Privacy
What gets collected, why, who else sees it, and how to make it go away.
lib/legal.ts and set LEGAL_CONFIRMED before taking payment, and have both documents reviewed by someone qualified.This is written to be read rather than to be defensible. If something here is unclear, ask me at [SUPPORT EMAIL] and I will rewrite the paragraph.
Who is responsible
[LEGAL NAME], trading as slux Labs, [SUPPORT ADDRESS], Sweden. Contact: [SUPPORT EMAIL]. Under the GDPR I am the data controller for everything described here.
What is collected, and why
| What | Why | Legal basis |
|---|---|---|
| Your email address | To send you the primer, to unlock it on return visits, and to send the newsletter if you asked for it | Consent, and performance of a contract once you are a member |
| Which form you used, and the UTM tags or referring site you arrived with | So I know which writing and which video actually brought people here, rather than guessing | Legitimate interest |
| Whether you started or finished the primer | To know where readers stop, so the document can be fixed | Legitimate interest |
| Account email and membership status | To know what you have access to | Performance of a contract |
| Your Discord user ID, if you connect Discord | To grant and remove the member role | Performance of a contract |
| A one-way hash of your IP address | Rate limiting. Two waves of subscription bombing in August 2026 signed strangers up to my list from harvested addresses; this is what stops it | Legitimate interest |
On that last one: the IP address itself is not stored. It is hashed with a secret key the moment the request arrives and only the hash is kept, which is enough to count requests and not enough to recover the address.
There is no analytics tracker on this site. No Google Analytics, no Meta pixel, no session recording, no advertising cookies, no cross-site tracking of any kind. That is why there is no cookie banner — there is nothing to consent to.
Card details
I never see them. Payments run through Stripe, which collects and stores card information directly; what reaches this site is a customer reference and whether the subscription is active.
Who else processes it
- Vercel — hosting and server logs
- Supabase — the database and sign-in
- Stripe — payments and subscriptions
- Kit — the mailing list
- Resend — sign-in and confirmation emails
- Discord — the community, if you join it
Each is a processor acting on my instructions. Some are outside the EEA, in which case transfers rely on the European Commission's standard contractual clauses or an adequacy decision. Nothing is ever sold, rented, or shared for advertising.
Cookies
primer_access— a signed token proving this browser gave an email, so the primer stays open. One year.so_session— keeps you signed in.so_utm— the first campaign tags you arrived with, so a signup can be attributed to the right video. Thirty days.
Your browser also stores your reading position in the primer locally. That never leaves your device.
How long it is kept
Lead records and funnel events are kept while the list is active and deleted on request. Account and membership records are kept while you have an account, and for as long afterwards as tax and accounting law requires. Rate-limit hashes expire within days.
What you can ask for
Under the GDPR you can ask for a copy of your data, ask for it to be corrected or deleted, ask me to restrict or stop a particular use, ask for it in a portable format, and withdraw consent at any time. Every newsletter has an unsubscribe link that works immediately and without asking me.
Email [SUPPORT EMAIL]. I will respond within 30 days, and usually much sooner. If you think I have handled your data badly you can complain to Integritetsskyddsmyndigheten (IMY), the Swedish data protection authority.
Changes
If this page changes materially, the date at the top changes and members are told by email. See also the terms.