Privacy notice
Last updated: 9 September 2026
Who is responsible
The self-employed provider operating SboxLock in Portugal is responsible for the personal data used to manage enquiries and commissions. The provider’s legal identity is supplied in the personalised agreement before a commission is accepted. For privacy requests, email contact@sboxlock.com or use the contact form.
Advertising and technical processing
We do not run advertising, audience analytics or marketing profiles, and we do not sell personal data. The site’s own code does not set cookies or use browser storage. Hosting and security services still process technical data; absence of advertising does not mean absence of data processing.
The contact form uses Cloudflare Turnstile to reduce spam. It processes network and browser signals, including IP addresses and browser characteristics. See Cloudflare’s Turnstile privacy policy. We do not describe this security processing as anonymous or claim that it collects no technical signals.
What we process
- Enquiries: your name, email, optional organisation or website, topic, message and acknowledgement that an enquiry is not an order.
- Submission and security records: enquiry reference, server receipt timestamp, connection IP address and Turnstile verification information. These are included in the enquiry email; hosting services may also keep access and security logs. The enquiry is not a software upload or agreement acceptance. Its timestamp and IP are not acceptance records. For email acceptance we keep the original reply, receipt time, headers, attached agreement and our confirmation; an email does not reliably disclose the customer device IP.
- Commissions: contact and billing details, ownership checks, accepted agreements and acceptance emails, permissions, payment records, project communications, reports and delivery evidence.
- Software files: the files and related materials you provide through an agreed channel. Do not send production credentials, unnecessary personal data or confidential files in an initial enquiry.
Purposes and legal bases
We use information to answer enquiries and take steps requested before a contract, perform agreed work, meet invoicing and other legal obligations, and protect the service and handle claims. Depending on the context, the bases are pre-contractual steps or contract performance, legal obligations, and legitimate interests in business communication, security and establishing or defending claims. Business-contact data may be handled on legitimate interests where the contact is not personally a party to the contract. We do not use enquiry data for marketing.
The acknowledgement on the form is not consent to marketing, permission to analyse files or a waiver of rights. Without the required contact information we cannot respond through the form.
Project confidentiality and local AI
We work on copies of the authorised binaries. Only people authorised for the project may access its materials for the agreed work, subject to confidentiality duties. We do not publish client or product names or case studies without written permission. An NDA can be agreed before files are shared.
We do not upload your binary or code to cloud AI services. AI processing of that material runs locally on our machines. This is separate from using hosting, email and the agreed file-transfer channel. Where we process personal data in your software on your behalf, any required data processing agreement must be in place first.
Recipients and payments
Hosting and network providers, Cloudflare Turnstile, email services and any agreed file-transfer service process relevant data to operate the service. Our contact handler uses Migadu for email delivery. Authorised project collaborators may receive the minimum project data needed. Tax authorities, advisers or competent authorities may receive information where necessary for legal obligations or claims.
Bank transfers involve banks and their payment systems. Cryptocurrency transactions are recorded on their respective public blockchains; wallet addresses, amounts and transaction identifiers can be visible to others and generally cannot be erased from the chain. An exchange or wallet service you choose may also process your data. We do not put your invoice, legal identity or agreement on a blockchain. Payment is not a process without third parties.
International transfers
Some service providers may process data outside the European Economic Area. Where required, we use an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. You may contact us for information about the safeguards relevant to your data. Provider locations and applicable safeguards must be assessed for the services actually used.
Retention and deletion
We retain enquiry and submission records while needed to respond, manage follow-up and address abuse or disputes, then delete them. Working binaries are retained only while needed for the agreed analysis and follow-up, and deleted when that purpose ends or on request. Asking for deletion during a job may prevent completion.
Invoices and other required records are retained for the applicable statutory periods. Signed agreements, authority evidence and necessary performance or delivery records may be retained while needed to establish, exercise or defend claims. These are not automatically erased when working binaries are deleted. Hosting and third-party security records follow the relevant service’s retention arrangements. Public blockchain entries are outside our ability to delete.
Your rights
Subject to the conditions in applicable law, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. We may need to verify your identity. Erasure is not absolute where records must be retained by law or for claims. You may complain to the Portuguese supervisory authority, CNPD. We do not make decisions producing legal or similarly significant effects about you solely through automated processing.
Changes
We update the date above when this notice changes. Material changes affecting an ongoing engagement will be communicated where required.