Privacy Policy

Sableboxx (“we”, “us”) is a design and digital studio operating from Abuja, Nigeria, and working with clients worldwide. We are the data controller for the information described in this policy.

For anything in this policy, including requests about your own data, write to hello@sableboxx.com or call +234 810 869 9059.

We only collect information you give us or that our hosting infrastructure records automatically in the course of serving the site.

When you submit the enquiry form at /contact we receive your name, email address, company name, website (if you give one), the service you selected, the budget range you selected and the message you wrote. All of it is optional except your name, your email address and your message — the form cannot be submitted without those.

When you email or call us we hold the contents of that correspondence and your contact details.

Automatically, our host records standard server logs: IP address, user agent, the page requested and the time of the request. We use these for security and to keep the site running. We do not build advertising profiles and we do not sell data.

• To reply to your enquiry and scope work. Our lawful basis is your request — taking steps at your request before entering a contract.
• To deliver a project you have engaged us for. Our lawful basis is performance of that contract.
• To keep the site secure and available, and to keep accounting records we are required to keep. Our lawful basis is our legitimate interest and, for records, legal obligation.

We do not send marketing email to people who have only submitted an enquiry. If we ever run a mailing list it will be opt-in and separately consented to.

The public Sableboxx website sets no advertising or analytics cookies, and runs no third-party tracking scripts. You will not see a cookie banner here because there is nothing to consent to.

The studio dashboard at /admin — which only Sableboxx staff can reach — stores a sign-in token in the browser so that a signed-in session survives a page reload. It is strictly necessary for that tool to function and is never set for public visitors.

We keep the list of third parties deliberately short. Each is a processor acting on our instructions, not an independent recipient of your data.

• Netlify — hosts and serves this website, and records the server logs described above.
• Render — runs the application that receives enquiry form submissions.
• MongoDB Atlas — stores enquiries, client records and site content.
• Our email provider — delivers the notification we receive when you submit the form, and our replies to you.
• Fontshare and Unsplash — serve the typeface and some imagery. Requesting a file from them discloses your IP address to them, as it would for any file on any website.

Some of these providers operate servers outside Nigeria and outside the EEA. Where they do, transfers rely on the provider’s standard contractual clauses and equivalent safeguards.

• Enquiries that do not become projects — kept for 24 months, then deleted, so we can recognise you if you come back.
• Client records and project correspondence — kept for the life of the engagement and for 7 years afterwards, which is how long we must keep the associated financial records.
• Server logs — retained by our host on their own rolling schedule, typically 30 days.

Under the Nigeria Data Protection Act 2023 — and under the UK/EU GDPR where it applies to you — you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything inaccurate.
• Delete it, where we have no continuing obligation to keep it.
• Restrict or object to how we use it.
• Send it to you, or to someone else, in a portable format.

Email hello@sableboxx.com and we will respond within 30 days. There is no charge. If you are unsatisfied with our response you may complain to the Nigeria Data Protection Commission, or to the supervisory authority where you live.

Data is transmitted over HTTPS, stored in an access-controlled database, and the studio dashboard requires a password that is stored only as a salted hash. Access is limited to the Sableboxx people who need it. No system is perfect; if a breach ever affects your data we will notify you and the relevant regulator as the law requires.

If we change this policy we will update the date at the top of this page. Material changes affecting people whose data we already hold will be communicated directly by email.