Privacy
Updated: 26 October 2026
Controller
CoreLayerLabs e.U., owner Florian Balaj, Liselotte-Schmidinger-Straße 9/6, 4600 Wels, Austria. Contact us at info@corelayerlabs.com with questions about your data.
Your enquiry
The form requires your name, email address and project description. Your company or planned business, budget, phone number and current website address are optional. Forms for specific services also submit the requested project type. We use these details to respond and discuss a potential project. Article 6(1)(b) GDPR applies to pre-contractual enquiries; other correspondence is processed under Article 6(1)(f), based on our legitimate interest in answering your enquiry.
Form entries during page changes
If you change language while writing an enquiry or application, or withdrawing cookie consent reloads the page, your entries are temporarily stored in this browser tab for a one-time transfer. The reloaded form restores them and removes the stored copy. Drafts older than two minutes are not restored. This transfer does not send your entries to a server or analytics service. Application attachments and filenames are not stored; files must be selected again after the page change. The form explains this.
Applications
When applying on our careers page, we process your selected role, name, email address, message and optional portfolio links or PDF documents to assess and handle your application. Resend sends these to Florian Balaj in our Google Workspace mailbox. Files are not published or additionally stored in a website database. Please do not submit unnecessary special categories of personal data. The legal basis is Article 6(1)(b) GDPR for pre-contractual steps. We review deletion when the procedure concludes; protecting legal claims may justify longer retention. This form does not add you to an applicant pool.
Storage and email
Enquiries are sent directly to our mailbox through Resend. They are not additionally stored in a website database. Resend sends an acknowledgement to your email address and enquiry notifications to us containing the submitted contact details and project description. Our mailbox uses Google Workspace. Form contents are not shared with advertising partners or used for newsletters.
Hosting and security
Vercel hosts this website. Technical information such as IP address, request time, requested URL and browser information may be processed to provide and protect the website. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in secure, reliable operation. To limit repeated submissions, we retain short-lived, pseudonymous identifiers derived from the email and IP address within each server instance for up to 15 minutes. A random request identifier prevents duplicate emails within the sending retry window.
Optional visitor statistics
Visitor statistics are provided by Microsoft Clarity as described below. Vercel Web Analytics is not currently enabled. Analytics loads only with your permission. You can reject analytics or withdraw permission for future processing through Cookie settings in the footer.
Microsoft Clarity
If you allow analytics, we also measure the enquiry journey: contact form viewed, form started, submission attempted, technical error and server-accepted enquiry. A sanitised visit source (source, channel, campaign, advertising keyword and landing path, without the full URL or click identifier) is retained in session storage for up to 30 minutes. If you submit an enquiry during this period, this optional analytics context is included in the internal enquiry email. Enquiries work without analytics; withdrawing consent clears the saved visit source. With your consent, we use Microsoft Clarity, provided by Microsoft Corporation, for heatmaps and session replays. Data processed includes page URLs, clicks, scrolling, technical device and browser information and IP addresses. Analytics cookies associate page views with sessions. Contact and application forms and their contents are masked; we do not send names, email addresses or project descriptions as custom identifiers. Advertising storage is denied through the consent API. The legal basis is your consent under Article 6(1)(a) GDPR. We do not load Clarity without consent. You can withdraw consent through Cookie settings; the page then reloads to end recording. Recordings are generally retained for 30 days; selected or labeled recordings and aggregated data may remain available for up to 9 months. Microsoft also processes data in the United States under its privacy statement linked below.
Optional ad measurement with Google Ads
When ad measurement is configured, the Google tag loads only after your separate consent. Google Ireland Limited can then attribute accepted enquiries to ad clicks. Google processes information including click identifiers, page address, IP address, browser information and a random enquiry identifier to prevent duplicate counting. We send no names, email addresses or project descriptions to Google Ads. We do not use enhanced conversions or permit personalized advertising. The legal basis is your consent under Article 6(1)(a) GDPR. You can reject or withdraw ad measurement independently of visitor statistics through Cookie settings in the footer. Withdrawal clears our first-party advertising cookies and reloads the page to unload the Google tag. Without consent, no Google tag or corresponding measurement events are sent.
Service providers and international processing
Vercel, Resend, Microsoft and Google may process information outside the European Economic Area. Processing is subject to data processing agreements and applicable safeguards for international transfers, including adequacy decisions or standard contractual clauses. See the linked provider privacy information below.
Retention
We keep enquiries while needed to respond and continue the correspondence. We review deletion after the enquiry is concluded. Statutory retention requirements and the protection of legal claims may justify longer retention. Your visitor-statistics and ad-measurement choices are considered in local browser storage for up to 180 days.
Your rights
Subject to GDPR requirements, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may withdraw consent for future processing and complain to the Austrian data protection authority or another competent supervisory authority.
You can choose to contact us through the WhatsApp link. The link opens WhatsApp as an external service. We use your phone number, visible profile details and the messages you send to respond to your enquiry. This website does not embed a WhatsApp chat or WhatsApp tracking script. You can also contact us by email or through the contact form. WhatsApp’s processing is covered by the provider’s privacy information.