Last updated: October 14, 2026
Boxmarshall Ltd, a company registered in Nigeria (RC 1557325) with its office in Lagos ("we", "us", "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Reoclo platform ("the Platform"). It is written to meet the Nigeria Data Protection Act 2023 (NDPA). We also keep the rights and complaint routes available to people in the European Union (GDPR) and the United Kingdom (UK GDPR).
Boxmarshall Ltd (RC 1557325), Lagos, Nigeria, is the data controller for personal data processed through the Platform. For questions or requests regarding your data, contact our data protection team at [email protected].
We collect and process the following categories of personal data:
Email address, name, username, avatar, timezone and preferences, the time your email address was verified, the time and version of the terms you accepted, and your organization memberships and roles. You provide this when you sign up, accept an invitation, or edit your profile.
The billing contact's name and email address, the organization's details, invoices, and payment records. Online payments are handled by Bachs Technologies Limited (bachs.io), which collects card or bank details on its own page and tells us only whether the payment succeeded and for how much. We never see or store card numbers.
One-time sign-in codes are stored only as keyed hashes (HMAC-SHA256) and sign-in link tokens as SHA-256 hashes; both expire, and the records are deleted about one day after creation. We store the public credentials of your passkeys and security keys, authenticator app secrets in encrypted form, and backup codes in hashed form. Session records include your IP address, browser and operating system (user agent), and last activity.
Sign-in history from the last 90 days, used to recognize new devices and to send security alert emails. For new-device alerts, the sign-in IP address is sent to ipwho.is to look up an approximate location (city and country).
Sign-in and sign-up forms are protected by Cloudflare Turnstile. Turnstile processes browser and device signals and your IP address to distinguish people from automated bots.
When you link or sign in with GitHub, we receive your GitHub account ID, username, and email address.
We send transactional and security emails, such as sign-in codes, invitations, and security alerts, through a transactional email provider.
Server connection details (hostnames, IP addresses), application configurations, domain names, and deployment settings you provide to the Platform.
Environment variables, SSH keys, and registry credentials. These are encrypted at rest using AES-256-GCM envelope encryption and are only decrypted in isolated worker processes during deployment operations.
Records of actions taken within the Platform, including who performed the action, what changed, and when. Sensitive field values are excluded from audit output.
Container logs and system journal logs from your servers, when you use our log management features. These logs originate from and belong to your infrastructure.
Platform usage patterns such as login timestamps, feature usage, and API request metadata. We do not use third-party analytics or advertising tools.
We process your personal data for the following purposes:
We process your data under the lawful bases set out in the NDPA and, for people in the EU and UK, GDPR Article 6:
We implement the following technical measures to protect your data:
If a breach puts personal data at risk, we report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and we tell affected people without undue delay.
Reoclo operates on a Bring Your Own Server model. Your applications, application data, and container workloads run entirely on infrastructure you own and control. We do not have access to your application databases, user data, or business data unless you explicitly configure the Platform to collect logs from those systems.
When you use browser terminal access, commands are relayed through the Platform but are not logged or stored by us. The terminal session exists only for the duration of your connection.
We do not sell, rent, or trade your personal data. We may share data only in the following circumstances:
We keep personal data only as long as we need it:
After your agreement with us ends, you have 30 days to export your Platform data. After this period, the data is deleted, and backup copies age out within 90 days, except where retention is required by law.
Under the NDPA and, for people in the EU and UK, the GDPR and UK GDPR, you have the following rights:
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
The Platform uses httpOnly cookies for authentication session management. We use browser local storage for user preferences such as theme selection. Cloudflare Turnstile may use cookies or local storage on its challenge domain to distinguish people from bots. We do not use advertising cookies, third-party tracking cookies, or analytics cookies.
We are based in Nigeria. The Platform runs on servers operated by Hetzner Online in Germany, its database is hosted on MongoDB Atlas, also in Germany, and our websites are served through Cloudflare's global network. Emails are sent through Prawnwire, Boxmarshall's own email platform, which runs on Hetzner servers in Germany and Finland. Storing data in these places moves it out of Nigeria. For these transfers we rely on the safeguards the Nigeria Data Protection Act allows: the data protection law of the European Union, which applies in Germany and Finland, and our agreements with these providers. Where data moves from the European Economic Area or the UK to a country without an adequacy decision, we use appropriate safeguards such as Standard Contractual Clauses.
You must be 18 or older to create an account. We do not knowingly collect children's data.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the Platform dashboard or email at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with the Nigeria Data Protection Commission (https://ndpc.gov.ng/). If you are located in the European Economic Area or the UK, you may also complain to your local data protection supervisory authority.
For any questions about this Privacy Policy or your personal data, contact us at [email protected].