Privacy
Privacy notice.
Plain language. The actual policy. Read it once, refer back when you need to.
Effective November 07, 2026
The short version.
We collect as little as we can. We don't track you across the internet, we don't load third-party analytics, and we never sell your data. The only personal information we hold is what you give us — your email, when you subscribe to our newsletter, or your message, when you write to us — and, if you pay us, the payment record our payment processor (Paystack) sends us. We never see or store your full card number. You can read everything below for the details, but if you only read one paragraph, that's the one.
Who we are.
The Elixirs Lab Ltd is a private limited company registered in the Federal Republic of Nigeria (RC 7206881). We are the data controller for any personal data described below. If you have a question, email info@theelixirslab.com with "Privacy question" in the subject.
We process personal data in line with the Nigeria Data Protection Act 2023.
What we collect, and why.
1. Newsletter subscriptions
When you subscribe through any "Subscribe" form on this site, we collect your email address. We use it for one purpose: sending you the engineering notes and research papers you signed up for, when we publish them. We do not use your email for promotional sequences, drip campaigns, or anything you didn't ask for.
2. Direct correspondence
When you email us at info@theelixirslab.com or hello@theelixirslab.com, we receive your email address and the contents of your message. We use it to reply, and to retain context for ongoing client conversations. We do not put correspondence addresses on the newsletter list without separate, explicit consent.
3. Server access logs
Our hosting provider (Vercel) keeps standard access logs for security and operational reasons — these contain IP addresses and user-agent strings. They are retained for a short period (typically 30 days) and we do not use them for tracking or analytics. We do not run first-party analytics on this site at all.
4. Payments
When you pay us by card or another online method, the payment is handled by Paystack, our payment processor. You enter your card details on Paystack, not on our systems. Paystack sends us a record of the payment: your name, email address and phone number (if you gave them), the amount, currency, date, payment reference and channel, and limited card details (card type and brand, issuing bank and country, the first six and last four digits, and the expiry month and year), plus a reusable card token where you agreed to save your card. We never receive your full card number or security code. We use this record to confirm the payment, issue receipts and refunds, handle disputes, and keep accounting and tax records. If you pay by bank transfer, we receive the details shown on the transfer.
What we don't collect
- – No tracking cookies. No cookies, in fact, except what your browser may set itself.
- – No analytics platforms (Google Analytics, Plausible, Fathom, etc.).
- – No advertising trackers, retargeting pixels, or behavioural fingerprinting.
- – No third-party social-media buttons that report your visit back to those platforms.
- – No email open-tracking, click-tracking, or read receipts in our newsletter.
Where the data lives.
We use a small number of carefully chosen processors. Each one only sees the data it needs for its specific job.
| Processor | What it stores | Why |
|---|---|---|
| Buttondown | Newsletter subscribers (email + opt-in timestamp) | Sending the newsletter |
| Zoho Mail | Inbox content for info@theelixirslab.com | Receiving and replying to email |
| Paystack | Payment records (see "Payments" above); full card details stay with Paystack | Processing payments, refunds and disputes |
| Vercel | Static site hosting + access logs | Serving the website |
| Cloudflare | DNS records (no proxied traffic) | Routing requests for https://theelixirslab.com to Vercel |
| GitHub | Source code (no subscriber or correspondence data) | Building and deploying the site |
Each of these providers has its own privacy policy and data-processing terms; their practices are governed by their own published agreements. We choose providers that take privacy seriously and review the relationship annually.
Where the data is processed.
Our processors operate primarily in the United States and the European Union. By subscribing or contacting us, you understand that your personal data may be transferred to and processed in those jurisdictions. We rely on standard contractual clauses or equivalent legal bases for cross-border transfers.
How long we keep things.
- – Newsletter subscribers: until you unsubscribe. Unsubscribing deletes you completely from Buttondown.
- – Email correspondence: retained for the duration of any active client engagement plus a reasonable period for accounting and legal compliance (typically 7 years).
- – Payment records: for as long as accounting and tax law requires us to keep them.
- – Server access logs: ~30 days, then automatically purged by the hosting provider.
Your rights.
Wherever you live, you may ask us to do any of the following with the data we hold about you:
- – Access what we hold (we'll send you a copy)
- – Correct anything that's wrong
- – Delete it ("right to erasure")
- – Export it in a portable format
- – Object to specific processing
- – Withdraw consent for newsletter sending (this is what unsubscribing does)
To exercise any of these, email info@theelixirslab.com with "Data subject request" in the subject. We respond within 30 days, usually faster. We don't require ID verification for routine requests; for a deletion or export of substantial data we may ask you to confirm from the email address on file.
If you live in the EU, UK, or California and we don't resolve a complaint to your satisfaction, you may also lodge a complaint with your local data-protection authority (the ICO in the UK, your national DPA in the EU, the CPPA in California).
If you are in Nigeria, you have these rights under the Nigeria Data Protection Act 2023, and you may complain to the Nigeria Data Protection Commission.
Security.
We hold all of the above to a high security standard — hardware-key two-factor authentication on every administrative account, encrypted backups, principle-of-least-privilege on processor access. Our security posture is documented at /security. To report a vulnerability, see .well-known/security.txt.
Children.
Our services are intended for adult professionals. We don't knowingly collect data from anyone under 16. If you believe a child has subscribed, email us and we'll remove the record.
Changes to this notice.
We may update this policy when our practices materially change. The effective date at the top tells you when the current version was published. Material changes (anything that affects how we use your data) get communicated via the newsletter before they take effect.
How to reach us.
Privacy questions, data subject requests, complaints, or anything else covered above: info@theelixirslab.com. Postal correspondence: The Elixirs Lab Ltd, 61 Anibaba Street, Ewumi Estate, Ikosi-Ketu, Lagos State, Federal Republic of Nigeria.