Who handles this site's data

We ask every vendor on the board to publish a list of the companies that handle their data. Few do. Here is ours.

Lovable hosts and builds this site. Lovable's privacy policy ↗
Cloudflare runs the network Lovable uses to deliver this site, and protects it against automated traffic. Cloudflare's privacy policy ↗
Supabase provides the site's database: provider portal accounts, claims, evidence submissions and correspondence records, and the update email list. Supabase's privacy policy ↗
GitHub hosts the public data feed the board reads. The feed contains assessment data about companies and products, nothing personal. GitHub's privacy statement ↗
Google Workspace handles email to and from ettol@genedlabs.ai. Google's privacy policy ↗
Sign-in and account emails are currently sent through Supabase.
Plausible Analytics (Plausible Insights OÜ, Estonia; data held in Germany) counts visits to the board. It uses no cookies and stores no personal data. Plausible's privacy policy ↗
Google Analytics 4 measures how the board is used, and only after you accept analytics. Google sets no cookie until you do, and advertising features are switched off. Google's privacy policy ↗

That is the full list. If it changes, this page changes first.

Cookies on this site (checked 09-10-2026)

Cookie	Set by	What it does	How long	Can you refuse it?
`session-id`	Lovable, our host	Counts visits and page views for the host's built-in statistics	30 minutes, renewed while you browse	Not at present. It is set when a page opens. We are working to remove it.
`__cf_bm`	Cloudflare, for Lovable	Tells visitors from automated bots, to protect the site. Also set when the ETTOL badge is shown on another website.	30 minutes	No. The site depends on it for protection.
`__dpl`	Lovable, our host	As we understand it, keeps your visit on one version of the site while an update goes out	24 hours, renewed on each page	No. It is needed for the site to load consistently.
`_ga`, `_ga_…`	Google Analytics	Counts how the board is used	2 years (Google's default)	Yes. Set only if you accept. Cookie choice in the footer changes your answer.

Your cookie choice itself is kept in your browser, not on our servers.

What we do not hold

This site has no pupil accounts and processes no children's data. That is why there is no data processing agreement, no data protection impact assessment and no safeguarding page here: those documents exist for organisations that process pupil data, and we are not one. The same reasoning the board applies to tools applies to us: not every check applies to every kind of organisation, and saying which and why beats pretending.