Legal

Privacy notice

This notice covers this website and the AI Automation Hub newsletter. It says what is collected, why, who processes it, which cookies need your consent, how long everything is kept, and what you can ask for. Last updated 6 September 2026.

Who is responsible

The controller is Eduard Vlase Limited, trading as AI Automation Hub. Eduard Vlase Limited is registered in England and Wales, company number 16832727. Registered office: 16 Hambleton Grove, Emerson Valley, Milton Keynes, MK4 2JS, United Kingdom.

Contact for anything in this notice, including rights requests: support@ai-automation-hub.net.

What is collected when you subscribe

  • Your email address, lower-cased and trimmed.
  • Consent timestamps: when you asked to subscribe, when you clicked the confirmation link, and when you unsubscribed, bounced or complained.
  • The page you subscribed from, and any utm_source, utm_medium and utm_campaign values in the address bar (64 characters each), plus the hostname of the site that referred you, if any.
  • The exact wording of the consent text you saw (currently version v2-2026-09: "By subscribing you agree to receive emails from Eduard Vlase Limited (AI Automation Hub) about new posts, builds, workshops and the community. Unsubscribe at any time. See the privacy notice."). Earlier versions are kept so that what you were told when you subscribed can always be shown.
  • Which newsletter emails were sent to you, the provider's message id, and whether they were delivered, bounced or reported as spam.
  • A one-way hash (SHA-256) of your address. It is kept on a suppression list after you unsubscribe or ask for erasure so that you are not emailed again by mistake.

The sign-up does not record your IP address, browser details, name, or the full address of the page that referred you. The browser's session storage holds the UTM values above only until you close the tab.

Website analytics, only with your consent

The site uses Google Analytics 4 (property G-RQBJSXLKKZ) to see which pages and videos bring people here. Until you press "Accept analytics" on the banner, the Google Analytics script is not loaded at all: nothing is sent to Google and no analytics cookie is written. After you accept, it runs in Consent Mode with analytics storage only; advertising storage, ad user data and ad personalisation are always denied. Nothing here is used for advertising. It never runs on the webinar sign-in, email confirmation and password reset pages, even after you accept.

Once you accept, Google receives the pages you view, how you arrived (for example a YouTube link), your device and browser type, and a rough location worked out from your IP address. GA4 does not store the address itself. The Google Analytics data is not joined to your newsletter record.

Cookies

No cookie is set without your consent. The website and the newsletter work without any. The only cookies the site can set are the two analytics cookies below, and only after you accept the banner:

  • _ga: tells Google Analytics that two page views come from the same browser. Lasts up to two years.
  • _ga_RQBJSXLKKZ: keeps the state of your visit for this property. Lasts up to two years.

Your choice (accept or decline) is remembered in your browser's local storage under the key aah-consent, so the banner does not ask again on every page. That entry is not a cookie and is never sent to us or to Google.

To withdraw consent or choose again, clear this site's data in your browser (usually under Settings, Privacy, Site data or Cookies, for ai-automation-hub.net). That removes the _ga and _ga_RQBJSXLKKZ cookies and the stored choice, so the banner appears again on your next visit and analytics stays off until you accept it. If you clear only the aah-consent entry from local storage, the banner reappears but the two cookies remain until you clear them too, or they expire.

Why, and on what basis

  • Sending the newsletter: your consent (UK GDPR article 6(1)(a) and PECR regulation 22), given by double opt-in. You can withdraw it at any time with the unsubscribe link in every email, and withdrawal is as easy as subscribing.
  • Keeping the consent record and the suppression hash: legal obligation and legitimate interest in being able to prove consent and honour your objection.
  • Source page, UTM and referrer host: legitimate interest in knowing which channel (YouTube, Skool, other sites) brought you here. This never affects what you receive.
  • Analytics cookies and the analytics data: your consent (PECR regulation 6 for the cookies, UK GDPR article 6(1)(a) for the data), given on the banner and withdrawable as described above.

Who processes it

  • Supabase (the subscriber database), hosted in Ireland, EU, under Supabase's data processing addendum.
  • Resend (email delivery and a mirror of the subscriber list used for sending), EU region, under Resend's data processing agreement.
  • Vercel (website hosting and the code that handles sign-up, confirmation and unsubscribe), under Vercel's data processing addendum.
  • Amazon Web Services (the function that sends newsletters and keeps a weekly encrypted backup), London (eu-west-2), under the AWS data processing addendum.
  • Google (Google Analytics 4), only after you accept the banner, under Google's data processing terms. Google may process the analytics data outside the UK; the transfer is covered by the UK-US data bridge and Google's standard contractual clauses.

No data is sold or shared for advertising.

How long it is kept

  • Unconfirmed sign-ups: 7 days, then deleted.
  • Subscribers who unsubscribe, bounce or complain: 12 months after that change, then deleted. The suppression hash stays.
  • Delivery events: 12 months. Confirmation and test emails: 12 months.
  • Newsletter delivery records: unlinked from you after 12 months.
  • Backups in AWS: 90 days. Resend's own logs: 30 days.
  • Google Analytics event data: 2 months, the default retention for a GA4 property, after which only aggregated reports remain. The analytics cookies expire two years after your last visit.

Your rights

You can ask for access to your data, correction, erasure, restriction, a portable copy, and you can object. Your objection to marketing is absolute: unsubscribe and it stops. You can also withdraw consent at any time without affecting what happened before. Email support@ai-automation-hub.net from the address in question and you will get an answer within one month. Requests about an address are only acted on when they come from that address, or after a signed link is sent to it.

If you are unhappy with how your data is handled you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

Changes

Each version of the consent wording is kept with its effective date so that what you were told when you subscribed can always be shown. Changes to this notice are dated at the top; a change to what is collected or why will be announced in the newsletter before it takes effect.