Privacy Policy
What Verlox Limited, trading as Silent Keel, collects about you on this site and in the portal, why, who receives it, how long it is kept, and how to see or correct it.
Last updated 6 September 2026
Who we are
- Verlox Limited, a company incorporated in Hong Kong with its registered office at Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong, trading as Silent Keel, is the data user for the personal data described here. "We" means that company.
- This page covers the website at silentkeel.com (the "Site"), the customer portal at app.silentkeel.com (the "Portal"), and email with us. It is our personal information collection statement and privacy policy statement under the Personal Data (Privacy) Ordinance (Cap. 486).
What we collect and why
What Why we use it How long we keep it Inquiry. Your name, email address and business, what you need, and a budget if you give one. To reply, and to set up your Project if we go ahead. One year after the last activity on it, unless it becomes a Project. Account. Your name and email address. If you sign in with Google: the identifier Google uses for you, your profile picture, and the tokens Google issues for the sign-in. To run your account, and to send the invitation, sign-in codes, invoices and notifications about your Project. We ask Google for nothing beyond your name, email address and picture, and never read anything in your Google account. One year after the last activity on your account: a sign-in, a message, a milestone or an invoice. Sign-in and security. The sign-in code we email you. For each session, the network address and browser it was started from. To sign you in and keep you signed in, and to spot abuse of the sign-in endpoints. Sign-in attempts are also counted per network address for a few minutes, to slow down guessing; the count is not stored. A code until it expires, ten minutes after it is sent. A session expires after seven days; its record goes with your account. Project. The agreement versions we propose, the answers and proposals you send back, the messages you and we write, the files you upload, and the deliverables and links we hand over. To do the work, and as the record of what was agreed and delivered. One year after the last activity on the Project. Accepted agreement versions stay with the invoices they support. Billing. Each invoice's amount and status, and the identifiers our payment provider uses for you, your subscription and each invoice. Card details go to the payment provider and never reach us. To invoice Development, charge Operations, and keep the records tax law requires. Seven years from the transaction, as the Inland Revenue Ordinance requires. Email. What you write to us. To answer, and as part of the matter it concerns. One year after the last message on the matter. Use of the Site and the Portal. The pages you open, what you click and how far you scroll, your browser and device, an approximate location from your network address, a recording of your session in which anything you type is masked, and which advertisement brought you to the Site, if one did. Tied to your account once you sign in. When an inquiry follows an advertisement, your email address goes to the advertising provider hashed, to match the inquiry to it. To see how the Site and the Portal are used, to improve them, and to measure our advertising. Up to a year; recordings for a shorter period. - Giving us personal data is voluntary. Without a name and an email address we cannot reply to an inquiry or open an account; everything else is up to you.
- We use it for these purposes only, and not for direct marketing. Records are deleted at the end of the periods above, and earlier on request (section 6).
Who receives it
- Personal data goes to the providers that run our systems for us, and to no one else for their own purposes: those that host the Site, the Portal, its database and files; deliver our email and host our mailbox; issue invoices and take payment, which is where your card details go; provide sign-in with Google, if you use it; and measure use and advertising through their cookies. Each processes it under its terms with us, and may hold it outside Hong Kong.
- Beyond these, we disclose personal data only to our professional advisers when they need it, to a successor if the business is sold, and where the law requires. We do not sell personal data.
Security
- Everything in transit is encrypted. There are no passwords: sign-in is by a one-time code or by Google. Card details never touch our systems.
- The Portal's database and files are private to it: a customer sees only their own Projects, and beyond that only the person who runs Silent Keel has access. Backups are kept for thirty days, so a deletion is complete thirty days after it is made.
Your rights
- You may ask whether we hold personal data about you, for a copy of it, and for it to be corrected. We answer within forty days, as the Ordinance requires, and charge nothing.
- You may also ask us to delete what we hold about you, except the billing records tax law makes us keep, or to stop using it for any particular purpose.
- Write to hello@silentkeel.com. We may ask you to write from the email address on your account, or otherwise confirm who you are, before acting.
Contact
- Requests about personal data are handled by the director of Verlox Limited.
- Verlox Limited, trading as Silent Keel
Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong
hello@silentkeel.com