In force

Privacy notice

Version: 2 October 2026
Status: In force

In short: when you send a request, we keep what you wrote and your e-mail address so we can answer it. We do not sell a request, use it for marketing, or pass it to an analytics tool or an ad platform. If you join our waitlist, we use your e-mail address once, for the launch e-mail, and only after you confirm it. We use AI tools to help prepare our reply to your request. Your details are not used to train AI models. This site sets no cookies of its own; it keeps your draft words in your browser tab until you send them or close the tab. The spam check on our forms, run by Cloudflare, can set Cloudflare's own cookies.

Contents

Who is responsible

BassWav decides what happens to the data this notice describes. Skilled Routines is its trade name. Write to the contact address below about anything in this notice.

BassWav, trading as Skilled Routines

Koningsweide 8, 5984 PR Koningslust, the Netherlands

Registered with the Dutch Chamber of Commerce (KVK) under number 98170716

contact@skilledroutines.com

The job finder and skill requests

What you type in the field on the home page or the finder is kept in your browser tab (see On your device) and is not sent anywhere until you press send. When you send a skill request, we receive the details listed here.

what: Your words; your e-mail address; the form you chose (self, assisted, managed, not sure, or none); the version of this notice you were shown; a random request number; the time we received it.
why: To understand your request and answer it. Your address is used for that answer only: no mailing list, no marketing.
basis: Steps you ask us to take before a possible contract (GDPR art. 6(1)(b)). Where your request leads to no work, our legitimate interest in answering it (art. 6(1)(f)). Records that tax and accounting law makes us keep: a legal obligation (art. 6(1)(c)).
where: Our database at Supabase, which holds the request itself and a queued e-mail copy of it. The e-mail copy is deleted 30 days after it is sent. It is delivered through Google Workspace to the people at Skilled Routines who handle requests.
how long: If your request leads to no work, we delete it 12 months after our last contact. If it leads to work, we keep it while the work lasts and afterwards as long as tax and accounting law requires.

Requests for managed work

When you send the managed-work request form, we receive the details listed here. Leave out passwords, customer data and anything confidential.

what: Your words; whether the thing exists yet; where it runs; a link, if you give one; the skill you came from, if any; your e-mail address; the version of this notice you were shown; a random request number; the time we received it.
why: To scope the work and answer you. Our systems never open your link; a person opens it only when reading your request. Your address is used for that answer only.
basis: Steps you ask us to take before a possible contract (GDPR art. 6(1)(b)). Where your request leads to no work, our legitimate interest in answering it (art. 6(1)(f)). Records that tax and accounting law makes us keep: a legal obligation (art. 6(1)(c)).
where: Our database at Supabase, which holds the request itself and a queued e-mail copy of it. The e-mail copy is deleted 30 days after it is sent. It is delivered through Google Workspace to the people at Skilled Routines who handle requests.
how long: If your request leads to no work, we delete it 12 months after our last contact. If it leads to work, we keep it while the work lasts and afterwards as long as tax and accounting law requires.

Waitlist for buying on this site

On the pricing page you can ask for one e-mail when you can buy Skilled Routines on this site. Joining is optional, and the list is for people aged 16 or older. You are on the list only after you click the link in our confirmation e-mail. The link expires after 48 hours. If you do not confirm, we delete the request at the latest 7 days after you asked.

You can withdraw your consent at any time: use the link in every e-mail from us, the page skilledroutines.com/waitlist/withdraw, or write to contact@skilledroutines.com. Withdrawing deletes your entry and any e-mail still queued for you. It does not affect what we did before you withdrew.

what: Your e-mail address; which list you joined; the time you asked; the version of the consent text you saw; once you confirm, the time you confirmed; a scrambled (hashed) form of your address, so the same address is not listed twice.
why: To send you one e-mail when you can buy Skilled Routines on this site. That e-mail promotes our offer. We use your address for nothing else, and it is not part of any request you send us.
basis: Your consent (GDPR art. 6(1)(a); for the e-mail itself, art. 11.7 Telecommunicatiewet).
where: Our database at Supabase, London, United Kingdom (eu-west-2), which also holds a queued copy of each e-mail. The confirmation e-mail and the launch e-mail are sent from contact@skilledroutines.com through Google Workspace. The spam check on the form is Cloudflare Turnstile (see Spam and abuse checks).
how long: When we send the launch e-mail, we erase your address. We then keep a record that you consented, a code and timestamps without your address, for 90 days, and delete it. If we have sent no launch e-mail 12 months after you joined, we delete your entry. The queued copy of each e-mail is deleted 7 days after sending.

Spam and abuse checks

Each send is checked by Cloudflare Turnstile, which normally shows you nothing. When the check loads, Cloudflare collects browser signals it calls strictly necessary to detect bots, and can set its challenge cookies inside its own frame: cf_clearance, which records that a check was passed, and the cf_chl_rc_i, cf_chl_rc_ni and cf_chl_rc_m cookies Cloudflare uses to find faults. Cloudflare sets these, not us. We also count sends per device to stop repeated sends.

Cloudflare's processing for this check is described in its Turnstile Privacy Addendum.

Cloudflare Turnstile Privacy Addendum

what: Your IP address, the browser signals Cloudflare collects, and Cloudflare's challenge cookies. We keep only a scrambled (hashed) form of the IP address, never the address itself.
why: To stop automated and repeated sends.
basis: Our legitimate interest in keeping our forms free of automated and repeated sends (GDPR art. 6(1)(f)). The check runs only when a form is used, as part of the send you ask for.
where: Cloudflare receives your IP address for its check. The hashed form is kept at Supabase.
how long: We delete our hashed counts after 24 hours. They hold no readable IP address. Cloudflare sets how long it keeps its own cookies and check data in its Turnstile privacy addendum.

On your device

This site sets no cookies. It keeps three items in your browser's session storage, which the browser clears when you close the tab. Nothing in it is sent anywhere unless you send a request.

find words: find.words: the words you type, so they carry from the home page to the finder and the request form. Removed when your request is sent.
request key: intake.key.<form>: a random request number, so a request you send twice arrives once. Removed when your request is sent.
echo: intake.echo: the e-mail address you sent, so the confirmation page can show where we will reply. Cleared when you close the tab.
basis: Keeping these items is strictly necessary for the form you are using (art. 11.7a Telecommunicatiewet), so it needs no consent. What you then send is covered under The job finder and skill requests.

Hosting

Our host, Vercel, serves every page and keeps technical logs of page requests, including IP address and browser. It receives nothing you type in a form: forms send straight to our database.

basis: Our legitimate interest in serving this site and keeping it secure (GDPR art. 6(1)(f)).
how long: Vercel keeps these logs for the period set in its terms with us, then deletes them.

Visit statistics

We count visits with Vercel Web Analytics. It sets no cookies: Vercel counts a visit by a hash of the page request, and discards that hash after 24 hours. It never receives what you type in a form.

what: Which pages are viewed, the site that sent you, and your type of device, browser and country, counted in total.
why: To see which pages people use, so we can improve them.
basis: Our legitimate interest in knowing which pages are used, so we can improve them (GDPR art. 6(1)(f)).
where: Vercel.
how long: Vercel discards the visit hash after 24 hours.

Buying a skill

Nothing is sold through this site yet, so no payment or order data is processed. Before the first sale, this section will describe what a purchase keeps.

Contacting us

Write to contact@skilledroutines.com about anything in this notice, or to use a right described below. We answer within one month.

Who can see it, and where it is kept

Only the people at Skilled Routines who handle requests, and the administrators of our systems, can read what you send. We use AI tools to help prepare our reply to your request. Your details are not used to train AI models. There is no public way to read it. We do not sell your data.

These companies process data for us, each under a data processing agreement: Supabase (our database, in London, United Kingdom); Vercel Inc. (hosting and Vercel Web Analytics, a US company); Cloudflare Inc. (the Turnstile spam check, a US company); Google (Google Workspace, our e-mail, a US company).

Vercel, Cloudflare and Google are US companies, so your data can reach the United States. These transfers rely on the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the EU standard contractual clauses in our agreement with that company.

Our database at Supabase is hosted in London, United Kingdom (region eu-west-2). Transfers to the United Kingdom rely on the EU adequacy decision for the United Kingdom.

Your rights

You can ask us to show you what we hold about you, to correct it, to delete it, to limit its use, to receive it in a portable form, and to object to our use of it where we rely on our legitimate interest. Where we rely on your consent, as for the waitlist, you can withdraw it at any time; this does not affect what we did before. Write to contact@skilledroutines.com from the e-mail address you used. We answer within one month, and may ask you to confirm it is you. Giving us your words and e-mail address is optional, but without them we cannot answer your request. If you think we handle your data wrongly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or to the authority where you live or work.