Privacy Policy

Devbox is a brand of Revshare Marketing Online, Lda, a company incorporated in Portugal, with team members in Lisbon (PT), Dubai (UAE) and Miami (US). Revshare Marketing Online, Lda is the controller of the personal data described in this policy.

Revshare Marketing Online, Lda · hello@devbox.agency

Enquiries and audit requests. When you use a contact form, request a free store scan or ask for an audit, we collect what you submit: name, email, company or brand, website or store URL, budget or revenue range, the services or areas you're interested in, and your message. We use it to reply and to provide what you asked for (steps taken at your request before a contract) and to follow up about our services (our legitimate interest).

How you found us. With an enquiry we also record the campaign tags in the link you arrived through (UTM parameters), the site that referred you, the first page you visited and the page you submitted from. This is held only in the page's memory while you browse — nothing is stored on your device — and is sent only if you submit a form. We use it to understand which channels bring us enquiries (legitimate interest).

Free store scan. When you submit a store URL, our systems read publicly available pages of that store and send the URL to Google PageSpeed Insights for a performance report. The URL and the results are stored with your request.

Security and abuse prevention. When you submit a form or run a scan we record your IP address and how long the form took to fill in. We use them only to block spam and automated abuse (legitimate interest) — never for advertising or profiling.

Analytics — only with your consent. If you allow analytics cookies, Google Analytics 4 (loaded through Google Tag Manager) measures how the site is used.

Advertising — only with your consent. If you allow marketing cookies, Google Ads, the Meta Pixel and the LinkedIn Insight Tag measure our ads and help us show relevant ads to people who visited the site. For the collection and transmission of this data, Meta Platforms Ireland and LinkedIn Ireland act as joint controllers with us; what they do with it afterwards is governed by their own privacy policies.

Until you make a choice, Google Consent Mode keeps analytics and advertising storage switched off. Details of every cookie are in our Cookie Policy.

We use a small number of providers, each bound by a data-processing agreement:

• Vercel — hosts the website and the server functions that receive form submissions (including standard server logs).
• Supabase — the database where enquiries and scan results are stored.
• Resend — delivers the email that notifies our team of a new enquiry.
• Google — PageSpeed Insights for the store scan and, only with your consent, Tag Manager, Analytics and Ads.

With your consent, Meta and LinkedIn receive data through their tags as described above. We do not sell your personal data or share it with anyone for their own marketing.

Some of these providers process data outside the European Economic Area, mainly in the United States. Where that happens, transfers rely on the provider's certification under the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.

We keep enquiry data for as long as needed to handle your request and for legitimate follow-up, and no longer than 24 months after our last contact, unless we enter into a contract or you ask us to delete it sooner. Scan results and security records follow the same limit. Cookies last as listed in the Cookie Policy.

We don't make decisions with legal or similarly significant effects about you based solely on automated processing. The store scan's scores are generated automatically, but they are information for you, not decisions about you.

You can ask us at any time to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent — which doesn't affect processing done before. Email hello@devbox.agency and we'll reply within one month.

If you believe we have not handled your data properly, you can complain to the Portuguese data protection authority, the CNPD (www.cnpd.pt).

If we materially change this policy, we will update this page and the date above.

Revshare Marketing Online, Lda · hello@devbox.agency