What we collect, and why.

Who this is

This site is operated by Hands On AI Lab LLC, a Colorado limited liability company on the Western Slope. Questions about anything on this page go to christopher@handsonailab.com.

What you give us on purpose

A few places on this site ask you for something. Each one is optional, and each one only asks for what it needs.

• The contact form. Your name, email address, and message, plus the topic you select. If you ask about a private session, an organizational workshop, integration support, or website design, the form also asks about your goal, any deadline, and — for the session and workshop topics — an expected participant count. This is delivered to Christopher as email through SMTP2GO. It is not added to any mailing list.
• Event feedback. After a class you may be given a feedback link. It collects three ratings, optional written answers, and — only if you choose to enter it — a name. Responses are stored in a Cloudflare D1 database. Nothing you write is published unless you explicitly select a publication option, and the published wording is your own.
• Booking. When you book a consultation, session, workshop or community event, we ask for your name, email address and phone number; your organization and title if you are booking for one; where the session will happen, with any directions for finding the room; and what you want to get out of it, your experience with AI, any accessibility needs, and how you heard about us. Community event requests also ask about the event and the organization hosting it, so we can confirm it qualifies. Only what the booking needs is required.
• Signing and paying. Paid work is covered by a service agreement you sign by typing your name. The signature record keeps that name, the time, the email address the link was sent to, and the IP address and browser details of the device you signed on. Card payments are taken by Stripe on our pages; we never see or store your full card number. We keep the amount, date, and the card brand and last four digits so your receipt can say how you paid.
• Email signups. The Friday event roundup is handled by MailerLite; the weekly column is handled by Substack. Each stores the address you enter, and each email carries an unsubscribe link that works.

During sessions and events

We do not keep the prompts you type, the AI output you get back, screenshots, or documents you work on during a consultation, session, workshop or Integration Support call, unless something is deliberately part of a custom project we are delivering to you.

AI-assisted note-taking may be used during consultations and sessions so that what was discussed and what happens next are captured accurately. You will be told when transcription is on. Those notes stay with your client record.

Please never give us passwords, sign-in codes or other credentials. We do not need them and will not ask.

We may take still photographs at events for our website, social media and portfolio. A host can opt an event out in writing beforehand, and if anyone at the event objects, we take no photographs there. Recording our instruction needs a separate written agreement.

What is collected automatically

This site uses Google Analytics to understand which pages and events people find useful. It records page views and a small number of deliberate actions: clicking an email or phone link, saving the contact card, opening an event registration page, and downloading a class handout. It sets cookies to do that.

The site is hosted on Cloudflare, which keeps standard request logs, including IP addresses, as part of serving and protecting the site. The contact form and booking pages use Cloudflare Turnstile to tell people apart from bots, and the booking system counts requests by IP address for a short time to slow down abuse; those counters are deleted within a day.

Booking emails contain private links that let you manage a booking, sign, pay or book support time without an account. Treat them like a key: anyone with the link can use it. We store them only in scrambled form, and they expire.

If you would rather not be counted, browser tracking protection, an ad blocker, or a Do Not Track extension will stop the analytics script. Nothing on this site stops working when you do that.

Who else touches it

We use ordinary service providers rather than building our own infrastructure, which means those providers process some of your information under their own policies: Cloudflare (hosting, security, and the feedback and booking databases), Stripe (card payments and refunds), Google (Calendar for scheduling, Meet for video sessions, Drive for storing agreements, invoices and receipts, and Maps to confirm addresses and work out travel time and any travel fee), Google Analytics (usage measurement), SMTP2GO (delivering form submissions and booking emails), MailerLite (event updates), Substack (the weekly column), and Eventbrite (registration, on Eventbrite's own pages). We do not sell, rent, or trade your information, and we do not buy lists.

How long it is kept

Contact form messages live in Christopher's email like any other correspondence, and are kept as long as they are useful for the conversation they belong to. Feedback responses are kept so classes can be improved over time, and published testimonials remain up until you ask for them to come down. Mailing list entries are kept until you unsubscribe.

Bookings, invoices, payments, refunds and signed agreements are business and tax records. They are kept for as long as those purposes and the law require, and they are not deleted automatically. Short-lived technical data, such as expired links and abuse counters, is deleted on a schedule.

What you can ask for

Write to christopher@handsonailab.com and ask what is held about you, ask for it to be corrected, ask for a published testimonial to be removed, or ask for your information to be deleted. You do not need a reason and you will not be talked out of it. The one limit is records we are required to keep, such as invoices and signed agreements; those can be corrected but not erased while that requirement lasts. Colorado residents have rights under the Colorado Privacy Act; the same address is where you exercise them.

Children

Bookings and paid services are for adults, and this site is not directed at children under 13. Anyone under 18 may attend a community event only with a parent or guardian present for the whole event, and we do not collect information from them. If a child has given us information, write to us and it will be deleted.

Changes

If this policy changes, the effective date above changes with it. Material changes will be noted in the weekly email rather than quietly edited in.