request. We do not use advertising or social media tracking cookies.

6. Recipients and processors

We share personal data only with service providers that help us run this website and act on our instructions:

• Resend: delivery of contact form submissions to our inbox.
• Vercel: website hosting and server logs.
• Cloudflare: Turnstile bot protection (see Turnstile Privacy Addendum).
• Umami: cookieless website analytics.

We do not sell your personal data. We may disclose it where required by law.

7. International transfers

Some of these providers are based in, or use infrastructure in, the United States or other countries outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on appropriate safeguards, such as the EU-U.S. Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses.

8. How long we keep your data

We keep contact form submissions and related correspondence for as long as needed to handle your request, and for up to 24 months after our last exchange. If your request leads to a contract, we keep the relevant data for as long as required by law, for example for accounting purposes. Turnstile and analytics data are retained by Cloudflare and Umami under their own policies.

9. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased;
• restrict the processing of your data;
• object to processing based on our legitimate interests;
• receive your data in a portable format.

To exercise any of these rights, email contact@yukarilabs.com. We will reply within one month. We may ask you to confirm your identity before acting on your request.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, Belgium, www.dataprotectionauthority.be.

10. Changes to this policy

We may update this policy when our practices or the law change. The date at the top of this page shows when it was last updated.