Legal
Privacy Policy
Last updated: 12 November 2026
1. Who is responsible for your data
The data controller is CodeBaxh. This policy explains how we handle personal data when you visit this website or contact us. To reach us about privacy, use the contact form.
2. What we collect
Contact form
When you send an enquiry we collect the details you enter:
- Name and work email address
- Company name, if you provide it
- The services you are interested in, your budget range and timeline
- Your message
- The fact that you gave consent, and when
Your IP address is used briefly on our server to limit repeated submissions and prevent spam. It is not stored with your enquiry.
Website statistics
We use privacy-friendly analytics that do not set cookies and do not collect personal data. Visits are counted in aggregate, so we cannot identify you or follow you across websites.
Cookies
This website does not use advertising or tracking cookies. Your light or dark theme choice is saved in your browser's local storage and never leaves your device.
3. Why we use it and our legal basis
- To answer your enquiry and prepare a proposal. Legal basis: your consent (Article 6(1)(a) GDPR) and steps taken at your request before entering into a contract (Article 6(1)(b)).
- To protect the website against spam and abuse. Legal basis: our legitimate interest in keeping the service secure (Article 6(1)(f)).
- To understand how the website is used, in aggregate. Legal basis: our legitimate interest in improving the website (Article 6(1)(f)).
4. Who processes data for us
We share personal data only with the service providers needed to run this website:
| Processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Website hosting and delivery | United States / EU |
| Resend (or the SMTP provider configured for the site) | Sending contact-form emails | United States / EU |
| Plausible Analytics | Privacy-friendly, cookieless website statistics | EU |
| Cloudflare (Turnstile), when enabled | Spam protection on the contact form | Global |
| Cal.com, when you book a call | Scheduling discovery calls | United States / EU |
Our engineering team is based in Pakistan and may access enquiry details to prepare a response. Where personal data is transferred outside the EU/EEA, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses. We do not sell personal data.
5. How long we keep it
Enquiries that do not lead to a project are deleted within 24 months of our last contact. If we work together, relevant correspondence is kept for the duration of the contract and afterwards for as long as accounting and legal obligations require.
6. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased
- Restrict or object to processing
- Receive your data in a portable format
- Withdraw consent at any time, without affecting processing already carried out
To use any of these rights, contact us using the details above. We respond within one month. You also have the right to complain to a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY).
7. Security
The website is served over HTTPS. Access to enquiry data is limited to the people who need it to respond, and our providers are chosen for their security standards.
8. Changes to this policy
We will update this page when our practices change. The date at the top shows when it was last revised.