MADE BY PROTO / POLICIES
Privacy Policy
How information is used across Made by PROTO, PROTO+ workshops, the private participant app and PROTO Weekly.
Last updated:
On this page
1. Who is responsible and how to reach us
Christer Berggren, the independent creator operating Made by PROTO and its PROTO+ initiative, is responsible for the processing described in this notice. Contact hello@madebyproto.eu for privacy questions or to exercise your rights. This notice applies to madebyproto.eu and its participant features, not to an external app or website merely mentioned in the portfolio.
This notice is dated 27 October 2026. It distinguishes our application’s handling from the separate account, infrastructure and security processing of its service providers.
2. Information collected and where it comes from
Public browsing involves technical request information needed by the hosting service, such as an IP address, requested URL, time, browser details and security information. A search term appears in the Journal’s query URL and may appear in technical logs. Do not put confidential information into a public search or a URL.
Published editorial material may identify an author, a public figure or another person relevant to the subject. Information comes from sources identified in the article, publicly available material or contributions supplied for publication. Public articles, credited images and author information are visible to visitors and may be distributed through the site’s feed, newsletter, search engines or links shared by readers.
You supply the information in a general PROTO+ interest form: name, email address, selected interests, an optional message, a separate newsletter choice and the time and version of the privacy information shown. The form does not request a birth date, national identity number, payment details or identity documents.
Workshop interest records contain your name, email, confirmation that you are at least 60, optional answers about experience, ideas and practical participation needs, status and relevant timestamps. Acceptance, cancellation, attendance, communication history and voluntary feedback may be added as the activity progresses. These records are not public.
For the private participant app, we hold the approved name and email, the site-specific account identifier supplied through ChatGPT sign-in, approval and access status, and relevant timestamps. Your own saved idea titles and notes are stored under that account identifier. An organiser can add your name and email when approving access; sign-in information comes from the authentication provider. We do not receive your ChatGPT password or access to your conversation history through this app.
If you write directly by email, the message, contact details, attachments and correspondence are processed in the relevant mail systems. Newsletter records, when subscriptions are enabled, contain an email address, consent wording and version, confirmation and subscription status, relevant timestamps and delivery references. Administrative security records identify the authorised operator, action, record reference and time.
3. Purposes and legal bases
General interest forms and workshop interest are processed on the basis of the consent requested in those forms, to respond about the selected initiative and administer the activity you asked about. Optional marketing is based on a separate choice. You can withdraw consent by contacting hello@madebyproto.eu; this does not make earlier lawful processing unlawful. If withdrawing required information makes an activity impossible, we will explain that consequence.
Participant approval, account security and access restrictions rely on the legitimate interests of running a safe, limited-access learning space and preventing unauthorised disclosure. Storing your private notes and providing the requested app functions rely on your request for that service and our legitimate interest in delivering it. These interests must be balanced against your rights; you can object as described below. They are not used as a substitute for newsletter consent.
Editorial use of personal information is assessed against the legitimate interests in independent reporting and commentary and the applicable protections for journalism and freedom of expression. These do not create a blanket exemption from accuracy, proportionality or other applicable duties. Publication-related privacy or correction requests are assessed in that context.
Ordinary enquiries are handled to respond to your request, using legitimate interests in managing correspondence, or steps you request before entering a contract where applicable. Limited security and audit processing serves the legitimate interests of preventing abuse, investigating incidents and showing who changed protected records. A specific legal obligation may require us to preserve information or respond to a lawful authority request; this is assessed case by case, rather than treated as permission to retain everything.
4. Required fields, voluntary choices and sensitive material
A name and contact address are needed to respond to an interest form. Workshop eligibility confirmation and required administrative details are needed to handle a place. Approved sign-in details are needed for private app access. You can browse the public pages without making those submissions. Optional answers, feedback and marketing choices are not conditions of access unless a particular required field is clearly explained.
Please do not submit health details, national identity numbers, bank or payment credentials, detailed debt files, passwords, other people’s private information or confidential business material. Forms are not designed to collect special-category personal data. Tell us about an accessibility adjustment without disclosing a diagnosis. If sensitive material is received unintentionally, contact us so that its use can be restricted and unnecessary material removed.
5. Privacy inside the participant app
Other participants cannot browse your notes or your registration answers. The standard administration screen does not show the contents of private idea notes. This is access-controlled storage, not end-to-end encryption or a promise that no authorised technical operator could ever access a record. Necessary technical access can occur for security, maintenance or handling a lawful data request.
Saving a note or form does not automatically publish it, transfer rights in it, subscribe you to PROTO Weekly or send it to an external AI model through our application code. If you choose to copy it into ChatGPT or another AI tool, that separate use is governed by the service you select. Private app content is requested over the network; the app does not intentionally store participant records in localStorage, IndexedDB or an offline service-worker cache. Information visible on a device can still be copied or captured by the device or its user.
7. Who receives information
The authorised PROTO operator handles submitted information. The website uses ChatGPT Sites / OpenAI for the Site platform and sign-in, with Cloudflare infrastructure for delivery, database and file storage. They process information needed for those functions and may process account, network and security information under their own applicable terms. Email correspondence uses the sender’s and recipient’s mail providers. We do not sell participant records or provide a mailing list to unrelated advertisers.
There is no public participant directory. Identifiable feedback or work is not published as a testimonial without a separate permission or arrangement. If you join a video meeting or share information during a workshop, your chosen display name, voice, camera and contributions may be visible to the organiser and other attendees; the selected meeting provider handles that session under its own rules. The website does not itself start a recording.
A lawful request, a security incident or the establishment or defence of a legal claim may require limited disclosure to an adviser or competent authority. Provider policies are available from OpenAI and Cloudflare. Those notices do not replace our responsibility for the purposes described here.
8. Processing locations and international transfers
Do not assume that the service is hosted or processed exclusively in the EU/EEA. OpenAI, Cloudflare and a service you choose to open can operate internationally, including in the United States. The applicable provider arrangements describe the transfer mechanisms they use, such as a relevant adequacy decision or standard contractual clauses where applicable. No EU-only processing location is promised for this service.
Contact hello@madebyproto.eu for information about the recipients and safeguards relevant to your data, or how to obtain available contractual information. A new processor or a materially different use requires a corresponding review and updated information; merely adding a disclaimer is not a substitute for the required processing and transfer arrangements.
9. How long information is kept
Public editorial material is kept as part of the Journal’s archive while its publication continues to serve an editorial purpose. A correction, justified privacy request, rights issue or editorial withdrawal can require amendment or removal. Archival publication is assessed against relevant privacy and freedom-of-expression rights rather than treated as an indefinite right to publish any personal detail.
General enquiries and PROTO+ interest submissions are kept while needed to respond, follow up on the specific initiative requested or resolve the resulting correspondence. Once the enquiry or planning purpose has ended, and there is no renewed request or necessary legal reason to retain it, the record is to be removed. Archiving an interest record does not delete it; this category currently requires manual review and deletion, rather than a fixed automatic expiry.
Workshop registrations have a set expiry: 180 days from registration while no workshop date is set, or 90 days after the scheduled workshop when a date is set. Expired records are excluded from active access and are removed, with related feedback and communication history, the next time workshop data is handled. There is no promise that a background job runs at the exact expiry time.
Participant identity and saved notes are kept while the requested account remains in place. A suspended account still has records. You can delete individual notes; the operator can permanently delete an account and its associated notes on request. Closing app access does not automatically delete a separate workshop registration, interest form or email thread: identify the records you want removed, or ask us to check them all.
For PROTO Weekly, unconfirmed requests expire after seven days, confirmation links after 48 hours, and unsubscribed records after 90 days; confirmed subscriptions are kept while active. Website cleanup runs when newsletter functions are used. A deletion request removes the subscription record and related individual delivery history from the application database.
Form tokens are valid for a short time and old records are cleared on subsequent form use; abuse counters use hashed identifiers and time windows. Our form databases do not store raw IP addresses for these counters. Limited administrative audit records currently have no automatic expiry and require manual review against incident, accountability and legal-claim needs. A deleted participant’s name and note contents are not copied into the audit log. Hosting, authentication, email and backup records follow the applicable provider retention arrangements; application deletion does not promise immediate erasure from every provider backup or mandatory security record. Request the relevant details from us.
11. Security and automated processing
The app uses approved account access, checks ownership before returning private records, restricts administration, protects form submissions and marks private responses not to be cached. These measures reduce risk; they do not make a system immune to incidents. Protect your device and account and tell hello@madebyproto.eu promptly about suspected unauthorised access. Any personal data breach will be assessed and handled under applicable notification duties.
The site does not use submitted personal data for a solely automated decision producing legal or similarly significant effects, a credit decision or behavioural advertising profile. Automated sign-in checks, capacity controls and anti-abuse limits help operate the service. If a technical check blocks a legitimate request, contact us for a human review.
12. Your rights and how to use them
Depending on the circumstances, you can request access, a copy, correction, erasure, restriction or portability of your personal data. You can withdraw consent and object to processing based on legitimate interests on grounds relating to your situation. You can object to direct marketing at any time. Some rights have legal conditions and exceptions; we will explain a refusal or any information that must be retained.
Send your request to hello@madebyproto.eu. We may ask for proportionate information to verify your identity, but do not send identity documents unless we explain why they are needed. We respond without undue delay and within one month; if the law permits an extension for a complex request, we will explain it within that first month. Exercising a right does not require you to buy anything or first accept these terms.
You may complain to a competent data protection authority, including the authority where you live or work or where you believe an infringement occurred. The European Data Protection Board’s authority directory lists national contacts. Contacting PROTO first is optional and does not limit your right to complain.
13. Adults and changes to this notice
PROTO+ is intended for adults and its current workshops are aimed at ages 60 and over. The site does not intentionally solicit children’s records. Contact us if a child’s personal information has been submitted so it can be assessed and, where appropriate, removed.
We will update this notice when the described handling changes and identify the new date. A material new purpose or optional feature will be explained at the relevant step, with a fresh choice where required. A later policy update does not automatically expand a previous consent. Further workshop details are available in Workshop 001’s privacy information; it supplements this notice for that activity.
Questions about this information or your rights?
hello@madebyproto.eu →