Privacy Policy
Last updated: June 2026
The short version
We collect as little as we can, we never sell or share your personal information, and we name every provider we rely on to run the service. For our own website (the blog, the contact form, the newsletter, and your account) Dom Labs decides how your data is used, so we are the data controller. For the chat widget, our customers decide what happens to their visitors' data, so for that we are only a processor acting on the customer's instructions. The detail is below, and you can reach a person at [email protected] about any of it.
Who we are
Dom Labs is a publication and lab operated from Lagos, Nigeria. This policy explains how we handle personal data across domlabs.dev and the chat widget. Where we are the controller, this policy is your full notice. Where we act as a processor for a widget customer, that customer's own privacy notice governs their visitors, and our handling is set out in our Terms of Service, and a separate Data Processing Agreement is available on request.
What we collect
From everyone who visits the site, we collect basic, anonymous usage data such as page views, referrer, approximate region, and device type through Vercel Analytics and Speed Insights. From the contact form, we collect your name, email, company, and the project details you choose to share. From newsletter sign-ups, we collect your email and your channel preferences. From account holders, we collect your email, your name if you provide it, a securely hashed password (or, if you use Google sign-in, the basic profile and email Google returns), and records of your plan and usage. From end-visitors who use a customer's widget, we process the chat messages they send and, where the site owner has enabled lead capture, the name, email, and message a visitor chooses to submit.
How we use it
We use this data to reply to you, to send only the newsletters you opted into, to create and secure your account, to run and bill the widget, to generate answers in the chat, to monitor errors and prevent abuse, and to understand in aggregate how the site is used so we can improve it. We do not sell your data, we do not share it for cross-context behavioural advertising, and we do not use it to train our own models.
Legal bases for processing
Under Nigeria's NDPA 2023 and the EU and UK GDPR, we rely on a legal basis for each use. We process contact and account data to take steps you ask for and to perform our contract with you. We send the newsletter and set non-essential preferences on your consent, which you can withdraw at any time. We rely on our legitimate interests to keep the service secure, prevent fraud and abuse, measure usage anonymously, and run the business, balanced against your rights. Where we act as a processor for a widget customer, the customer is responsible for the legal basis covering their visitors, and we process on their documented instructions.
The chat widget and AI
The widget answers questions using third-party AI providers, currently DeepSeek as the primary chat model and MiMo by Xiaomi as a fallback, reached through an OpenAI-compatible API, plus Google's Gemini for embeddings and search indexing and Gemma for some admin features. When a visitor sends a message, that message and relevant context from the site's knowledge base are passed to those providers to generate a reply. We keep a per-site message count for billing, and, where a site owner has enabled lead capture, the contact details a visitor chooses to share. We are the processor for this on behalf of the site owner. Because messages reach third-party AI providers, please do not type confidential or sensitive personal information into any chat.
Cookies and analytics
We do not use third-party advertising or tracking cookies, and we do not build advertising profiles. We use Vercel Analytics and Speed Insights for privacy-friendly, anonymous measurement that does not use cross-site cookies. We use your browser's local storage to remember things like your newsletter preference, your theme, and your chat session, which stay on your device. Cloudflare Turnstile runs on our forms to tell humans from bots without the tracking that traditional CAPTCHAs use.
Who we share data with
We rely on a small set of vetted sub-processors, each handling only the data it needs: Vercel for hosting, anonymous analytics, and speed insights; Neon for our PostgreSQL database; Resend for transactional and newsletter email; Paddle for payments, acting as merchant of record so it issues receipts and handles tax; Cloudinary for media and image hosting; Upstash for QStash queues and Redis rate limiting; Sentry for error monitoring; Cloudflare for Turnstile bot protection and for DNS and email routing; DeepSeek and MiMo by Xiaomi for chat responses and Google for embeddings, search indexing, optional account sign-in, and certain admin features; and Firecrawl, used only as a render fallback when crawling a customer's site. We do not sell data to anyone, and we share with these providers only to deliver the service.
International data transfers
Dom Labs operates from Nigeria, and several of our providers process data in the United States and other regions. Our database with Neon is hosted in the United States with encryption at rest. When data moves across borders, we rely on appropriate safeguards, such as standard contractual clauses or equivalent transfer mechanisms in our providers' data processing terms, so your data keeps a comparable level of protection wherever it is handled.
How long we keep data
We keep data only as long as we need it. Contact form submissions are kept while we are in conversation and for up to 24 months afterwards as a record, then deleted. Newsletter subscriptions are kept until you unsubscribe, after which we retain a minimal suppression record so we do not email you again. Account data is kept for the life of the account and deleted within 90 days of closure, subject to any records we must keep for legal or tax reasons. Widget chat message logs are kept for up to 12 months for support, abuse prevention, and quality, while billing message counts are kept for the period required for accounting. Lead records captured through the widget are held on behalf of the site owner and deleted on their instruction or when their account ends.
Your rights
Depending on where you live, you have rights over your personal data under Nigeria's NDPA 2023, the EU and UK GDPR, and California's CCPA and CPRA. These include the right to access the data we hold, to correct it, to delete it, to receive a portable copy, to object to or restrict certain processing, and to withdraw consent at any time. We do not sell or share personal information, so there is nothing to opt out of in that sense, but you are free to exercise any of these rights, and we will not treat you differently for doing so. Email [email protected] and we will respond within the time the law allows. If your request concerns data we process for a widget customer, we will direct it to that customer as the controller. You also have the right to complain to a supervisory authority, which in Nigeria is the Nigeria Data Protection Commission.
Keeping data safe and breaches
We protect data with encryption in transit and at rest, access controls, rate limiting, and bot protection, and we keep our provider list small and vetted. No system is perfectly secure, but if a breach affecting your personal data occurs, we will investigate, contain it, and notify the relevant authority and any affected people without undue delay where the law requires, including the timelines set by the NDPA and GDPR.
Children
Dom Labs is not directed to children, and the service is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email [email protected] and we will delete it.
Changes and contact
We update this policy when our practices change, and we revise the date at the top. For material changes we will give notice by email or in the dashboard. For anything privacy-related, including access or deletion requests, email [email protected] and a person will reply.