Privacy policy | Salt Box Studio

Last updated: 14 October 2026 (version 2026-10-14)

1. Who we are

The data controller is SALT BOX S.R.L., Bucharest, Romania ("SALT BOX", "we").

For any question about personal data, write to contact [at] saltbox.ro or call +40 735 552 ···.

This policy covers https://saltbox.ro and the online tool SBX Rigging Calc, which is available to account holders only. We process data under Regulation (EU) 2016/679 ("GDPR"), Romanian Law no. 190/2018 and Law no. 506/2004.

2. What data we process, why, and on what legal basis

2.1. Visiting the site

Data: what section 3 describes (the visit counter) and the web server's technical logs (section 6).
Purpose: running the site securely, counting visits and the pages read.
Legal basis: Art. 6(1)(f) GDPR - our legitimate interest in a working, secure site and in knowing how much it is used.

2.2. Your account

You create your account yourself, through the sign-up form. It becomes active once you confirm your email address.

You can also sign in with Google or Apple ("Continue with Google / Apple"). Google or Apple then confirm your identity and send us your name, your email address and an account identifier; at the first sign-in the account is created at once, without a confirmation email. We do not receive your Google or Apple password. You can add your country and professional role later, on your account page.

Required data: name, email address, password (stored only as an irreversible cryptographic hash), country, professional role.
Optional data: company, phone, how you heard about SALT BOX.
Purpose: creating and running your account, access to SBX Rigging Calc, account messages (address confirmation, password reset, important changes).
Legal basis: Art. 6(1)(b) - providing the service you request; for "how you heard about SALT BOX": Art. 6(1)(f) - our legitimate interest in knowing how clients find us.

2.3. Email confirmation

Data: a one-time link sent to your address, the date and time of confirmation.
Purpose: checking that the address is yours and preventing fake accounts.
Legal basis: Art. 6(1)(b) and (f).

2.4. Calculator usage log

Data: date and time, module used, values entered, a summary of the results, IP address, browser type.
Purpose: service security, preventing abuse and automated copying, protecting and improving the tool, evidence of the inputs in case of a dispute.
Legal basis: Art. 6(1)(f) - legitimate interest.
Free-calculation counter and the Pro plan: for each calculation in the main tools we keep the tool and the start time, to count the free calculations of the current month, and the date until which the account has Pro. Legal basis: Art. 6(1)(b) - providing the service.

2.5. Login and security

Data: successful and failed logins, IP address, session identifier.
Purpose: protecting accounts and limiting abusive attempts.
Legal basis: Art. 6(1)(f).

2.6. SALT BOX news (optional)

Data: name, email address and proof of consent (date, time, IP address, browser identification, the text accepted).
Purpose: occasional news about our projects and services.
Legal basis: Art. 6(1)(a) - your consent, and Art. 12 of Law no. 506/2004. The sign-up box is unticked by default.
You can withdraw your consent at any time, through the link in every message, on your account page or by writing to us. Withdrawal does not affect messages already sent.

2.7. Correspondence and the contact form

Data: what you send us by email, phone or the contact form. The form asks for your name, email address and message; the project type, the build date and venue and a link to your files are optional.
Purpose: answering requests and offers.
Legal basis: Art. 6(1)(b) and (f).
A message from the form reaches us by email, at contact [at] saltbox.ro; the site does not keep it in its database. To limit abuse, the server keeps only a cryptographic hash of the IP address, not the address itself, for at most 24 hours.
The form also has an optional news box, unticked by default (section 2.6). If you tick it, we keep the proof of consent: email address, date, time, IP address, browser identification and the text accepted, for the period in section 5.

2.8. Payments (Pro)

Data: your name or company, billing address, VAT number (if you give one), the plan bought, amounts, the date and status of payments, and the customer and subscription identifiers at Stripe. You enter your card details directly on Stripe's page; we never receive them.
7-day free period (site): the date your account had the free period and an irreversible hash of the card fingerprint Stripe gives us, so the free period is given only once per card (Terms, 4.4). The card cannot be rebuilt from this hash. Legal basis: Art. 6(1)(f) - our legitimate interest in preventing repeated use of the free period.
In the phone app: Apple (iPhone) or Google (Android) takes the payment. From them we receive only the subscription's data (signed by Apple, or read through Google Play's developer interface): the plan, its dates, whether it renews, a refund if there is one, the transaction identifiers and the random identifier our app gives the store at purchase to link the subscription to your account. We never receive your card or Apple / Google account details.
Purpose: taking the payment, switching Pro on, invoices and the accounting records.
Legal basis: Art. 6(1)(b) - the contract, and (c) - legal accounting and tax obligations.

We make no automated decisions and no profiling with legal effects on you. We do not sell personal data.

3. The visit counter (no cookies)

We count visits with our own counter, hosted on our server. We do not use Google Analytics or any other third-party analytics service.

The counter uses no cookies and writes nothing to your browser.
Your IP address is not stored. To count the unique visitors of a day, we compute a cryptographic fingerprint (hash) from the IP address, the browser identification and a random value that changes every day. The previous day's value is deleted, so visits on different days cannot be linked.
For each visit we keep: date and time, the page visited, the site you came from (domain name only), the device type (desktop, mobile or tablet), the browser language and the daily fingerprint above.
Bots and search engines are not counted.
To limit abuse, the counter counts how many visits come from the same IP address within 10 minutes, again through a fingerprint (hash) made with the daily value, never with the address itself; that fingerprint is deleted with the daily value at the latest.
The data is deleted automatically after 400 days. We use it only for totals (visits, pages, sources) and share it with no one.

The legal basis is our legitimate interest in knowing how much the site is used (Art. 6(1)(f) GDPR). This data does not allow us to identify you.

4. Cookies and browser storage

We use only our own strictly necessary cookies, for the account pages and for logging in, and your browser's local storage for the calculator. Details: Cookie notice.

5. How long we keep data

Account and profile data: while the account is active. After 24 months of inactivity we notify you by email and delete the account 30 days later.
Unconfirmed sign-ups: 7 days.
Address confirmation link: 48 hours. Password reset link: 1 hour.
Calculator usage log: 12 months. The IP address in the log is erased after 90 days.
Free-calculation counter: 62 days.
Login and security logs: 90 days.
Visit counter: 400 days.
Web server technical logs: at most 90 days.
Proof of consent to news: while you receive news, and 3 years after you withdraw it.
Card fingerprint hash (free period): 3 years from the free period, even if you delete your account.
Payments and invoices: as long as accounting and tax law require (usually 10 years), even if you delete your account.
Correspondence and contract documents: as long as the business relationship and the legal periods require (for example, accounting records are kept for 10 years).

When you delete your account, your profile data is deleted at once and the usage log is anonymised (its link to the account is removed). The exceptions are the proof of the consents you gave (kept as listed above) and data the law requires us to keep.

6. Who receives your data

Our hosting and email provider (MagHost, Romania) stores the site, the database and the email on our behalf, as a processor, under a contract meeting Art. 28 GDPR. The web server keeps technical logs of requests (IP address, page requested, date and time, browser) for operation and security. Confirmation and password-reset emails, and the messages sent through the contact form, go through this provider's mail server (contact [at] saltbox.ro).
Google and Apple, only if you choose to sign in with them: the sign-in happens on their pages, under their own privacy policies. The site itself loads nothing from their servers.
Stripe (Stripe Payments Europe, Ltd., Ireland), the payment processor for Pro: it receives the payment data and processes it under its own policy (https://stripe.com/privacy). Stripe may transfer data to Stripe, Inc. (USA) under the EU-US Data Privacy Framework and standard contractual clauses.
Apple (Apple Distribution International Ltd., Ireland), for subscriptions bought in the iPhone app: Apple sells the subscription and takes the payment under its own policy (https://www.apple.com/legal/privacy/) and sends us its status.
Google (Google Ireland Limited, Ireland), for subscriptions bought in the Android app: Google sells the subscription and takes the payment through Google Play under its own policy (https://policies.google.com/privacy), and we read its status.
Public authorities, only when the law requires it.

The site loads no scripts, fonts or other resources from other companies' servers. Apart from Stripe, Apple and Google (above), we do not transfer personal data outside the European Economic Area.

7. Your rights

You have the right:

of access to your data (Art. 15 GDPR);
to rectification (Art. 16);
to erasure (Art. 17);
to restriction of processing (Art. 18);
to data portability (Art. 20);
to object to processing based on legitimate interest (Art. 21);
to withdraw your consent at any time (Art. 7(3)).

On your account page you can edit your data, download a copy of it and delete your account. For any other request, write to contact [at] saltbox.ro. We answer within one month of receiving the request; for complex requests this may be extended by two more months, and we will tell you. We may ask for information to confirm your identity.

You may lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania; anspdcp@dataprotection.ro; www.dataprotection.ro. You may also complain to the authority of the EU country where you live.

8. Security

We apply appropriate technical and organisational measures:

encrypted connections (HTTPS);
passwords stored only as hashes;
access to data limited to those who need it;
login rate limits and bot protection, with no external services;
backups;
keeping data no longer than needed.

9. Minors

The site and SBX Rigging Calc are meant for professionals. We do not open accounts for anyone under 18.

10. Changes

We may update this policy. The current version is always published on this page, with its date. If you have an account, we will also tell you about important changes by email.

11. Contact

SALT BOX S.R.L. · contact [at] saltbox.ro · +40 735 552 ··· · Bucharest, Romania