Privacy Policy
1. Data controller
JetBox Digital, a sole trader business of Yevhenii Otstavnov, established in Co. Laois, Ireland, operates the website jetbox.ai and is the data controller for the personal data described here.
Contact for any privacy matter: [email protected], +353 85 114 0712. This policy was last updated on 7 October 2026.
2. What we collect
Data you send us. When you use the contact form, your own email client sends us the name, email address, phone or messenger handle, project type and message you typed. The contact form does not store anything on this website — it opens your mail application and the message reaches us by email.
Orders. When you order through our order form, we store what you enter — your name, email address and phone number (if you give one); for a business, its name and country; the project brief with any links you give us; and your choices — on our server, together with the order's history: messages, payments, refunds and the documents we issue. When you send the order, accept or cancel the contract, start a payment or answer a refund proposal, we record the time, your IP address and, at most of these steps, your browser, as evidence of what was agreed. Your order page opens only with one-time codes sent to your email address, and we keep a record of each code request, sign-in attempt and sign-out (time, IP address and browser) to protect it.
Care plans. A care plan ordered through our care-plan form is kept the same way, together with your website's address, the plan you chose and, from Stripe, the reference of your subscription and of each of its payments.
Data you send by other channels. If you write to us by email, phone or WhatsApp, we receive whatever you choose to share, including your contact details and the content of your message.
Server logs. Our web server records the IP address, user agent, requested URL, referrer, response code and timestamp of each request. These logs are technical and are not used to profile you.
Local storage. Your cookie choice is stored in your browser's local storage under the key jb_consent, and, if you use the light/dark switch, your choice of theme under jb_theme. On your order page, a message or payment comment you are typing is kept there too, so it survives an expired session; it is removed once sent, when you sign out, or once it is a day old. None of this leaves your device, and we cannot read it remotely.
3. Why we use it and on what legal basis
To answer your enquiry or your order request — Article 6(1)(b) GDPR, steps taken at your request before entering a contract.
To deliver a project or a care plan you ordered, including the emails it needs — confirmations, invoices, a failed payment, and a notice before a first payment or an annual renewal — Article 6(1)(b) GDPR, performance of the contract.
To keep a record of what was agreed and to protect your order page (the order records and sign-in records described above) — Article 6(1)(f) GDPR, our legitimate interest in being able to show what was agreed and in keeping your order secure.
To keep the website secure and working (server logs, abuse prevention) — Article 6(1)(f) GDPR, our legitimate interest in a secure service.
To meet Irish tax and accounting duties — Article 6(1)(c) GDPR, legal obligation.
Analytics or marketing measurement, if you switch them on in the cookie banner — Article 6(1)(a) GDPR, your consent, which you can withdraw at any time.
4. We do not sell your data
We never sell, rent or trade personal data. We do not use your data for automated decision-making or profiling.
5. Who else may process it
Hosting. The site runs on a dedicated server operated for us in the European Union (Hetzner Online GmbH, Germany).
Email. Our email, including order emails and access codes, is sent and received through Resend, our email delivery provider; emails you send us, and the alerts our order system sends us about your order, including the messages you write on your order page, are then delivered to our Gmail mailboxes.
Payments. Card payments, including Apple Pay and Google Pay, are taken by Stripe Payments Europe, Limited (Ireland), under its own terms and privacy policy. We give Stripe your email address, the order number and what the payment is for; we never see your full card details. For a care plan, Stripe keeps your card to take each payment of the plan until it ends.
Network. All pages, including the order form and order pages, are delivered through Cloudflare, which carries everything sent to and from our pages, including your IP address, for us.
Live case previews. Case pages embed the client websites through our own server. Your browser also loads assets directly from those sites, which means their own privacy policies apply to that traffic.
Each of these acts as a processor or independent controller under a written agreement or their own terms; none receives your data for their own marketing.
Your own website. When we host and look after your website on a care plan, we process the personal data it holds — your customers' details, say — on your behalf, as your processor, under the data processing schedule of the care plan contract. This policy covers our own processing; your site's privacy policy covers that data.
6. International transfers
Our hosting stays inside the EU. Where a provider (for example Google, Cloudflare, Resend or Stripe) processes data outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision.
7. How long we keep it
Enquiries that do not become projects: up to 24 months, then deleted.
Project correspondence and invoices: 6 years, as required by Irish tax law.
Orders that became a contract, with their messages, records and documents: 6 years after the order ends (completed and paid, cancelled or refunded, or, for a care plan, after the plan ends), as Irish tax law requires for accounts, and because contract claims can be brought for six years. Order requests that never became a contract, including a care plan whose payment page was not completed: 24 months after the last activity, then deleted. Order page sign-in records: 12 months.
Copies and backups of a website we looked after on a care plan: deleted 30 days after the plan ends.
Server logs: rotated and deleted within 30 days.
Your cookie choice: until you change it or clear it in your browser, or until we add a tool that needs a new choice.
8. Your rights
Under the GDPR you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time without affecting prior processing.
Write to [email protected] and we will reply within one month. There is no charge for a reasonable request.
If you are not satisfied, you may lodge a complaint with the Irish Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 — www.dataprotection.ie.
9. Security
The site is served over HTTPS only. Access to the server and to our mailboxes is protected by key-based authentication and two-factor authentication. We keep the number of people with access to the minimum.
10. Children
This site is not directed at children. We do not knowingly collect data from anyone under 16.
11. Changes
If we change this policy we update the date in section 1.