Privacy

Last updated 25 October 2026

The Delegation Lab at lab.vaom.ai is run by Verkflöde AB (reg. 559538-5708), Sweden, which is responsible for the processing described here. Questions: hello@verkflode.com.

The short version

• No cookies, no accounts, no sign-up.
• The game runs in your browser. What you choose in it stays there; the files you export are made there too.
• We count visits anonymously with our own analytics, on our own server. No IP addresses are stored.
• The AI model that writes VAOM's briefings is sent nothing about you or your game.
• The Lab and its analytics run on a server in France.

Visit statistics

We use Umami, an open-source analytics tool that we run ourselves on the Lab's server; no analytics company receives your data. For each visit it records the page, the referring site, browser, operating system, device type, screen size, language and approximate location (the country, sometimes a region or city), and how far the game got: started, each round reached and finished, completed, and which export files were saved, with the scenario played. Each stage of the game is recorded as a page of its own (such as /play/round-2) when it is reached, which shows how long a visit lasted. It uses no cookies. To tell one visit's steps apart it derives an anonymous ID from your IP address and browser together with a secret that changes every month; the IP address itself is not stored, and the ID can't be turned back into it.

We use these statistics to see whether the Lab works and where players stop, which is our legitimate interest under Article 6(1)(f) GDPR. They are deleted automatically after 12 months. Encrypted backups of them, on our own equipment, are kept for two weeks.

Browsers that send a Do Not Track signal aren't counted. You can also switch counting off for this browser here; that is the only thing the Lab ever stores in your browser, and only if you ask:

The AI model

VAOM's round briefings are written by a model from Mistral AI (France), which our server calls through Mistral's EU endpoint, where Mistral processes requests in data centres in the EU and EFTA countries. Each request contains only the fixed text for that round: nothing you chose or typed, and nothing that identifies you. Mistral sees our server, not your browser. If the model doesn't answer in time, you get the Lab's own scripted text; the debriefs and your final profile are always scripted from your game, in your browser.

Where the Lab runs

The Lab's server is at OVHcloud in Gravelines, France. Cloudflare sits in front of it to provide the encrypted connection and protect it against attacks, so Cloudflare handles your IP address and requests on the way, at the data centre nearest you, which may be outside the EU (see Cloudflare's privacy policy). Our server keeps no access logs. To stop abuse of the AI model, it remembers how often an IP address asked for a briefing, in memory only and for at most an hour. Fonts and everything else the page needs come from our own server: your browser contacts no other company to show the Lab.

Your rights

You have the right to access, correct and erase personal data about you, and to object to its use. The statistics aren't linked to a name or an address we could look up, so we usually can't find “your” records, but write to us and we will help as far as we can. You can also complain to the Swedish Authority for Privacy Protection (IMY).

This page covers the Lab. The VAOM framework at vaom.ai and verkflode.com have their own.