Privacy Policy

01 Who We Are

Gravlux Creative Lab is a premium web design and digital creative studio founded by Lewis Coogan, based in Nairobi, Kenya. We specialise in web design, brand identity, web applications, e-commerce, and FinTech platform development for clients across Africa and globally.

For any privacy-related enquiries, contact us at: gravluxcreativelab@gmail.com

02 Information We Collect

We collect only the information necessary to provide our services and respond to your enquiries. This includes:

• Contact Information: Your name, email address, phone number, and company name when you fill in our contact or project enquiry form.
• Project Details: Information you share about your project goals, budget range, and service requirements.
• Communications: Records of email correspondence and messages you send to us.
• Usage Data: Basic analytics such as pages visited, time spent on pages, and general geographic region (country/city level) through anonymised analytics tools. We do not use cookies that track you across other websites.
• Technical Data: Browser type, device type, and referral source — used only in aggregate to improve our site.

We do not collect sensitive personal data such as financial account details, payment card numbers, or government identification numbers through this website.

03 How We Use Your Information

We use the information you provide solely for the following purposes:

• Responding to your project enquiries and proposals
• Communicating about service agreements, project progress, and deliverables
• Sending invoices and managing our business relationship with you
• Improving the functionality and content of our website
• Complying with legal obligations applicable in Kenya and international best practices

We will never sell, rent, or trade your personal information to third parties for their marketing purposes.

04 Legal Basis for Processing

We process your personal information on the following lawful bases:

• Contractual necessity: Processing required to fulfil a service contract with you.
• Legitimate interests: Running our studio, responding to enquiries, and improving our website.
• Consent: Where you have explicitly provided your information by filling in our contact form.
• Legal obligation: Where required by Kenyan law or applicable regulations.

05 Cookies & Tracking

Our website uses minimal, privacy-respecting technologies. Specifically:

• No tracking cookies: We do not place third-party tracking or advertising cookies on your device.
• Session functionality: Basic session data may be stored temporarily to ensure the website functions correctly.
• Analytics: If we use analytics tools, they are configured to anonymise IP addresses and do not build personal profiles of visitors.
• EmailJS: Our contact form uses EmailJS, a third-party service that processes the content of your message to deliver it to our inbox. EmailJS has its own privacy policy available at emailjs.com.

You can control or block cookies through your browser settings at any time without affecting your ability to view our website.

06 Third-Party Services

Our website is hosted on Vercel (vercel.com), which may collect standard server logs including IP addresses. Vercel's infrastructure is governed by their own privacy policy. We have configured our deployment to add security headers and minimise data exposure.

We use Google Fonts (fonts.googleapis.com) to display our chosen typefaces. Google may log the font request — refer to Google's privacy policy for details. No personal data from our visitors is shared with Google beyond what is inherent in this font request.

Our project clients' websites are hosted on separate platforms (Vercel, Netlify) and are governed by their respective privacy policies.

07 Data Retention

We retain your contact details and project correspondence for as long as is necessary to:

• Fulfil and manage your service contract
• Comply with legal and accounting requirements (typically 7 years under Kenyan law)
• Maintain records of completed projects for portfolio purposes (with your permission)

Once retention periods expire, personal data is securely deleted or anonymised.

08 Data Security

We take the security of your information seriously. Our website is served over HTTPS with TLS encryption. We implement industry-standard security headers including strict content-type options, referrer policy, and frame protection.

Access to enquiry data is restricted to authorised Gravlux team members only. We do not store financial or payment details on our website or servers.

While we take all reasonable precautions, no internet transmission is 100% secure. If you have concerns about sharing sensitive information online, please contact us via email directly.

09 Your Rights

You have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete information.
• Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Objection: Object to our processing of your data for marketing purposes at any time.
• Portability: Request your data in a structured, machine-readable format.
• Withdraw Consent: Withdraw any previously given consent without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at gravluxcreativelab@gmail.com. We will respond within 30 days.

10 Children's Privacy

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it promptly.

11 International Transfers

Gravlux Creative Lab is based in Nairobi, Kenya. If you are contacting us from outside Kenya, your information will be transferred to and processed in Kenya. By submitting your details, you consent to this transfer. We ensure that your data is handled with the same level of care regardless of where it is processed.

Our hosting provider Vercel operates globally, which means your data may pass through data centres in various regions. Vercel maintains appropriate data protection standards under their agreements.

12 AI Training Opt-Out

We have taken steps to prevent our website content from being used to train AI models without our consent. Our robots.txt file explicitly disallows crawling by known AI training bots including GPTBot, Google-Extended, CCBot, and anthropic-ai. We assert our copyright over all original content on this website.

13 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or website features. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

Continued use of our website after any changes constitutes your acceptance of the updated policy.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us: