Legal

Privacy Policy

This policy explains what personal data the SIDOX® website and client platform process, why, where it is stored and how you can exercise your rights. It is written to be read, not to obscure.

Last updated 22 October 2026

1. Who is responsible

SIDOX® (“we”, “us”) is an independent digital studio operating this website and client platform. For privacy requests, contact [email protected]. Formal company and contracting-entity details are provided in the applicable written agreement or on request.

2. Data we process

Account data: name, email address, password hash, email-verification status, profile details you choose to add (company, phone, country, website, biography, avatar URL) and account status.
Authentication and security data: hashed session tokens, session expiry, hashed IP addresses, browser user-agent, audit events and rate-limit counters. Raw passwords are never stored.
Inquiry and booking data: name, email, company, website, service interest, budget range, message, requested call time, timezone and notes.
Project and communication data: project records, milestones, updates, requirement forms, messages, unread markers, notifications and documents you or an administrator upload.
Payment-verification data: invoices, amounts, transaction references, payment dates, uploaded PDF proofs and the administrator’s review decision. Uploading a proof does not itself confirm a payment.
Email delivery records: recipient, subject, template name, delivery status, provider identifier and error details, so transactional email can be audited.
Optional analytics: if you explicitly allow it, a privacy-friendly, cookieless analytics script records anonymous page views. Declining analytics does not limit the site.

3. Why we process it

To create and secure your account and provide the client dashboard.
To respond to inquiries, arrange calls and prepare proposals.
To deliver and administer projects, documents, messages and payment verification.
To protect the service against abuse, fraud and unauthorized access.
To meet legal, accounting or contractual obligations where applicable.
To improve the site where you have allowed optional analytics.

Depending on the context, processing is based on performance of a contract or steps prior to a contract, our legitimate interest in operating a secure service, your consent (for optional analytics), or a legal obligation. You may withdraw consent for analytics at any time.

4. What is not done

We do not sell personal data.
We do not use client project data for advertising or public case studies without approval.
We do not send marketing email through the transactional email system.
We do not use invasive advertising or cross-site tracking cookies.

5. Cookies and local storage

Essential cookies keep you signed in and protect authentication flows. Optional analytics is loaded only after you allow it. The consent choice itself is stored in your browser’s local storage. Details and durations are in the Cookie Policy.

6. Service providers

Depending on the deployment, data may be processed by:

Hosting and infrastructure: Vercel (application hosting) and a PostgreSQL provider such as Supabase (database and, where configured, private file storage).
Email delivery: Resend, when configured, for transactional messages only.
Payments: Whop is an intended payment boundary. It is only active where credentials and a webhook secret have been configured; this deployment does not claim an active Whop integration unless those values exist.
Analytics: Plausible, only if a domain is configured and you allow analytics.

Providers act under their own terms and data-processing agreements. Where data is transferred internationally, appropriate safeguards are expected to be used by those providers.

7. Retention

Account and project data is retained for as long as the account or engagement requires it, then for a reasonable period to meet legal, accounting and dispute-resolution needs. Security and audit logs are kept for a limited operational period. Rate-limit counters are short-lived. Email delivery records are retained for operational auditing. When data is no longer needed, it is deleted or anonymized.

8. Security

Passwords are hashed with a memory-hard algorithm. Sessions are database-backed and stored in an httpOnly cookie; only a hash of the session token is stored. Authorization and ownership checks run on the server. Private documents are stored outside the public web root and served only after an authenticated access check. Security headers and rate limits are applied. No system is perfectly secure, and no absolute guarantee is claimed.

9. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing. You may also withdraw analytics consent. Send requests to [email protected]. Identity may need to be verified before a request is actioned. You may also complain to your local data-protection authority.

10. Children

The service is intended for businesses and professional users. It is not directed at children, and accounts should not be created by anyone under the age required to enter a binding contract in their jurisdiction.

11. Changes

This policy may be updated to reflect changes in the service or the law. The “last updated” date above will change. Material changes affecting account holders will be communicated through the platform or by email where appropriate.

12. Contact

Privacy questions and requests: [email protected].

2. Data we process

Account data: name, email address, password hash, email-verification status, profile details you choose to add (company, phone, country, website, biography, avatar URL) and account status.

Authentication and security data: hashed session tokens, session expiry, hashed IP addresses, browser user-agent, audit events and rate-limit counters. Raw passwords are never stored.

Inquiry and booking data: name, email, company, website, service interest, budget range, message, requested call time, timezone and notes.

Project and communication data: project records, milestones, updates, requirement forms, messages, unread markers, notifications and documents you or an administrator upload.

Payment-verification data: invoices, amounts, transaction references, payment dates, uploaded PDF proofs and the administrator’s review decision. Uploading a proof does not itself confirm a payment.

Email delivery records: recipient, subject, template name, delivery status, provider identifier and error details, so transactional email can be audited.

Optional analytics: if you explicitly allow it, a privacy-friendly, cookieless analytics script records anonymous page views. Declining analytics does not limit the site.

3. Why we process it

To create and secure your account and provide the client dashboard.

To respond to inquiries, arrange calls and prepare proposals.

To deliver and administer projects, documents, messages and payment verification.

To protect the service against abuse, fraud and unauthorized access.

To meet legal, accounting or contractual obligations where applicable.

To improve the site where you have allowed optional analytics.

6. Service providers

Depending on the deployment, data may be processed by:

Hosting and infrastructure: Vercel (application hosting) and a PostgreSQL provider such as Supabase (database and, where configured, private file storage).

Email delivery: Resend, when configured, for transactional messages only.

Payments: Whop is an intended payment boundary. It is only active where credentials and a webhook secret have been configured; this deployment does not claim an active Whop integration unless those values exist.

Analytics: Plausible, only if a domain is configured and you allow analytics.

Providers act under their own terms and data-processing agreements. Where data is transferred internationally, appropriate safeguards are expected to be used by those providers.

7. Retention

8. Security

9. Your rights