What we collect, and what we don't.

ctobox is built GDPR-first. Your data is stored and processed on EU infrastructure (Google Cloud, Frankfurt and Belgium regions), you have the full set of GDPR rights — access, rectification, erasure, portability, and objection — and we act on any request within the statutory 30 days. The full privacy policy, including our lawful bases for processing and our list of sub-processors, is being finalised by our legal counsel and lands here before public launch.

In short, we collect the brief and form answers you submit, your email address, your payment metadata via Stripe (we never see your card details), and a salted hash of the IP address used for each request — the minimum needed to deliver your scaffold, in line with the GDPR principle of data minimisation. We do not sell, share, or syndicate your input or output. The generated scaffold is yours from the moment your charge clears.

To exercise any of your GDPR rights — including a full export or the erasure of your data — write to privacy@ctobox.tech.