Privacy notice
Last updated: 27 July 2026
This notice is provided under Article 13 of Regulation (EU) 2016/679 and explains what personal data PowerLab400 collects, for what purpose and on what legal basis, who it is disclosed to, how long it is kept and what rights you can exercise. It was written by reading the site's own code: it describes what actually happens.
Data controller
The data controller is the operator of PowerLab400, reachable at studio@powerlab400.com.
[To be completed with the controller's legal or personal name, registered address and VAT number where applicable.]
No Data Protection Officer has been appointed, as none of the cases set out in Article 37 of the Regulation applies. For any question about your data you can write directly to the address above.
Are you obliged to provide your data
No. Reading the articles and using the tools requires no data at all: there is no need to register and nothing is asked of you.
Providing data becomes necessary only if you choose to use a service that requires it, and the consequences of refusing concern that service alone:
Account: without an email address and a password it cannot technically be created, so you will not be able to comment or save articles.
Newsletter: without an email address we cannot send you anything.
Contact form: without a name, an email address and a message we cannot read your request nor reply to you.
There is no statutory or contractual obligation requiring you to provide this data: the choice is always yours.
Why we process data, on what basis and for how long
Every processing operation has a specific purpose and a legal basis among those in Article 6 of the Regulation. Where the basis is legitimate interest, that interest is spelled out.
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| Creating and running your account | Email address, password (stored only as a cryptographic hash), optional display name | Art. 6(1)(b) — performance of the service you requested | Until you ask for deletion |
| Publishing your comments | Comment text, display name, date, linked account | Art. 6(1)(b) — performance of the service you requested | Until you delete them or ask for your account to be deleted |
| Remembering the articles you saved | The list of articles, linked to your account | Art. 6(1)(b) — performance of the service you requested | Until you remove them or ask for your account to be deleted |
| Sending you the newsletter | Email address | Art. 6(1)(a) — your consent, withdrawable at any time | Until you unsubscribe |
| Replying to messages you send us | Name, email address, message text | Art. 6(1)(f) — legitimate interest in replying to people who write to us | In the mailbox, for as long as the correspondence remains useful |
| Noticing unauthorised access to your account | Email address, IP address, date and time of each successful sign-in | Art. 6(1)(f) — legitimate interest in the security of the site and of accounts | 400 days, then deleted automatically |
| Knowing how many visitors are present at the same time | A random number kept in a cookie, not linked to any personal data | Art. 6(1)(f) — legitimate interest in understanding site usage in aggregate form | The cookie lasts 1 year; the count is held in memory and resets on every restart |
| Knowing which articles get read | Only the article identifier and the date. No link to the person: no identifier, no IP address | Not personal data: it identifies nobody | 400 days, then deleted automatically |
| Letting you choose the light or dark theme | Your preference, stored in your browser | Not personal data and it never leaves your device | Until you clear your browser data |
How the data is collected
All the data listed above is provided by you, by filling in a form on the site: registration, comment, newsletter subscription, contact form. We buy no lists, gather nothing from other sites and do not follow you elsewhere.
What you type into the tools never leaves your device. Dates, numbers, hex records, DDS sources: the calculations happen in your browser and nothing reaches the server. You can check this by opening your browser's developer tools on the Network tab while you use them.
Your email address never appears on public pages, not even next to comments: if you have not set a display name, only the part before the @ is shown.
Who the data is disclosed to
Data is not sold, traded or disclosed to third parties for their own purposes. It is accessible only to the controller and to the providers that keep the site running, which act as processors under contract:
Hostinger — hosts the site and the database. Like any hosting service, its servers log accesses, IP addresses included.
Resend — sends the site's emails: registration confirmation, password recovery, newsletter, contact form messages. It receives the recipient's address and the message content.
In addition, Google provides the typefaces used on the pages (Google Fonts). So that your browser can download them, your IP address is sent to Google's servers when each page loads; with respect to that data Google acts as an independent controller.
No other party receives your data, unless a request comes from an authority in the cases provided for by law.
Transfers outside the European Union
Some of the providers listed above are based in the United States or may process data on servers outside the European Economic Area. In particular Resend and Google are US companies.
Where such a transfer takes place, it relies on the adequacy decision adopted by the European Commission for the EU-US Data Privacy Framework, or on the standard contractual clauses approved by the Commission.
[To be verified and stated per provider: which of the two instruments applies, by checking certification to the EU-US framework on the official register and the contractual terms in place.]
You can avoid your IP address reaching Google altogether by preventing your browser from loading external resources, or by using an extension that blocks them: the site stays fully readable, only the typefaces change.
Cookies
The site uses the cookies listed below. None of them profiles you, shows you advertising or follows you across other sites, and no data gathered through cookies is disclosed to third parties.
| Name | Type | What it does | Duration |
|---|---|---|---|
connect.sid | Technical | Keeps your session open after signing in. Set only if you sign in, and required to stay signed in. | 30 days |
visitor_id | Statistical | A random number allowing the site to count how many visitors are present at the same time. Not linked to any personal data, not shared, and unable to recognise you on other sites. | 1 year |
powerlab400:tema | Preference | Remembers whether you chose the light or dark theme. Not a cookie but a preference stored in your browser, created only if you use the toggle. | Until you clear your browser data |
You can delete or block cookies at any time from your browser settings, which also allow selective refusal. Deleting connect.sid signs you out; blocking the others costs you nothing the site offers.
Automated decisions and profiling
No automated decision-making and no profiling take place. No decision concerning you is taken automatically, your data is not used to analyse or predict behaviour, preferences or interests, and it is not combined with data from other sources.
Your rights
You may exercise at any time the rights set out in Articles 15 to 22 of the Regulation:
Access — find out whether data concerning you is held, what it is, and obtain a copy.
Rectification — correct it if wrong or complete it if incomplete.
Erasure — have it deleted, along with your account, comments and saved articles.
Restriction — ask that it be kept but not used.
Objection — object to the processing based on legitimate interest, namely the sign-in log and the visitor count.
Portability — receive it in a machine-readable format, to take it elsewhere.
Withdrawal of consent — the only processing based on consent is the newsletter: you may withdraw it whenever you like using the link at the bottom of every email or from your account page. Withdrawal takes effect from that moment and does not make earlier processing unlawful.
Some things you can do yourself, immediately and without asking anyone: change your display name and password from your account page, edit or delete your comments from the article page, unsubscribe from the newsletter.
How to exercise your rights and how to complain
To exercise the rights listed above, write to studio@powerlab400.com. You will receive a reply within one month of the request; where the request is complex that period may be extended, and we will tell you so and explain why. Exercising your rights is free of charge.
If you believe the processing of your data infringes the Regulation you have the right to lodge a complaint with a supervisory authority — in Italy the Garante per la protezione dei dati personali (garanteprivacy.it) — or with the authority of the Member State where you live or work. You may also seek a judicial remedy.
Security measures
The site is reachable only over an encrypted connection (HTTPS). Passwords are stored solely as a cryptographic hash computed with bcrypt, from which the original password cannot be derived. The session cookie cannot be read by page scripts and is marked as secure on encrypted connections. Sign-in attempts are rate limited to hinder brute-force attacks. Database queries always pass values separately from the command, so content entered by users cannot alter its meaning.
No measure is infallible. Should a data breach occur that poses a high risk to your rights, you will be informed at your account email address, alongside the required notifications to the supervisory authority.
Changes to this notice
If the way the site handles data changes, this page will be updated and the date at the top will change accordingly. Substantial changes will also be announced to newsletter subscribers. You are encouraged to reread it from time to time.