Your information, explained plainly.
This page explains what steva.studio collects, why we use it, who helps us process it, and the choices you have.
Last updated 27 July 2026
Who is responsible
Next Originals operates steva.studio and is the controller for the personal information described on this page.
For any privacy question or request, email us at Email us.
Information we handle
When you submit the contact form, we receive the information you enter and the context needed to understand your request.
- Your name, email address, role, school or organisation, year group, interests and message.
- Your school’s public IB directory identifier when you select a listed school.
- Your city and country. Cloudflare may suggest an approximate location from your network connection; we store it only if you submit the form.
- The page where you submitted the form, the referring site without its query string, campaign tags such as UTM parameters, and advertising click identifiers contained in the page URL.
- A randomly generated lead identifier used to create and deduplicate the successful-enquiry record in our own conversion ledger.
- Whether you separately agreed to receive occasional marketing email, together with the date and version of that choice.
- Your analytics and advertising choices, together with the date and consent-panel version, so later conversion reporting can respect the choice you made.
- A PostHog browser identifier and our internal lead identifier only when you allow analytics, so the confirmed enquiry can be connected to the earlier website journey without sending your contact details to PostHog.
- Technical information processed by Cloudflare to deliver and secure the site. Turnstile uses a temporary verification token and may use your network address to check that a submission is not automated; we do not add either value to the lead record.
Why we use it
We use personal information only for the purposes below and under the corresponding GDPR legal basis.
- To answer enquiries, send requested material and discuss a possible school workshop: steps taken at your request before a possible agreement, or our legitimate interest in responding to you.
- To send occasional news about The AI Lab, The Mirror Machine and related resources: your consent. This choice is optional and can be withdrawn at any time.
- To prevent spam, abuse and attacks and keep the website reliable: our legitimate interest in protecting the service.
- To record which referring source or campaign led to an enquiry in our own lead database: our legitimate interest in understanding which outreach is effective, using only the attribution included with the submitted form.
- To understand aggregate website performance through PostHog’s cookieless mode while Cookieless audience measurement is enabled: our legitimate interest in improving the site without storing an identifier in your browser or creating a person profile.
- To connect visits, interactions and campaign results over time through PostHog first-party storage: your analytics choice.
- To report successful enquiries and later sales stages to analytics or advertising platforms from our server when those services are active and your recorded choice permits the destination.
Analytics and your choices
PostHog is configured without automatic click capture, session recordings or surveys. We send named website events such as page views, button selections, section views, scroll depth and contact-form progress. Cookieless activity does not create a person profile, and only a restricted set of page, campaign and interaction properties is sent; form answers, contact details and advertising click identifiers are excluded.
Before you make a choice, and whenever Cookieless audience measurement is enabled without Analytics cookies, PostHog stores no identifier in cookies, local storage or session storage. Its EU service calculates a temporary identifier from the project, date, source network address, browser information and hostname using a salt that changes daily and is then deleted. PostHog strips the source network address before storing the event.
You can turn Cookieless audience measurement off completely through Privacy choices in the footer. No PostHog events are then sent from the website. This does not stop the limited technical processing Cloudflare needs to deliver and secure the site, or the storage of information you deliberately submit through the contact form.
If you allow analytics, PostHog may use first-party browser storage to connect visits and campaign activity over time. You can withdraw that choice through Privacy choices in the footer.
A successful form submission is first recorded in our D1 lead and conversion database. The browser then records a successful-form event in PostHog without contact details or form answers. Only when you allow Analytics cookies does the browser identify that journey using our internal lead identifier, and the server also sends a pseudonymous confirmed-enquiry event containing the lead identifier, broad form selections and campaign attribution. Next Originals can match that PostHog profile and event to D1, so we treat them as personal information even though PostHog receives no contact fields.
Google, Meta and LinkedIn advertising tags are not currently active. If activated for a campaign, they will load only after you allow Advertising. We will update this policy before enabling a new provider.
We use a strictly necessary first-party consent cookie to remember and apply your choices for about six months. You can change them at any time using Privacy choices in the footer.
International processing
PostHog analytics data is sent to PostHog Cloud EU in Frankfurt. Cloudflare and Google are international service providers and may process other service information outside the European Economic Area. Where European personal information is transferred internationally, we rely on the providers’ data-processing terms and recognised safeguards such as adequacy decisions or the European Commission’s Standard Contractual Clauses.
How long we keep it
- Enquiry and related correspondence: up to 24 months after our last meaningful interaction, unless a school relationship develops or we need a record for legal or administrative reasons.
- Marketing subscription: until you unsubscribe or withdraw consent. We may retain the minimum information needed to honour an opt-out.
- PostHog website analytics: up to 12 months under the current service configuration.
- Security and delivery information: according to the service provider’s operational retention periods and only as long as needed for security and reliability.
Your rights
Depending on the circumstances, you can ask to access, correct or delete your personal information; restrict or object to its use; or receive information you provided in a portable format. You can withdraw consent at any time without affecting earlier lawful processing.
Email us to exercise a right or ask a question. We may need enough information to confirm that the request relates to you. You may also lodge a complaint with the French data-protection authority, the CNIL.
Children’s information
The website describes a programme for children, but its enquiry form is intended for teachers, school decision-makers, parents and other adults. Please do not submit a child’s personal information through the form.
Changes to this policy
We will update this page when our website services or data practices change and revise the date at the top.