Your project.
Your data.
This page explains what data the website processes when you save a brief, use your account and make a payment. The person responsible for the product is Ruslan Safiullin.
The separate site administrator sign-in uses a password hash and a protected session cookie. Staff access requests are sent to the project inbox with name, email and identifier; registering a request does not grant permissions.
Email registration and sign-in
To create an account and sign in, we process your email address and your name if you provide it. Your account is created after verification with a one-time code. The site's database on Sites / Cloudflare stores the account identifier, email, name, verification time and consent version. This information is used to access your requests and protect your account; registration does not subscribe you to newsletters.
The code is sent through Google Workspace / Google Apps Script. For delivery, Google receives the email address, code, message language and technical request details. Your name and project materials are not included in the code email. The sender is SDH Advisor <noreply@ganodermadetection.com>. The code is valid for 10 minutes and can be used once. The site's database stores a protected derivative of the code rather than the plaintext code. The delivered message is stored in the recipient's mailbox under their email service's rules.
To prevent repeated requests, we store attempt times and results, counters and protected derivatives of the technical IP address; the IP address itself is not stored in these records. Code records that expired more than two days ago and outdated counters are cleared during subsequent successful requests. This is not deletion on a separate schedule.
After sign-in, your browser receives a secure session cookie. The database stores a derivative of a random session token. The session lasts up to 8 hours and expires after 30 minutes of inactivity; signing out revokes it on the server. Expired session records are cleared during subsequent successful requests. Send requests about access, correction or deletion of account data to safiullin@advisor-it.com.
Staff or expert registration does not grant administrative or staff permissions. Access is granted after review and assignment by an administrator. Migrating an existing account requires verification of the original account and email; a matching contact email alone does not grant access to another user's requests. The separate administrator password sign-in is retained.
Applicable law and visitors' rights
SDH Advisor undertakes to comply with the legal and regulatory requirements applicable to the website's activities and personal data processing, including mandatory provisions in visitors' jurisdictions where they apply to such processing. This policy does not limit any rights granted to you under applicable law.
Depending on applicable law, you may request access to, rectification or erasure of your data, restriction of processing, object to processing, withdraw consent or contact the competent supervisory authority. Use the contact below to make a request, specifying your country and the nature of the request. Whether particular requirements apply depends on the circumstances of processing and the territorial scope established by law.
What is stored
Name, role, contact details, country, project answers, selected service format, lead source and reference link. Submission records your account identifier within the site, request number, date and consent version.
Why we need the data
To save and review applications, choose a service and agree the next step. Linked materials are not downloaded automatically. Brief content is not sent to an external AI model. Submitting a brief does not itself subscribe you to marketing emails.
Calculator and educational PDFs
Educational PDFs on the homepage can be downloaded directly without registering or providing an email. The calculator runs on the page: budgets and cost shares are not stored in the database or sent to the team. The PDFs are public fictional educational materials. If a separate educational PDF request is made through the service's retained form, the email, request type and source, selected example, date and consent version are processed; the file is provided on the site and is not automatically emailed. Storage and processing of previously saved requests are described below.
Review requests and news
To arrange a 20-minute review we save email, request source and consent date. A request does not book a time: the team agrees it by email after checking work meetings and availability. Private calendar events are not published. A separate optional checkbox permits SDH news and materials by email and is off by default. Getting a PDF and arranging a meeting do not require news consent. Stored consent does not mean a mailing service is connected. You can withdraw consent or request email deletion using the contact below.
These requests and news consent are stored in the Sites / Cloudflare database. Records older than 90 days are cleaned up on the next successful submission of this form. A completed submission is notified to the team inbox via Google Workspace; a copy remains in the work mailbox. Mail failures do not cancel saved requests or block an available PDF. Email is not included in the page URL. To limit repeated requests, a daily hash of the technical IP address, without the address itself, is retained for up to 48 hours; expired records are cleaned up on the next successful submission.
Website language
Your interface language is saved in your browser for one year. Text you enter, official company details and original videos and publications remain in their original language.
Draft on your device
Fields are automatically saved in browser storage on this device. The draft is deleted after successful submission; after 30 days of inactivity, it is cleared the next time you open the brief. On a shared device, clear the website's data when you have finished.
Saved request
Requests are stored in the website's database on Sites / Cloudflare infrastructure. Access to your requests is verified against your account. Unprocessed requests older than 90 days are cleared upon the next successful request submission in the system. Data for agreed orders requires separate retention rules.
Payments and Telegram
To keep order records, we store invoices, agreed amounts and currencies, the selected payment method, and payment transaction identifiers and statuses. The website does not collect card numbers or CVC codes. When you proceed to payment, the connected payment service processes data under its own policies; available methods and terms are shown before payment.
When you contact us through the connected bot, your numeric Telegram identifier is stored. It can be linked to your account only using a one-time code generated after signing in to the website. Once linked, requests and payment history become available through both channels. Disconnecting Telegram ends the bot's access to your account and does not delete transaction history.
The bot stores your selected language and unfinished brief. You can delete a draft with /cancel; drafts older than 24 hours are cleared the next time you interact with the bot. Technical message-processing records store an identifier and checksum; completed records older than 48 hours are cleared during subsequent interactions. Receipts are sent only to the user's private chat after access is verified. Telegram also processes conversations with the bot under its own policies.
Video and map
The uploaded video is hosted on the website's infrastructure. Embedded YouTube and Google Maps content is loaded only after you click the relevant button. When it loads, Google receives technical connection data, including your IP address and browser information, and applies its own privacy policies. External links open the respective service.
Contact for data enquiries
Email safiullin@advisor-it.com. Include your request ID and the nature of your enquiry. The person responsible for the product is Ruslan Safiullin.
Deletion
Sign in to “My projects”, open the request and click “Delete request and its data”. After confirmation, the record is deleted from the website's primary database. Issued invoices and payment records are stored separately from the brief for contract performance, accounting and compliance with applicable obligations. Deleting a request does not delete these records. The retention period for financial documents is determined by applicable requirements; for questions about deletion and retention periods, use the contact below. This deletion does not control the infrastructure provider's backups.
Communication and notifications
Submitted website and Telegram bot applications and bot support requests are forwarded to the team at safiullin@advisor-it.com. Draft answers are not forwarded. Messages remain queued during temporary delivery failures. After sending is confirmed, support message text is removed from the queue; the email copy remains in the work mailbox. Google Workspace is used for email notifications.
Confidential materials
Do not include passwords, trade secrets or third parties' personal data in the initial brief. Restricted documents are shared after terms and a secure channel have been agreed. Consent to review a request does not cover publishing a case study, AI training or reuse of the concept.