Learn what personal data we use to provide Sibly services, how we protect it and how you can exercise your rights.
At a glance
- Storybook OÜ is the controller of Sibly account, order and customer communication data.
- For your company's emails and website content, we generally act on your company's instructions.
- We use service partners, including Qboxmail for email services.
- For privacy enquiries, contact info@sibly.pro.
1. Who is responsible for your data?
This policy applies to the Sibly website, customer accounts, website creation, web hosting, website maintenance, email, domains and related customer support. The service provider and controller of customer relationship data is Storybook OÜ. Contact us at info@sibly.pro.
For personal data hosted on a customer's behalf, the customer generally determines the purposes of processing. We act as a processor under the agreement and the customer's instructions. This privacy policy does not replace a data processing agreement with the customer.
2. What data do we use and why?
| Situation and data | Purpose and legal basis |
|---|---|
| Account creation and sign-in: name, email, company, role, authentication identifiers and account preferences. | Providing the account and service: performance of a contract or pre-contractual steps. For a company representative, our legitimate interest in managing the customer relationship and verifying authority. |
| Orders and billing: service, billing period, billing details, invoices and payment status. | Performance of a contract; legitimate interest in managing the relationship with a company's contact person; statutory accounting obligations. |
| Enquiries, support and free audits: contact details, messages, website address, audit inputs and results. | Preparing or delivering the requested service; for other communications, our legitimate interest in answering enquiries and improving the service. |
| Technical data: IP address, device and browser information, timestamps, sign-in and administrative activity logs. | Legitimate interest in protecting accounts and services, detecting misuse and resolving faults. Statutory retention obligations apply where relevant. |
| Newsletters and marketing preferences: email, consent date and source, opt-out. | Sending marketing emails based on consent, which can be withdrawn at any time. |
| Domain registration or transfer: registrant and contact details, evidence of authority and the necessary authorisation code. | Carrying out the requested transaction and meeting registry requirements. A contract with an individual or, for a company representative, legitimate interest in managing the relationship; legal obligation where applicable. |
Fields required to enter into a contract or operate the service are identified in forms. Without them, we may be unable to provide the service. Marketing consent is optional and is not a condition of ordering a service. Reading this policy does not constitute marketing consent.
When relying on legitimate interests, we assess necessity and the impact on individuals' rights. You may object to this processing on grounds relating to your particular situation.
3. Where does the data come from?
We receive data from you, your company's authorised users, service usage, and payment, authentication and domain partners. To prepare company information and websites, we may use Inforegister, Storybook, public company registers and the company's own website. This may include representatives' names, roles and business contact details.
When you sign in with Storybook, we use the identifiers needed for authentication and account linking. Data being publicly available does not make its use unrestricted.
4. Your emails and website content
The customer generally determines the purposes of processing personal data in their mailboxes, contacts, calendars, website files and databases. We store and process this data to provide and secure the service, make backups and carry out customer instructions.
We do not use customer email content to create Sibly advertising profiles or for our own marketing. Staff access to customer content must be based on a documented work requirement, customer instruction or legal obligation, and limited to what is necessary. Spam and malware prevention involves automated analysis of messages.
Qboxmail is our technical email partner. In addition to hosting, Qboxmail processes certain usage, message metadata and security data as an independent controller, for example to prevent abuse. This is described separately in its user privacy notice.
If your employer ordered the mailbox or website, direct requests concerning that content to them first. We assist the customer within the scope of our service and agreement.
5. AI and related visibility services
When creating or editing a website with AI, your input and the website content being processed may be sent to an AI provider. Use information intended for company publication; do not enter passwords, mailbox content or sensitive information about other people. The technical solution uses the OpenAI API; the data fields, retention settings and transfer safeguards depend on the particular AI feature and service agreement.
Generating website content does not in itself constitute automated decision-making with legal or similarly significant effects on you. If such decision-making is introduced, we will provide separate information about its purpose, logic and consequences.
Inforegister and Storybook brand marketing or company information services may involve processing by the relevant provider for its own purposes. See the group privacy policy. That reference does not extend business database use or retention rules to Sibly mailbox content. The issuer explains the terms for trust marks and certificates.
6. Who receives data and where is it stored?
We share data as necessary with email, hosting, domain, payment, authentication, AI and support partners. Technical integrations include Qboxmail, Realtime Register, Montonio and OpenAI. A partner's role depends on the transaction: it may act as our processor or as an independent controller. Group membership does not automatically permit sharing all customer data.
Domain registrant details are sent to the registry for the relevant extension. Public registry information depends on the extension and applicable rules. Billing data may be shared with an accounting provider and, where legally required, a competent authority.
Qboxmail's data processing agreement provides for hosted content and backups to be located in the European Economic Area (EEA). Its user privacy notice also describes transfers of certain security service data to US partners. International domains, AI services, recipients you email and optional applications you choose may also involve processing outside the EEA.
Transfers we arrange outside the EEA must use an applicable safeguard, such as a European Commission adequacy decision or standard contractual clauses with necessary supplementary measures. For information about partners, locations and safeguards, or a copy of relevant safeguards, contact info@sibly.pro.
7. How long do we keep data?
The following are Sibly's planned retention periods. They do not mean that all data is kept for the same duration. Customer content, billing records and security logs are separate categories.
| Data | Retention |
|---|---|
| Enquiries and free audits that do not lead to a customer relationship | 12 months after the last substantive communication or delivery of the audit. |
| Support requests | 24 months after resolution. Temporary customer files: up to 30 days after resolution. Passwords and keys included in messages are removed immediately. |
| Core account and contract records | For the customer relationship and, as necessary to defend claims, up to 3 years afterwards. Necessity is reviewed at least annually. |
| Accounting source documents | 7 years after the end of the relevant financial year; special categories of documents follow statutory periods. |
| Sibly web server access and error logs / security logs / administrator audit logs | 30 days / 180 days / 12 months respectively after the event. |
| Hosted website content and backups | During the service. Up to 30 days of restricted export access after termination, followed by deletion of active content. Remaining backups expire no later than 60 days after the service ends. |
| Marketing data | While consent remains valid; inactivity is reviewed after 24 months. Evidence of consent: up to 3 years after withdrawal if necessary. A minimal opt-out record prevents unwanted re-enrolment. |
| Security incident data | Case summary and decisions: up to 3 years after closure. Sensitive raw data: up to 90 days after closure unless a specific evidential need requires longer retention. |
Email-specific arrangements. Messages are kept during the service. Qboxmail's Mail Time Machine describes recovery points up to 15 days old; this is not the deletion period for all backups. Its public documentation distinguishes up to 60 days following a final deletion request from 30 days after contract termination, with backup exceptions. The exact schedule for closing Sibly mailboxes, exporting data and final partner deletion is set in the email service agreement. Separately ordered archives follow the agreed retention period; ten-year archiving is not enabled by default.
For a justified deletion request, Sibly's internal target is deletion from active systems within 7 days of verifying authority and scope, with backup expiry within 30 days of active deletion. The statutory response period for rights requests is described below; applicants are informed of partner-specific arrangements.
A specific legal obligation or dispute may require keeping necessary data longer with restricted access. We document the reason and review continuing necessity. Previously approved deletions must be reapplied after restoring a backup. Closing an account does not automatically delete invoices subject to statutory retention.
8. How do we protect data?
Our security approach is based on restricted access, encrypted connections, backups, software updates and incident handling. The implementation plan requires administrator multi-factor authentication, periodic access reviews and recovery testing. Specific measures and package differences are defined in the service agreement.
No service eliminates every risk. Keep your credentials confidential and report suspicious activity promptly to info@sibly.pro. In a breach, we notify customers, competent authorities and affected individuals according to our role, contractual requirements and applicable law.
10. What rights do you have?
You may ask whether and how your personal data is processed, access it and request correction of inaccurate data. Subject to legal conditions, you may request erasure, restriction and portability, and object to processing based on legitimate interests. You may object to direct marketing at any time.
You may withdraw consent at any time without affecting the lawfulness of earlier processing. Unsubscribe using the link in a newsletter or by contacting us.
Send requests to info@sibly.pro. We can help you formulate a request. We may ask for proportionate additional information to verify your identity and its scope. We respond without undue delay, normally within one month of receipt. For complex or numerous requests, the period may be extended by up to two further months under the law; we will inform you and explain why within the first month.
If you believe your data protection rights have been infringed, you may contact the Estonian Data Protection Inspectorate or a competent court. Contacting us first is not a condition for filing a complaint.
11. Changes to this policy
We keep this policy aligned with our services and actual processing. We publish new versions with an effective date and communicate material changes appropriately. If new processing requires consent, we ask for it separately.
A question about your data?
Contact info@sibly.pro. Include information needed to identify your service or account, but do not send passwords or authorisation codes.