Privacy notice and personal data governance.

Effective Date & Document Authority

This policy took effect on 2026-10-30 and represents the binding personal data governance framework for Learhatven.

Data Controller Identity

The data controller responsible for the processing of personal data collected through this website is:

Learhatven operates educational course websites, educational showcases, and design mentorship practices under the direction of Irina Kuznetsova, web designer since 2021.

Protection of Children

The services and web pages provided on learhatven.com are intended strictly for adult business operators, professional educators, and adult independent students. We do not knowingly solicit, take, or store personal information from children under the age of 18. If a parent or guardian discovers that a minor has submitted personal data through our inquiry forms, please contact us at [email protected], and we will delete the information from our records within 48 hours.

Categories of Data Collected

We collect only the information strictly necessary to answer consultation requests, scope educational web platforms, and maintain website security:

• Inquiry Form Data: When you submit a project request through mahi7bc.php, we collect your full name, email address, telephone number, studio address or city, selected project kind, target scope or page budget, syllabus and operational notes, and your explicit consent choice.
• Support Chat Records: The chat widget at jojo67d.php records the text of your conversation, along with a session token stored in your browser’s local storage so you can review message replies.
• Technical Log Data: Our hosting infrastructure automatically records the visitor’s IP address, browser user-agent string, operating system version, HTTP referrer URL, and the timestamp when the request was initiated and completed.
• Advertising Click Identifiers: When visitors arrive via sponsored campaigns, the destination URL parameters (such as gclid, msclkid, or fbclid) are recorded in server logs to evaluate campaign efficacy.

No account registration, user passwords, credit card numbers, or automated billing records are processed or held on learhatven.com. The catalogue and service scope are strictly inquiry-based.

Purposes of Processing

We process personal information for the following specific business purposes:

• To prepare detailed architectural quotations and scope plans for 5–10 page educational showcases and booking portals.
• To schedule and deliver one-on-one digital craftsmanship and curriculum design mentorship sessions with Irina Kuznetsova.
• To respond to direct telephone, chat, and email inquiries submitted by prospective clients.
• To verify website security, prevent spam via server honeypots, and diagnose technical server anomalies.
• To evaluate the performance of our paid marketing campaigns across authorized digital channels.

Legal Bases for Processing

For visitors subject to the General Data Protection Regulation (GDPR) or similar global frameworks, our lawful processing bases are:

Advertising Platforms & Click Identifiers

This website receives active, paid traffic from Google Ads, Microsoft Advertising, and Meta Ads. When a visitor clicks on one of our sponsored advertisements, the network appends a unique click identifier to the landing URL:

• Google Ads: Appends the gclid (Google Click Identifier) parameter to evaluate search query matching and ad relevance across google ads campaigns.
• Microsoft Advertising: Appends the msclkid parameter to measure Bing search and partner audience interaction from microsoft advertising campaigns.
• Meta Ads: Appends the fbclid parameter where educational campaigns are directed through Facebook or Instagram profiles under meta ads.

These identifiers (gclid, msclkid, fbclid) allow our systems to confirm which campaign originated a visit from google ads, microsoft advertising, or meta ads. We do not merge click identifiers with third-party data broker profiles.

Google Consent Mode v2 Architecture

Our site implements Consent Mode v2 directly within our client-side runtime. Before any tracking script or analytics module loads, four core consent flags are initialized in an explicit denied state:

• ad_storage: Denied
• ad_user_data: Denied
• ad_personalization: Denied
• analytics_storage: Denied

These four signals remain strictly denied until the visitor grants affirmative consent via our cookie banner. If the visitor selects “Decline Non-Essential”, or later revokes permission through the footer preference control, all four parameters are instantly reset to denied, preventing the transmission of tracking signals and ad personalization tokens.

Global Privacy Control (GPC)

We fully respect the Global Privacy Control signal transmitted by modern browsers via the Sec-GPC header. If your browser sends a Global Privacy Control signal, our systems automatically treat this as an affirmative opt-out request for analytics and targeted advertising storage, without requiring any additional user interaction.

Authorized Data Processors

Learhatven transfers data only to established infrastructure providers and platform partners necessary to operate our website and services:

• Google LLC / Google Ireland Ltd: Operates Google Ads and Google Analytics. Details on Google’s processing practices are available at policies.google.com/privacy.
• Microsoft Ireland Operations Ltd: Operates Microsoft Advertising. Microsoft’s privacy commitments and data handling rules are detailed at privacy.microsoft.com/privacystatement.
• Meta Platforms Ireland Ltd: Operates Meta Ads and related social advertising infrastructure.
• Web Hosting & Server Infrastructure: Our production web servers and relational databases reside in secure, ISO-certified data centers located in the United States.
• Mail Service Provider: Encrypted email forwarding infrastructure that delivers inquiries to our Chicago inbox at [email protected].

International Data Transfers

Learhatven is based in the United States. Personal information collected through our website from visitors located in the European Economic Area, the United Kingdom, or Switzerland is transferred to and stored in the United States. Where such transfers occur, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent adequacy frameworks to ensure that your personal information receives a level of protection comparable to that required by European law.

Data Retention Schedules

We maintain clear, finite retention schedules rather than indefinite storage:

• Consultation Inquiries & Email Correspondence: Retained for exactly 24 months following the date of submission to maintain records of design proposals and agreed scope documents.
• Support Chat Transcripts: Retained in active database logs for 12 months, after which conversation records are permanently purged.
• Server & Access Logs: IP logs and network request histories are held for 90 days for diagnostic, security, and rate-limiting purposes, after which they are automatically rotated and overwritten.
• Cookie Consent Choices: Your consent state stored under site_consent_v2 is maintained in your browser for 12 months before prompting reconfirmation.

Security Measures

We protect all data transmitted to learhatven.com through modern Transport Layer Security (TLS 1.3) encryption. Access to our server logs and database storage is restricted to authorized administrative personnel via multi-factor authentication and strict SSH key controls. Our forms incorporate server-side validation and honeypot mechanisms to prevent malicious injection attacks and automated credential stuffing.

European GDPR Privacy Rights

Under the General Data Protection Regulation (GDPR), visitors residing in the European Union or United Kingdom are entitled to specific statutory rights regarding their personal data:

• Right of Access: You may request a copy of all personal information we hold regarding your inquiries.
• Right to Rectification: You may request corrections to inaccurate or incomplete contact records.
• Right to Erasure (“Right to be Forgotten”): You may request the permanent deletion of your inquiry messages and contact logs.
• Right to Restriction: You may restrict the scope of processing while a factual dispute is investigated.
• Right to Data Portability: You may receive your data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object at any time to the processing of your data based on legitimate interests.
• Right to Withdraw Consent: Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

United States & California Privacy Rights (CCPA / CPRA)

Under US state privacy statutes, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), Colorado Privacy Act, Virginia Consumer Data Protection Act, and Illinois state laws:

• Right to Know: You may request disclosure of the specific categories of personal data collected, the business purposes, and third parties receiving such data.
• Right to Delete: You may request deletion of personal information collected directly from you.
• Right to Opt-Out of Sale or Sharing: Learhatven does not sell personal data for monetary consideration. We do not share personal information with third parties for cross-context behavioral advertising without explicit affirmative consent.
• Right to Non-Discrimination: We will never deny services, charge different hourly rates, or alter quotation terms because you exercised your privacy rights.

Right to Lodge a Regulatory Complaint

If you believe our data processing violates applicable privacy regulations, you have the right to lodge a formal complaint with the relevant supervisory body:

• In Illinois: With the Office of the Illinois Attorney General, Consumer Protection Bureau.
• In California: With the California Privacy Protection Agency (CPPA) at cppa.ca.gov.
• In the European Union: With the Data Protection Authority in your EU Member State of habitual residence or workplace.

Data Subject Access Requests (DSAR)

To exercise any of the statutory rights described above, submit a written request to our dedicated privacy contact:

We acknowledge all data access requests within 48 hours and deliver our substantive written response within 10 days of verification. We may request basic identity verification (such as confirming access to the email address used in the original inquiry) to protect client confidentiality.

Policy Updates & Notifications

We review and update this privacy policy periodically to reflect operational refinements, new educational formats, or changes in regulatory standards. All revisions are posted directly to this URL with a revised effective date. For significant updates impacting previously collected data, active clients will be informed via direct email notification.

Direct Human Privacy Contact

For specific inquiries regarding our data handling procedures, you may reach Irina Kuznetsova directly at our Chicago studio:

Email: [email protected]
Telephone: +1 (846) 555-4596
Postal Address: 400 South LaSalle Street, Chicago, Illinois 60605, Chicago, Illinois, United States