Privacy Policy

SafeBlockLab is a full-stack engineering studio registered in Estonia. This policy covers the personal data we handle through this website and through our work with clients.

For the data described here, SafeBlockLab is the controller: we decide why it is collected and what happens to it. Where we build or operate software on a client's behalf, that client is usually the controller and we act as their processor under the contract between us. This policy does not govern that data; the client's own policy does.

You can reach us about anything in this policy at contact@safeblocklab.com.

We collect very little, and almost all of it is information you type into a form and send us on purpose.

When you submit the contact form, we receive:

• Your name and email address, which are required, because a reply has to be addressed to someone and reach them.
• The industry your project is in, picked from a list.
• Your message.
• Your company, if you choose to give one. The field is optional.
• Any files you attach — up to three. They arrive in our inbox with your message, as email attachments.

When you email us directly, we receive whatever the email contains, including your address and anything you attach.

When you use the assistant on this site, we receive the messages you send it. What happens to them after that is covered in the section on the assistant below.

When you ask for a cost estimate, we receive your answers to the estimate's questions and anything you type into its text boxes. The section on the cost estimate below says where they go.

Our hosting and email providers keep technical records — server logs, IP addresses, mail delivery records — as an ordinary part of delivering the service. We do not build profiles from them and we do not use them for marketing.

We do not knowingly collect personal data from children. This site is aimed at people commissioning software, not at children, and we do not ask for age.

We use what you send us for the reason you sent it, and for the ordinary business that follows from it:

• To answer your enquiry, scope the work and prepare a proposal.
• To deliver, support and invoice work you have commissioned.
• To keep our own records — contracts, invoices, correspondence — for as long as the law requires us to keep them.
• To keep this site and our systems secure, and to investigate misuse.

We do not sell personal data. We do not share it with advertising networks or data brokers, and we do not use it to train models.

We will not add you to a mailing list because you used the contact form. If we ever run one, it will be something you opt into separately and can leave in one click.

Under the EU General Data Protection Regulation (GDPR), we rely on the following bases:

• Performance of a contract, or steps taken at your request before entering one — answering an enquiry, quoting for work, and then doing it.
• Our legitimate interests in running and securing the studio — keeping records, preventing abuse of the contact form, and defending legal claims. We rely on this only where your interests and rights do not override it.
• Legal obligation, for the tax and accounting records we are required to keep.
• Consent, where we ask for it. Where consent is the basis, you can withdraw it at any time, and doing so does not affect anything done before you withdrew it.

The NEXT_LOCALE cookie remembers your selected language. When assistant bot verification is configured and succeeds, the assistant also sets an assistant_pass cookie. That signed cookie lets the server verify recent challenge completion for up to 30 minutes. It is restricted to the chat API, cannot be read by page JavaScript, and is marked Secure in production.

The assistant saves the current conversation in this browser's localStorage under safeblock.assistant.thread so it can be restored after a reload. This storage has no automatic time expiry. Starting a new chat or clearing this site's browser data removes the saved conversation; closing the panel does not.

The estimate page keeps your answers and your latest estimate in this browser tab's sessionStorage, under safeblock.estimate.session and safeblock.estimate.last, so they survive a reload or a visit to the contact page. They are removed when you close the tab.

Google Analytics is planned but is not currently enabled on this website. Before enabling analytics, we will publish its purposes, retention and available choices, and obtain consent where required.

When Turnstile bot protection is enabled, the contact form and assistant load Cloudflare's challenge script. The server sends the resulting verification token and, when available, the visitor's IP address to Cloudflare to validate the challenge and limit automated abuse.

You can contact contact@safeblocklab.com for information about the infrastructure providers involved in handling a particular request and their applicable processing and retention arrangements.

This site has a chat assistant that answers questions about SafeBlockLab from the site's own pages and the studio's published answers. It can show general cost and time ranges from our own guide and points you to the estimate page for an indicative estimate of your project.

When a message needs AI processing, TypeSafe AI's Jev model decides what kind of message it is and which part of the site answers it. It receives your latest message, your previous one, the end of the assistant's last reply, the page you are on and the previous topic. Fireworks AI runs the open model that writes replies; it receives the selected site content and up to the last six messages of the conversation. If you ask for a person, Fireworks receives up to your last eight messages to draft a note to the team. Some replies use fixed text without a model call. What each provider keeps is as described in the section on the cost estimate.

We keep no copy of the conversation on our servers: it is saved in your browser, as described in the section on cookies and storage. Our logs record only the kind of message, which part of the site answered it, how much of the models it used and how long it took, never what you wrote. If you ask for a person, the assistant drafts a note to us that is sent only when you check it and click send, and it then reaches us like a message from the contact form.

Either way, treat the assistant as you would an email to a stranger: it is a good place to describe a problem and a bad place to put passwords, credentials, personal data about other people, or anything covered by an NDA you have with someone else.

The estimate page works out an indicative cost range from your answers. Your company name and industry stay with us. Your other answers, and anything you type into the estimate's text boxes, are sent to two AI providers:

• TypeSafe, whose Jev model picks the row of our own price guide that fits your project. TypeSafe hosts its services in the United States. Its privacy policy says it does not train or fine-tune models on what it receives, does not disclose it to third parties other than its own service providers, and keeps personal data for as long as reasonably necessary to provide its services.
• Fireworks AI, which runs the open model that writes the short summary shown with your estimate. Fireworks does not log or store the text it receives or writes for open models; it records only technical details such as the size of the request.

The price itself comes from our own guide, not from either provider. We save your answers and the result under a reference such as EST-7K2M9P, so that you can bring the estimate to the contact form, and we delete it twelve months after it was made.

Describe the project in the text boxes, not people: please leave out personal data about others, credentials and anything confidential.

We share personal data only where it is needed to do the thing you asked for, or where the law requires it:

• Service providers who run parts of our infrastructure — hosting, email delivery, source control, accounting — and the two AI providers named in the section on the cost estimate. They process data on our instructions and are bound by contract.
• Professional advisers, such as accountants and lawyers, where they need it to advise us.
• Authorities, where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims.
• A buyer, if the studio or part of it is ever sold, in which case this policy continues to apply to the data transferred until the buyer publishes their own.

We do not share client project data between clients. Work done for one client is not shown to, discussed with, or reused for another without written permission.

Some of the providers we rely on operate outside the European Economic Area. Where personal data is transferred to a country without an adequacy decision, we rely on the appropriate safeguards the law provides — in practice, the European Commission's standard contractual clauses — together with the provider's own technical and organisational measures.

You can ask us which providers are involved in a particular piece of work and where they operate. We will tell you.

We keep personal data for as long as it is doing the job it was collected for, and then we delete it:

• Enquiries that do not become work: kept while we are in conversation, and deleted within twelve months of the last message.
• Client correspondence and project records: kept for the life of the engagement and then as long as we may need them to answer a question about the work or defend a claim.
• Contracts, invoices and accounting records: kept for the period tax law requires, which is longer than we would otherwise choose.
• Server and mail logs: kept for the short operational window our providers retain them for, and not copied out of it.
• Saved estimates: deleted twelve months after they were made.
• The assistant verification cookie: valid for up to 30 minutes. The conversation saved on your device has no automatic expiry and can be removed by starting a new chat or clearing this site's browser data.

Depending on where you live, you have some or all of the following rights over your personal data:

• To ask what we hold and get a copy of it.
• To have inaccurate data corrected.
• To have data deleted, where we have no continuing reason to keep it.
• To ask us to restrict how we use it while a question about it is resolved.
• To object to processing we carry out on the basis of legitimate interests.
• To receive data you gave us in a portable format, and to have it sent elsewhere where that is technically feasible.
• To withdraw consent, where consent is what we relied on.

Write to contact@safeblocklab.com and we will answer within one month. We do not charge for this. If we need to confirm who you are before handing over a copy of someone's data, we will ask, and we will ask for the least that will settle it.

If you think we have got something wrong, tell us first — we would rather fix it than read about it. You also have the right to complain to your data protection authority, and complaining to us does not take that away.

The website uses request validation and abuse controls to limit misuse. These controls reduce risk but do not guarantee that every threat can be prevented.

No system is perfectly secure. If you believe you have found a vulnerability in this site or in something we built, write to contact@safeblocklab.com and we will take it seriously and come back to you.

We will update this policy when what we do changes — a new provider, a connected model, analytics, anything that alters the description above. The effective date at the top of the page is the date of the version you are reading.

Where a change materially affects how we handle data we already hold, we will tell affected clients directly rather than relying on you to re-read this page.

Questions, requests and complaints about this policy go to contact@safeblocklab.com.