// privacy
Privacy policy
This page explains what personal data chibulabs.com collects, why, who processes it, how long it is kept, and the rights you have.
Who is responsible
chibulabs.com is run by me, Chibuikendum Abraham-Onyeacho, and I am the data controller for this site. The quickest way to reach me about privacy is the contact form.
Summary
- The only personal data you give me directly is what you send through the contact form. Like any website, each visit also passes technical data, such as your IP address, through the hosting provider (Cloudflare).
- Messages are stored in a database hosted by Cloudflare (Western Europe) and emailed to me through Resend (EU region).
- I do not sell personal data, show adverts or use tracking cookies. The site’s own code sets no cookies.
- Visitor statistics come from Cloudflare Web Analytics, which does not use cookies.
What I collect and why
1. Contact form
When you send a message, I collect:
- Your name, email address and message — so I can read and reply to your message.
- The date and time the message was sent.
- A hashed version of your IP address — a keyed, one-way hash, not the IP address itself. It is used only to limit how many messages one connection can send, to stop spam and abuse.
- Your browser’s user agent (the browser and operating system name your browser reports) — to help spot automated abuse.
- Delivery status — whether the email notification to me was sent successfully.
Lawful basis: my legitimate interests in answering messages you choose to send and in protecting the form from spam and abuse.
2. Spam protection (Cloudflare Turnstile)
The contact form uses Cloudflare Turnstile to check that a person, not a bot, is sending the message. Turnstile runs a short check in your browser inside a frame served by Cloudflare. When you send the form, the site passes the check and your IP address to Cloudflare to confirm the result. Cloudflare describes how Turnstile handles data in its Turnstile Privacy Addendum.
Lawful basis: legitimate interests (keeping the form secure).
3. Hosting and security (Cloudflare)
The website is hosted and delivered by Cloudflare. Every visit passes through Cloudflare’s network, which processes technical data such as your IP address, browser details and the pages requested in order to deliver the site and protect it from attacks.
Cookies: the site’s own code does not set any cookies. Cloudflare’s bot protection may set a strictly necessary security cookie called __cf_bm, which expires after 30 minutes of inactivity. Cloudflare explains its cookies in Cloudflare Cookies.
Lawful basis: legitimate interests (running a secure, working website).
4. Visitor statistics (Cloudflare Web Analytics)
I use Cloudflare Web Analytics to see aggregate visitor numbers and page performance. According to Cloudflare, it does not use cookies or local storage and does not fingerprint individual visitors.
Lawful basis: legitimate interests (understanding how the site is used and keeping it fast).
Who processes your data
- Cloudflare, Inc. — hosting, content delivery, security, the contact-form database (primary location Western Europe), Turnstile and Web Analytics. Cloudflare privacy policy.
- Resend — sends the email notification for each contact-form message, using its EU (Ireland) sending region. Resend privacy policy.
- Apple (iCloud Mail) — hosts the inbox that receives contact-form emails. Apple privacy policy.
I do not share your data with anyone else, except where the law requires it.
International transfers
Contact-form messages are stored in Western Europe and emailed from the EU. Cloudflare’s network runs in many countries, so technical data about your visit may be processed outside Nigeria, and the providers above may access data from other countries, including the United States.
Cloudflare and Resend handle this data under their data processing agreements, which include safeguards for international transfers. Apple handles email under its own terms and privacy policy.
How long I keep it
- Contact-form messages (including the hashed IP address and user agent): 12 months, then deleted.
- Emails in my inbox about your message: 12 months, then deleted.
- Cloudflare and Resend logs are kept according to their own policies.
Your rights
Under the Nigeria Data Protection Act 2023 you have the right to:
- be told how your personal data is used (this page);
- access a copy of the personal data I hold about you;
- have inaccurate data corrected;
- have your data deleted;
- object to processing based on my legitimate interests, and ask me to restrict processing;
- receive your data in a portable format, where this applies;
- withdraw consent at any time, where I rely on consent.
How to make a request: send it through the contact form, using the email address the request is about and saying which right you want to use. I may ask you to confirm your identity. I will reply within 30 days.
Complaints
If you are unhappy with how I handle your data, please contact me first so I can try to put it right. You can also complain to the Nigeria Data Protection Commission (NDPC), which has a form for reporting privacy violations, or through its website: ndpc.gov.ng.
Security
The site is served only over HTTPS, uses a Content Security Policy, and keeps API keys and other secrets in Cloudflare’s encrypted secrets storage rather than in the website code. Only I can log in to view the stored messages; Cloudflare and Resend handle them only as described above.
Changes to this policy
If this policy changes, I will update this page and the “Last updated” date above.