Privacy notice
Last updated: 17 September 2026
This notice is provided under Article 13 of Regulation (EU) 2016/679 and explains what personal data PowerLab400 collects, for what purpose and on what legal basis, who it is disclosed to, how long it is kept and what rights you can exercise. It was written by reading the site's own code: it describes what actually happens.
Data controller
The data controller is the operator of PowerLab400, reachable at studio@powerlab400.com.
[To be completed with the controller's legal or personal name, registered address and VAT number where applicable.]
No Data Protection Officer has been appointed, as none of the cases set out in Article 37 of the Regulation applies. For any question about your data you can write directly to the address above.
Are you obliged to provide your data
No. Reading the articles and using the tools requires no data at all: there is no need to register and nothing is asked of you.
Providing data becomes necessary only if you choose to use a service that requires it, and the consequences of refusing concern that service alone:
Account: without an email address and a password it cannot technically be created, so you will not be able to comment or save articles.
Newsletter: without an email address we cannot send you anything.
Contact form: without a name, an email address and a message we cannot read your request nor reply to you.
There is no statutory or contractual obligation requiring you to provide this data: the choice is always yours.
Why we process data, on what basis and for how long
Every processing operation has a specific purpose and a legal basis among those in Article 6 of the Regulation. Where the basis is legitimate interest, that interest is spelled out.
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| Creating and running your account | Email address, password (stored only as a cryptographic hash), optional display name | Art. 6(1)(b) — performance of the service you requested | Until you ask for deletion |
| Publishing your comments | Comment text, display name, date, linked account | Art. 6(1)(b) — performance of the service you requested | Until you delete them or ask for your account to be deleted |
| Remembering the articles you saved | The list of articles, linked to your account | Art. 6(1)(b) — performance of the service you requested | Until you remove them or ask for your account to be deleted |
| Sending you the newsletter | Email address | Art. 6(1)(a) — your consent, withdrawable at any time | Until you unsubscribe |
| Replying to messages you send us | Name, email address, message text | Art. 6(1)(f) — legitimate interest in replying to people who write to us | In the mailbox, for as long as the correspondence remains useful |
| Noticing unauthorised access to your account | Email address, date and time of each successful sign-in. No IP address | Art. 6(1)(f) — legitimate interest in the security of the site and of accounts | 400 days, then deleted automatically |
| Checking that messages sent by the site actually arrive | Recipient address, message subject, delivery outcome and any error. Not the content of the message | Art. 6(1)(f) — legitimate interest in noticing that a requested message (registration confirmation, password recovery, newsletter) failed to be delivered | 180 days, then deleted automatically |
| Knowing how many visitors are present at the same time, and when a new visit begins | A random number kept in a cookie. It stays in the server's memory: it is not stored in the database and not linked to your account | Art. 6(1)(f) — legitimate interest in understanding site usage in aggregate form | The cookie lasts 1 year; the count is held in memory and resets on every restart |
| Knowing which articles get read, by whom and how people get there | The article, the date and the name of the site you came from (for example google.com) or the source label written into the link you opened. If you are signed in, your account too. Never the IP address, and never the full address of the page you came from | Art. 6(1)(f) — legitimate interest in understanding which content is useful, to whom, and how it is found | The link to the account 90 days, then removed; the rest 400 days, then deleted automatically |
| Knowing when and from where the site is opened | Date and time of arrival, landing page and name of the referring site. If you are signed in, your account; if not, nothing that identifies you, not even the IP address. The arrival is recorded, not every page: pages opened less than half an hour apart belong to the same visit | Art. 6(1)(f) — legitimate interest in understanding site usage and knowing which registered users visit it | The link to the account 90 days, then removed; the rest 400 days, then deleted automatically |
| Letting you choose the light or dark theme | Your preference, stored in your browser | Not personal data and it never leaves your device | Until you clear your browser data |
How the data is collected
The data listed above is provided by you, by filling in a form on the site: registration, comment, newsletter subscription, contact form.
The site records only a few things by itself while you use it: sign-ins to your account, the articles you open and the times you arrive on the site (linked to your account only if you are signed in), and the name of the site you came from, which your browser passes on by itself to every site you visit.
The site does not store your IP address, in any of the cases listed above. Its only use is limiting repeated sign-in and form submission attempts: for that it keeps the address in the server's memory for at most an hour, without writing it anywhere, and forgets it on every restart. What is written below about Hostinger and Google still applies, since they receive the address on their own account.
We buy no lists, gather nothing from other sites and do not follow you elsewhere.
What you type into the tools never leaves your device. Dates, numbers, hex records, DDS sources: the calculations happen in your browser and nothing reaches the server. You can check this by opening your browser's developer tools on the Network tab while you use them.
Your email address never appears on public pages, not even next to comments: if you have not set a display name, only the part before the @ is shown.
Who the data is disclosed to
Data is not sold, traded or disclosed to third parties for their own purposes. It is accessible only to the controller and to the providers that keep the site running, which act as processors under contract:
Hostinger — hosts the site and the database. Like any hosting service, its servers log accesses, IP addresses included.
Resend — sends the site's emails: registration confirmation, password recovery, newsletter, contact form messages. It receives the recipient's address and the message content.
In addition, Google provides the typefaces used on the pages (Google Fonts). So that your browser can download them, your IP address is sent to Google's servers when each page loads; with respect to that data Google acts as an independent controller.
No other party receives your data, unless a request comes from an authority in the cases provided for by law.
Transfers outside the European Union
Some of the providers listed above are based in the United States or may process data on servers outside the European Economic Area. In particular Resend and Google are US companies.
Where such a transfer takes place, it relies on the adequacy decision adopted by the European Commission for the EU-US Data Privacy Framework, or on the standard contractual clauses approved by the Commission.
[To be verified and stated per provider: which of the two instruments applies, by checking certification to the EU-US framework on the official register and the contractual terms in place.]
You can avoid your IP address reaching Google altogether by preventing your browser from loading external resources, or by using an extension that blocks them: the site stays fully readable, only the typefaces change.
Cookies
The site uses the cookies listed below. None of them profiles you, shows you advertising or follows you across other sites, and no data gathered through cookies is disclosed to third parties.
| Name | Type | What it does | Duration |
|---|---|---|---|
connect.sid | Technical | Keeps your session open after signing in. Set only if you sign in, and required to stay signed in. | 30 days |
visitor_id | Statistical | A random number allowing the site to count how many visitors are present at the same time and to recognise the start of a new visit. Not stored in the database or linked to your account, not shared, and unable to recognise you on other sites. | 1 year |
powerlab400:tema | Preference | Remembers whether you chose the light or dark theme. Not a cookie but a preference stored in your browser, created only if you use the toggle. | Until you clear your browser data |
You can delete or block cookies at any time from your browser settings, which also allow selective refusal. Deleting connect.sid signs you out; blocking the others costs you nothing the site offers.
Automated decisions and profiling
No automated decision-making and no profiling take place. No decision concerning you is taken automatically, no system processes your data to predict behaviour, preferences or interests, and the data is not combined with data from other sources.
If you are signed in to your account, the site operator can see in the administration panel which articles you opened, when, and where you came from, to understand how the content is used. It is a list, not a profile: nothing is derived from it automatically and no decision concerning you depends on it.
Your rights
You may exercise at any time the rights set out in Articles 15 to 22 of the Regulation:
Access — find out whether data concerning you is held, what it is, and obtain a copy.
Rectification — correct it if wrong or complete it if incomplete.
Erasure — have it deleted, along with your account, comments and saved articles. Reads and arrivals on the site remain only as a count, no longer linked to you.
Restriction — ask that it be kept but not used.
Objection — object to the processing based on legitimate interest: the sign-in log, the visitor count, and the reads and arrivals linked to your account.
Portability — receive it in a machine-readable format, to take it elsewhere.
Withdrawal of consent — the only processing based on consent is the newsletter: you may withdraw it whenever you like using the link at the bottom of every email or from your account page. Withdrawal takes effect from that moment and does not make earlier processing unlawful.
Some things you can do yourself, immediately and without asking anyone: change your display name and password from your account page, edit or delete your comments from the article page, unsubscribe from the newsletter.
How to exercise your rights and how to complain
To exercise the rights listed above, write to studio@powerlab400.com. You will receive a reply within one month of the request; where the request is complex that period may be extended, and we will tell you so and explain why. Exercising your rights is free of charge.
If you believe the processing of your data infringes the Regulation you have the right to lodge a complaint with a supervisory authority — in Italy the Garante per la protezione dei dati personali (garanteprivacy.it) — or with the authority of the Member State where you live or work. You may also seek a judicial remedy.
Security measures
The site is reachable only over an encrypted connection (HTTPS). Passwords are stored solely as a cryptographic hash computed with bcrypt, from which the original password cannot be derived. The session cookie cannot be read by page scripts and is marked as secure on encrypted connections. Sign-in attempts are rate limited to hinder brute-force attacks, by counting for at most an hour those coming from the same IP address, held in memory only. Database queries always pass values separately from the command, so content entered by users cannot alter its meaning.
No measure is infallible. Should a data breach occur that poses a high risk to your rights, you will be informed at your account email address, alongside the required notifications to the supervisory authority.
Changes to this notice
If the way the site handles data changes, this page will be updated and the date at the top will change accordingly. Substantial changes will also be announced to newsletter subscribers. You are encouraged to reread it from time to time.