At SurfBoxStudio we believe privacy is a fundamental human right. That’s why we don’t store, share or sell your data. Our websites and mobile applications don’t use any tracking technologies and we only use cookies when absolutely necessary. If we don’t need to, we don’t.

Our Definition of “Personal Data”

We define personal data based on privacy laws and regulations of the EU, including the General Data Protection Regulation (GDPR). GDPR are widely regarded as the strongest privacy protections in the world. We consider any information that can identify you, your behaviour, and/or could be used to track you as personal data. For more details please see section: Your Rights under GDPR.

We don’t store, share or sell your data or have third party advertisements partners

We respect your privacy. By limiting data collection and never sharing or selling your data it is much less likely to be stolen, abused, sold or leaked. We believe this is the best way to protect your privacy.

Let’s be perfectly clear, sometimes we will have access to your “personal data”

When do we have access to your “personal data”? How long do we retain this data?

We will only have access to your "personal data" when it is provided to us via one of the following means:

If you request a development build invitation

Upon receiving a request for a development build invitation, the email address provided will be stored in our systems until access is provided, if access is not provided within three (3) calendar months, the email address will be removed from our systems. In order to provide access to the development build via an invitation, the provided email address will be added to a Cloudflare Access whitelist in order to allow said access to the development build. Please refer to Cloudflare's privacy policy for more details on their handling of the provided email address.

If you subscribe to our email newsletter

Upon receiving a request for our email newsletter, the email address provided will be stored in our systems until access is withdrawn, by either unsubscribing via the email newsletter, or contacting us via email and requesting the removal of the email address from our systems. Email newsletters are sent via Google's Gmail, please see Google's privacy policy for details on their policy.

If you reach out to us via email (support requests)

We use a Gmail account provided by Google in order to respond to your support requests. We will only retain your email address on Gmail (and the email you sent) until we have responded, or 30 days has passed, whichever is sooner, at which point both your email and email address will be deleted from the Gmail account. Please note, emails and email addresses, once deleted by ourselves, may stay on Google’s Gmail servers for up to 60 days. For more information please see section: How your “personal data” is protected.

What we will never do with your email address (and emails):

We will never share your email address or email(s). We will never sell your email address or the email(s). We will never add your email address to a mailing list or subscribe you to a newsletter if you did not specifically request this. We will never contact you out of the blue.

How your “personal data” is protected

How we protect your data

We use two-factor authorisation and strong password protection on the Gmail account we use to access your support enquiries. We limit access to the Gmail account to one member of staff, Paul Jenkins. We do not use any third-party email clients, such Microsoft Outlook or Apple Mail, which may store emails and email addresses locally on our systems. We access your support request by accessing Google Gmail directly, we do this to ensure email addresses or email(s) are never stored locally on our systems unintentionally.

How we protect your data

Google secures email data with high level encryption, please follow the below link for more details on how Google protect your privacy:

Where will your email support request be stored?

Your email support request will be stored on Google’s servers that are located worldwide. Please follow the following link to see all Google’s data centres.

Google’s headquarters are located at; 1600 Amphitheatre Parkway in Mountain View, California.

Cookies and Web hosting

What are Cookies, and when do we use them?

Cookies are small pieces of information that are stored on your device by websites and mobile applications. Cookies have a number of uses, from storing your login details in order to aid faster access to password protected areas, to cookies that have unique elements that can be used to track all kinds of your personal data. Our use of cookies are simply to allows to protected areas such as editor.surfboxstudio.com, the website editor/builder, we utilise third-party solutions; Google OAuth2 and Cloudflare Access to restrict access, these third-party providers store cookies on your device in order to allow access to these areas/subdomains. Surf Box Studio don’t store any cookies ourselves, but as mentioned our third-party providers do in order to provide the required solutions.The Cloudflare Access cookie lasts 4 weeks on the device before it expires. Google OAuth2 cookie expires after one(1) hour. At which point you will be logged out, logging back in will begin the cookie timeframe once again.

Third party Web Hosting provider

We use Cloudflare Pages for hosting our website. Cloudflare Pages do not inject cookies into the websites they host. Please be aware that Cloudflare may collect “personal data” from visitors to our website, including logs of visitor IP addresses, to comply with legal obligations, and to maintain the security and integrity of the Website and the Service. For more details please read Cloudflare’s Privacy Policy. Where do Cloudflare host websites? Cloudflare have data centres all over the world, please see the following link:

Cloudflare Headquarters are located at: San Francisco office (Headquarters) San Francisco 101 Townsend St. San Francisco, CA 94107.

What “non personal data” do we access?

For clarity, here are some examples of non personal data we may access when using our website: Operating system / Browser Our website is built on a single code base, therefore at times within the code we may need to check which operating system/ browser you are running the website on. We do this in order to facilitate system dependent features and fixes, such as Internet Explorer compatibility features. We never store, share or sell any of this data. Development Build Activity While using the latest development build (via requested invitation), we may record click activities within the website editor / builder. This is in order to understand any pain points the development build may have, and to create an easier to use user experience. This is only relevant to development builds.

Your Rights under GDPR

The General Data Protection Regulation gives you the following rights in regards to how your “personal data” is processed: You must be given reasons for why your “personal data” is processed. Including: What kind of “personal data” is processed. Who has access to it within the organisation, third-party access and where they are located. When and how your “personal data” is collected. How organisations are protecting your “personal data”. You have the right to see what “personal data” an organisation have about you and how it is being used. This data must be sent to you, or a third party you designate in a commonly readable format (e.g spreadsheet). You have the right to know how long an organisation plans to store your “personal data” and reason for why this information is kept for that length of time. You may request to correct or update any “personal data” an organisation hold about you. You have the right to ask for all your “personal data” to be deleted by an organisation that stores your “personal data”. Such a request must be honoured within a month. Please note, there are grounds in which an organisation could deny the request, such as the exercise of freedom of speech or compliance with legal obligations. For more details on about GDPR please visit:

Safeguarding Children (COPPA)

We believe safeguarding a child’s “personal data” should go without saying. Therefore we comply with the Children’s Online Privacy Protection Rule (“COPPA”). What is COPPA? COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. How SurfBoxStudio complies with COPPA We comply with COPPA by never storing, sharing or selling any “personal data” when you use our Website or Mobile Applications, regardless of whether you are a child or an adult. We request, if you are under the age of Thirteen (13), and you would like to get in touch with us by email, please have a parent or guardian do this on your behalf. If you believe that we may have received an email from a child under the age of thirteen (13), please contact us immediately so we can delete this information from our Gmail account. For more details please visit the COPPA website.

Changes to this Privacy Policy

SurfBoxStudio may update or make changes to this Notice from time to time. If we make material changes to this privacy policy, we will notify you here, or by means of a notice on our Website home page or within our Mobile Applications prior to the change becoming effective. We strongly suggest you consult this Privacy Notice regularly for any changes.

How to contact us and how to complain

Please let us know if you are not happy with the way we use and process your data, or if any of this privacy policy is unclear by contacting us at surfboxstudio@gmail.com. Our address is: Paul Jenkins T/A Surf Box Studio 35 Lovelock Road Parafield Gardens SA, 5107 You always have the right to lodge a complaint with the relevant authority where you live, work or where an alleged infringement has occurred, for example in the United Kingdom you can contact the Information Commissioner’s Office.