Book an audit

Home / Privacy

Privacy

Privacy

This page explains how Baked Labs handles personal data on bakedlabs.co and in our emails. Baked Labs is the trading name of Saiem Amer and is not a company. Saiem Amer is the data controller for everything on this page.

What our own tracker does

Public pages load a small script at /a.js. The script does not set cookies. It does not write to localStorage, sessionStorage or indexedDB. It only talks to our own server at /api/collect on the same site.

On each page view the script sends the event name, the page path, the referrer URL and the query string. When you click a booking link that points to our Cal.com page, or a link marked for booking, it also sends a book_call event with the same fields.

The script does nothing if your browser has Do Not Track set to 1, if Global Privacy Control is on, or if the browser reports itself as an automated tool.

What we store from the tracker

Our collector at /api/collect stores no cookies. It answers with an empty 204 response and never sets a Set-Cookie header.

It does not keep your raw IP address. It builds a visitor id by hashing a daily salt with your IP, your user-agent string and the site host, using SHA-256, and it keeps only the first 32 hex characters of that hash. The salt lives in our database and rotates every day. Old salts are deleted, so the same visitor cannot be linked across days through that id.

For each allowed event the collector stores a timestamp, the calendar day, the page path, the referring host when it is a different site, any utm_source, utm_medium and utm_campaign values from the query string, the country code Cloudflare reports for the request, a coarse device class of desktop, mobile or tablet taken from the user-agent, the event name, and the visitor id described above. Paths are cut at 300 characters. Referring hosts are cut at 200. UTM values are cut at 100.

Only pageview and book_call events are accepted. Requests from known bots are ignored. Posts that carry another site's Origin header are ignored. Bodies longer than 2048 characters are ignored. The collector rate-limits each visitor id to 60 events per minute. We rely on legitimate interest to count visits in this cookie-free way.

If you request the scorecard

When you request the dbt Project Health Scorecard, we store your name, email and company, your consent and its wording version, the time, the country Cloudflare reports, the page you came from, and a keyed hash of your IP address that we use to limit repeat signups. We use this to send the scorecard and the related emails you agreed to. Reply to any of them to unsubscribe. Download links expire after 7 days. We rely on your consent for this.

If we emailed you

We send a small number of plain text emails to people at companies that are hiring for data roles. We find the role in a public job ad. We find your name and role on public pages such as your company's website or LinkedIn, sometimes through Exa's people search, and we find or check your work address with Kitt and BounceBan before we write. We keep your company, name, role, work email, the ad we saw, when we emailed you and any reply, in our own files and in Gmail. We rely on legitimate interest, because the email is about your role and your company's public hiring. In the UK we only email corporate addresses. In Australia and New Zealand we only use addresses your company publishes, and only about your role. Every email ends with a way to opt out. If you reply, we stop, and we add your address to a do-not-contact list so it stays that way.

Who processes the data

Saiem Amer, trading as Baked Labs, controls the data described on this page. These organisations process data for us when we use their services.

We do not sell personal data.

Your rights

You can ask to see, correct or delete your data, or object to how we use it. If you are in the EU or the UK, you can also complain to your data protection authority.

Retention

Events from our own tracker are kept for 12 months, and older rows are deleted automatically. Salts already rotate every day, and rate-limit rows older than a few minutes are cleared.

Scorecard signups and prospect records (leads, send log) are kept for 24 months, or deleted sooner on request.

The do-not-contact list is kept for as long as we send cold email. It holds only the email address and the opt-out date.

Rising Labs analytics

Public pages also load an analytics script from risinglabs.co, a service Saiem Amer also runs. Saiem Amer is the data controller for that service too. The script does not set cookies and does not write to localStorage or sessionStorage. It posts events to https://risinglabs.co/api/event. risinglabs.co is served through Cloudflare, so Cloudflare processes these requests too. Like any web request, each event reaches risinglabs.co with your IP address and browser user-agent. Your IP address is not saved. Rising Labs does not save the full user-agent. It reads it once per hit to make the daily visitor hash and to derive browser, OS and device labels, and only those labels are stored. It also stores page path, referrer source, UTM tags, country (from Cloudflare, not the IP), screen size, browser language and time on page. The visitor hash resets daily, so nobody can be followed across days through it. On each page view it sends the full page URL including any query string, the site name, the referrer, the window width, the document language, whether the page is marked as a 404, and a random id that your browser makes for that page view and does not store. It also sends how many seconds you spent on the page and how far you scrolled as a percentage, and it records outbound link clicks and file downloads without the link query string, phone and email clicks without the number or address, and clicks on elements marked with data-rla or data-cta. It does nothing when Do Not Track is set to 1, when Global Privacy Control is on, or when the browser reports itself as an automated tool. We rely on legitimate interest for this as well.

Rising Labs events are stored in a Cloudflare D1 database on the Rising Labs Cloudflare account, not the bakedlabs one. Raw visit events are kept for about 26 months and then deleted, leaving only daily totals with no visitor ids. Cleanup runs when the dashboard is opened, so the exact day of deletion can vary.

Cloudflare Web Analytics

Public pages also load Cloudflare Web Analytics. The script beacon.min.js loads from static.cloudflareinsights.com and posts to cloudflareinsights.com/cdn-cgi/rum. The script does not set cookies and does not write to localStorage or sessionStorage. From the script and from a live page capture, each report can include the page URL, the referrer, a page-load id, a site token, paint and navigation timings, browser engine labels, and memory figures. How Cloudflare stores that data is described in Cloudflare's own privacy policy at https://www.cloudflare.com/privacypolicy/.

How to reach us

For privacy requests, email saiem@bakedlabs.co. You can also book a call at https://cal.com/saiem-amer/intro-with-baked-labs and ask for privacy.

Changes

We will update this page when the tracker, the collector, the scorecard form or our outreach practice changes.