Privacy Policy

Studio and contact

DNA Lab is an independent creator partnership studio operated by Claudio in Italy. Privacy enquiries and requests can be sent to business@dnalab.work.

Full operator identity is shared with prospective collaborators at the introductory stage, before confidential material, an agreement or work. This commercial introduction does not replace information that must be provided to people whose personal data is processed.

Visits and first contact

This website has no contact form, embedded checkout, advertising pixel or analytics script. Serving pages involves technical information such as an IP address, requested URL and browser details; hosting infrastructure may retain operational or security logs.

Email links open your chosen email application. If you contact us, we receive the address you use, your name if supplied and your message. Initially we need only your name, email, public creator profile and brief project context. Do not send credentials, sensitive personal data, confidential analytics or unnecessary private material in your first message.

Public-source research

We may review public profiles, posts, comments, interactions, recurring questions and language to understand creator audiences and possible product opportunities. Some collection and analysis may be assisted by automated third-party tools. Relevant information can include handles or identifiers attached to public content, content excerpts and engagement signals.

Publicly accessible information can still be personal data, and automated collection is processing. We focus on information relevant to the research purpose, limit unnecessary identifiers and avoid unrelated reuse. We do not claim that all collected material is anonymous or that publication removes privacy obligations.

Where information is obtained indirectly, the source categories, processing information and any applicable notice requirements are addressed for that activity. Public availability is not treated as a blanket exemption from informing people.

Creator-provided private material

You may voluntarily provide relevant documents, aggregate analytics, redacted screenshots, private business notes or audience feedback. We agree the intended purpose and handling separately. Share only what is needed and what you are authorised to disclose, removing unrelated personal information where possible.

We do not automatically send private project material to external analysis or AI services. Ordinary receipt by the email service you use to contact us is distinct from onward upload to an analysis tool. Any proposed onward processing of non-public personal or confidential material is explained and agreed before use, including relevant recipient and data-handling information. Your agreement does not replace any other applicable lawful-basis or rights requirements.

Our core work does not need passwords, 2FA or recovery codes, API keys, Stripe logins or direct social-account access. Any specific platform role needed for an agreed task is limited and revocable; passwords remain private.

Purposes and legal bases

We use enquiry information to respond, understand the request, prepare a proposal and deliver agreed work. Where applicable, the basis is requested pre-contractual steps or performance of a contract under GDPR Article 6(1)(b).

Relevant business communication, proportionate public-source research, record management and security may rely on legitimate interests under Article 6(1)(f), where the assessment supports that basis and the interests and rights of the people concerned are respected. This is not automatic permission for unsolicited marketing, any scraping method or sensitive-data processing.

Records required by an applicable legal obligation are processed on that basis under Article 6(1)(c). If a specific optional activity requires consent, it is requested separately. We explain additional project purposes and the applicable basis before introducing them.

You can decline to provide optional project material. That may limit the assessment or agreed scope; it does not grant permission to obtain private account access instead.

Recipients, AI and internal methods

Depending on the activity, recipient categories include website hosting and infrastructure services, email providers, document storage and collaboration services, public-source collection and analysis providers, and AI-assisted research or production providers. Professional advisers or competent authorities may receive information where needed for the relevant purpose or legal obligation.

AI supports research and drafting alongside human review. We do not sell creator data or use project sharing as permission for unrelated reuse. Information about relevant recipients and processing is provided where required; internal tooling, prompts and methods are not a public software catalogue.

Provider retention, training use, deletion, subprocessors and processing locations depend on the actual service and configuration. We do not make a blanket promise of zero retention, disabled training or a particular hosting region. Relevant terms must be checked before a proposed use of non-public material.

Sensitive information

We do not intentionally request sensitive personal information or raw customer lists for core research. Public discussions may nevertheless reveal health, religious, political, sexuality-related or other sensitive information.

Before automating analysis of a sensitive subject area, we assess the purpose, minimisation, provider behaviour and any additional restrictions. If appropriate conditions are not established, that automation is not used. We do not assume that a tool automatically removes sensitive information.

End-customer information

A launched product may involve purchase, contact, access, support or transaction information. The actual Whop setup determines which parties receive it and for what purpose; the relevant responsibilities and customer-facing information are established before launch. This website does not collect checkout information.

Access needed for product delivery, support, transaction administration or project reporting is separate from independent future marketing. Revenue sharing does not automatically create a right to export or market to a customer list. We do not assume that DNA Lab, the creator and the platform are joint controllers or that one is a processor merely because they collaborate.

Reports use aggregated or redacted information where practical. Customer information for a handover is shared only where lawful, necessary and consistent with the relevant notices and permissions.

International processing

Processing may involve services outside the European Economic Area. For the activity concerned, relevant recipient entities, locations and any required transfer arrangement must be identified and the necessary information provided. We do not claim a particular safeguard, adequacy decision or contractual mechanism without verifying its applicability.

Retention and deletion

Enquiry information is retained while needed for the request, agreed follow-up or a related issue. Public-source research is retained only while relevant to the documented research purpose. Project material is retained for the agreed work and necessary support.

Legal record-keeping or justified dispute needs can require particular records to be retained longer. Information is deleted or anonymised when those purposes no longer justify keeping it; this is not a claim that all existing data is already anonymised. Provider-held logs, backups and copies have their own arrangements.

The applicable retention period or criteria and any deletion limits are established for the actual activity. You can ask about a particular record or request deletion; applicable rights and lawful retention duties are assessed for the request.

Your choices and rights

Depending on the circumstances and applicable law, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where consent is the basis, you may withdraw it without affecting earlier lawful processing.

Email business@dnalab.work to exercise your rights or ask about a research source, recipient or processing purpose. We may need proportionate information to confirm that the request concerns you. You can also complain to the Italian data protection authority, the Garante, or another competent supervisory authority.

Human decisions and updates

AI-assisted audience research informs human work. This website does not make solely automated decisions with legal or similarly significant effects about visitors. Product publication requires human review and creator approval.

The notice is updated when relevant practices change. Additional project processing information is provided before that processing starts; this notice does not authorise undisclosed uses of personal data.