Privacy Policy

1. Who we are

Novacraft is a software engineering and design studio operated by Novacraft Engineering Studio Limited. Our registered address is 54b Adeniyi Jones, Oba Akran, Ikeja, Lagos 100282, Nigeria, and you can reach us on +234 814 349 7066 or [email protected]. We also have operational presence in Miami (USA), Nairobi (Kenya), and Accra (Ghana). References to “Novacraft”, “we”, “us”, or “our” in this policy refer to this entity.

Questions about this policy can be directed to [email protected].

2. What we collect

We only collect information you voluntarily give us. This includes:

• Contact information (name, email address, phone number) when you submit a project enquiry or register for the Academy.
• Project details (budget, timeline, brief, reference links) when you use our contact form.
• Academy registration data (preferred course, experience level, cohort preference) when you register for a training programme.
• Usage data (pages visited, time on site, browser and device type) collected automatically via analytics. We do not use tracking cookies or fingerprinting.

3. How we use your information

We use your information to:

• Respond to project enquiries and quote requests.
• Manage Academy cohort enrolment and send cohort communications.
• Improve the content and performance of this website.
• Comply with legal obligations where applicable.

We do not sell, rent, or trade your personal information to third parties. We do not use your data for profiling or automated decision-making.

4. Legal basis for processing (GDPR)

Where GDPR applies, we process personal data on the following bases:

• Contract performance covers the processing necessary to respond to your enquiry or deliver Academy services.
• Legitimate interests cover site analytics to improve our offering, where these interests are not overridden by your rights.
• Consent applies where you have explicitly opted in to receive marketing communications.

5. Data retention

We retain enquiry and contact data for up to 24 months after last contact. Academy enrolment records are kept for 5 years for certification purposes. You may request deletion at any time (see section 8).

6. Cookies and analytics

This website uses privacy-respecting analytics. We do not use third-party advertising trackers or social media pixels. Session data is anonymised and aggregated. No individual is identified.

We count page visits with Cloudflare Web Analytics, which sets no cookies and does not follow you to other sites; Cloudflare receives the page address, the referring site, your browser details and your IP address to do this. We also use Google Analytics, which is not loaded at all and sets no cookies until you click Accept in the cookie banner; if you decline, it is never loaded. We do not use advertising trackers.

Strictly necessary cookies (session management, security) are set automatically. No consent is required for these. No marketing or tracking cookies are set.

7. Third-party services

We use a small number of third-party services to operate this website:

• Vercel provides hosting and the edge network. Data processed in accordance with Vercel's Privacy Policy.
• Email delivery forwards contact form submissions through a transactional email provider. Your email is not added to any mailing list without consent.

We do not use Meta Pixel or similar advertising trackers.

8. Your rights

You have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: request deletion of your data where there is no overriding legal obligation to retain it.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

9. Security

We take the security of your data seriously. Our systems are hosted on SOC 2-compliant infrastructure, communications are encrypted in transit (TLS 1.3), and access to personal data is restricted to personnel who need it to carry out their responsibilities.

10. Vela Mail (iOS and Android)

Vela Mail is our email app for company mailboxes hosted on Mailbox by Novacraft. Your organisation creates your account and decides what happens to the mail in it; Novacraft Engineering Studio Limited operates the mailbox service and the app on its behalf.

What the app sends to your mailbox service: your work email address and your password or verification code when you sign in; the mail, recipients, attachments and signatures you read, write and send; the name and optional phone number in your profile; and, if you turn on notifications, a push token for this device and whether alerts should show the sender and subject. Your organisation's mailbox keeps a list of signed-in devices and recent sign-ins for security.

What stays on your phone: sign-in tokens and unsent drafts are encrypted in the device's secure storage (Keychain on iOS, Keystore on Android). App lock PINs and Face ID or fingerprint checks never leave the device.

Services the app relies on: notifications are delivered through Firebase Cloud Messaging (Google) and the Apple Push Notification service. App updates are delivered by our Pulsar service, which receives an anonymous install identifier, the app version and, if an update fails, an error report.

Vela Mail shows no advertising, does not track you across other apps or websites, and does not sell or share your data.

Removing your data: removing a mailbox in the app's Settings signs this phone out, ends its session on the server and deletes the account from the device. The mailbox itself belongs to your organisation; to close it or delete its contents, ask your administrator or write to [email protected]. Help with the app is at Vela Mail support.

11. Open tracking in mailbox email

Some mailboxes on Mailbox by Novacraft add a small invisible image to the email they send. When the recipient's email app loads that image, the mailbox records that the message was opened, so the sender can see it in their Sent folder.

Who does it: mail sent from the Novacraft and Metro Peril mailboxes carries this image by default, and the sender can turn it off for any message. Every other mailbox we run sends without it unless the sender turns it on for that message, in the web mail or in Vela Mail.

What is stored: the message it belongs to, its subject, the first recipient's address, when it was sent, how many times the image was loaded and when it was first loaded. We do not store the recipient's IP address, location or device. Opens by people signed in to the sending mailbox are not counted.

How long: these records are deleted 12 months after the message was sent.

It is approximate: Apple Mail Privacy Protection loads images on the recipient's behalf whether or not they read the message, and email apps that block images never load it, so a message can show as opened when it was not, or not opened when it was. Recipients who prefer not to be counted can turn off automatic image loading in their email app.

12. Changes to this policy

We may update this policy from time to time. Material changes will be noted at the top of this page with a revised date. Continued use of the site after any change constitutes acceptance of the updated policy.