Privacy policy.
CPLT helps teams understand private AI and, where needed, builds it for them. Its own privacy practices should survive the same scrutiny. Here is everything this site does with data, in plain terms. Last updated 9 September 2026.
Who is responsible
The data controller for cplt.tech is CPLT, operated by Stéphane Lepain. For anything in this policy, write to hello [at] cplt [dot] tech — you will get an answer from me personally.
The contact form
If you write to me through the form, I process what you submit: your name, work email, the message itself, and — only if you choose to provide them — company, role, and which scenario sounds like you. This is used for exactly one purpose: reading your inquiry and answering it (Art. 6(1)(b) GDPR — steps prior to entering into a contract).
Your submission is stored in a database on this site's own server in the EU, and a notification email is delivered to my inbox through my hosting provider's mail service. It is not sold or used for marketing lists. I keep submissions for as long as the conversation is live; ask and they are deleted.
The form is protected against bots by Cloudflare Turnstile, which processes technical signals from your browser (including your IP address) to tell humans from scripts (Art. 6(1)(f) GDPR — keeping automated abuse out). Cloudflare's own privacy policy is at cloudflare.com/privacypolicy. The hosting provider also processes the stored submission and notification email.
Analytics
This site uses Umami, self-hosted at stats.cplt.tech on infrastructure I operate — the same discipline I bring to paid builds. It sets no cookies, does no cross-site tracking, and stores no personal profiles; I see aggregate page counts and anonymous events on the hosting infrastructure described below.
Events include links to Services or contact, questionnaire clicks, video-load clicks, starting the contact form, submission attempts, successful storage of a submission and broad error categories. Clicking Send does not count as an enquiry. Names, email addresses and message contents are not sent to analytics. The selected service and whether a company was supplied may be counted. You can disable analytics in this browser on the analytics opt-out page. Enquiry qualification and follow-up are handled separately from these aggregate events.
Optional video player
The homepage video player connects to YouTube only after you choose to load it. The dedicated video and transcript page loads the player when you visit it. I use youtube-nocookie.com for the embed. YouTube then receives connection information and handles playback under its own privacy policy. You can use the questionnaire and contact page without loading the video. A video-load click is not a completed view, and a questionnaire click is not proof of a completed download.
The essay list
If you subscribe to Field Notes, I store exactly one thing: your email address, in the same database on the same EU server as everything else. It is used for one purpose — sending you an email when a new essay is published (Art. 6(1)(a) GDPR — your consent, given when you subscribe). No marketing-list sales, no profiling, no other mail. Unsubscribe any time by replying to any essay email or writing to hello [at] cplt [dot] tech, and the address is deleted.
Server logs
Like every web server, this one keeps standard access logs (IP address, requested URL, timestamp, user agent) for security and operations (Art. 6(1)(f) GDPR). They are used to detect abuse and debug problems, nothing else, and are rotated on a short schedule.
Where everything runs
cplt.tech runs on a virtual server in Germany, provided by Hostinger and operated by me — the web server, the database, and the analytics all live there. Hosting, email delivery and the Turnstile bot-check involve the providers described above. Their processing is distinct from the self-hosted analytics.
What this site does not do
I do not install advertising trackers or sell your data. Provider processing is limited to the services described above. No profiling or automated decisions about you.
Your rights
Under the GDPR you can ask me for access to the data I hold about you, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format. One email does it. You also have the right to lodge a complaint with your supervisory authority.