01 — Overview
The short version
Emmy ("we", "our", "us") is a web-development studio based in Lagos, Nigeria. We take privacy seriously and collect only what we genuinely need to run our business and serve you well. We don't sell your data, we don't run ads, and we don't share your information with third parties beyond the handful of tools required to deliver our services.
This policy applies to all information collected through our website at emmy.dev, our client portal, and any direct communications between you and us. If you have questions, the contact details at the bottom of this page go straight to a human.
02 — Data we collect
What we know about you
We collect information in three ways — things you give us, things collected automatically, and things we receive from third parties.
Information you provide
- Name and email address when you fill out a project inquiry or sign up for an account.
- Business name, website URL, and project details submitted via our intake form.
- Payment information — processed directly by Stripe; we never see or store your card details.
- Communications you send us via email, portal messages, or any other channel.
Information collected automatically
- Basic analytics data (page views, referral source, browser type) via Cloudflare Web Analytics — privacy-respecting, no cross-site tracking, no fingerprinting.
- IP address and request logs retained briefly for security purposes.
- Authentication tokens stored in secure HTTP-only cookies when you log into the client portal.
Information from third parties
- If you sign in with a social or OAuth provider in the future, we may receive a name and email address from that provider.
- Payment status and subscription data from Stripe.
03 — How we use it
Why we collect what we collect
We use your information only for the following purposes:
- To respond to project inquiries and provide quotes.
- To deliver and manage the services you've contracted us for.
- To send you project updates, invoices, and support messages.
- To process payments and manage your subscription if applicable.
- To monitor the health and security of our platform.
- To improve our website based on aggregated, anonymised usage data.
- To comply with legal obligations.
We do not use your data for profiling, automated decision-making, or advertising of any kind.
04 — Sharing & disclosure
Who else sees your data
We keep your data within our team except where a trusted third-party tool requires it. Here's the complete list:
- Supabase — our database and authentication provider. Data is stored on servers in the EU.
- Stripe — payment processing. Stripe is PCI-DSS Level 1 certified.
- Cloudflare — DNS, CDN, and privacy-friendly analytics. No personal data is shared.
- Resend / transactional email — we use a transactional email service to deliver receipts and project updates. Only your email address and name are shared.
We will never sell, rent, or trade your personal data. We may disclose information if required by law or to protect the rights and safety of Emmy, our clients, or the public.
05 — Cookies
Cookies & similar technologies
We use a small number of cookies, all strictly necessary for the site to function:
- Auth cookie — keeps you logged in to the client portal. Expires with your session or after 7 days.
- Cookie consent — remembers your preference so we don't ask again.
We do not use advertising cookies, social-media tracking pixels, or third-party analytics cookies. Cloudflare Web Analytics is cookie-free. For more detail see our Cookie Notice.
06 — Retention
How long we keep it
We hold your data only for as long as it's needed:
- Project inquiries that don't convert — deleted after 12 months.
- Active client data — retained for the duration of the engagement plus 3 years for accounting and legal compliance.
- Stripe billing records — kept for 7 years as required by Nigerian financial regulations.
- Server logs — purged after 30 days.
When data is no longer needed it is securely deleted or anonymised.
07 — Your rights
What you can ask us to do
Depending on your jurisdiction you may have the right to:
- Access a copy of the personal data we hold about you.
- Correct any inaccurate information.
- Delete your data (the "right to be forgotten"), subject to legal retention obligations.
- Restrict or object to how we process your data.
- Receive your data in a portable, machine-readable format.
- Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, email us at hello@emmy.dev. We will respond within 30 days.
08 — Security
How we protect your data
We apply reasonable technical and organisational measures to protect your information, including TLS encryption in transit, encrypted storage at rest via Supabase, and role-based access controls so that only the people who need your data can see it.
No system is 100% secure. If we ever discover a breach that affects your personal data we will notify you as required by applicable law, promptly and in plain English.
09 — Children
Under-13 policy
Our services are designed for businesses and adults. We do not knowingly collect personal data from anyone under the age of 13. If you believe a child has submitted information to us, please contact us and we will delete it promptly.
10 — Changes
When this policy changes
We may update this policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. If changes are material, we'll notify active clients via email. Your continued use of our services after changes take effect constitutes acceptance of the revised policy.
11 — Contact
Get in touch
If you have any questions about this privacy policy or how we handle your data, reach out — we'll respond quickly.