Privacy policy

Last updated: 13 September 2026

Controller

Contact Karim Meimanov at the address above for privacy questions or to exercise your rights.

Data and purposes

We process your email, assessment answers, personal experience, goals and constraints to create and deliver your report. Account information, mission steps, check-ins and journal entries let you save progress and prepare the included weekly plan. When you use curator chat, we store your messages and their timestamps and show your completed steps and check-ins to the human curator so they can respond and follow your progress. Order identifiers and payment status connect your purchase to your report. Device, request and error information helps operate and secure the service. A salted hash of connection information limits repeated sign-in and new-assessment requests; rate-limit records expire after one day.

Providing assessment and account data is necessary for these features. Please omit unnecessary health, religious or other sensitive information and other people's personal data. Optional private feedback contains your rating and review, linked to your account. It is used to improve the pilot and is not published without separate permission.

Legal bases

Service delivery uses Article 6(1)(b) GDPR; statutory recordkeeping uses Article 6(1)(c). Security, troubleshooting and reviewing voluntarily submitted feedback use Article 6(1)(f), based on our interest in a reliable service. Optional availability emails use your consent under Article 6(1)(a).

Optional notification

The notification checkbox starts unchecked and has its own save button. A review never enrols you. We store the choice, consent wording version and timestamps, including withdrawals. Consent covers email about availability of later Sidartly weeks; it does not authorize unrelated marketing or recurring payments.

Withdraw by turning off the preference and saving it in your account, or emailing support. Withdrawal does not affect previous lawful processing. Necessary sign-in, purchase and report-delivery messages are separate from this optional notification.

Providers and recipients

ChatGPT Sites and Cloudflare provide hosting. Supabase provides database storage and authentication; the configured project is in the EU (Ireland). OpenAI processes assessment and check-in context to generate reports and plans. Resend delivers report emails. Gumroad processes purchases under its own payment and privacy arrangements. Only the information required for each function is passed to the relevant provider; full card details are not stored by Sidartly.

The site currently loads fonts from Google Fonts, which receives connection information such as your IP address. Providers may process data outside the EEA. Applicable transfer arrangements depend on the provider and service, including adequacy decisions or standard contractual clauses where required. Contact us for information about applicable safeguards.

AI processing

AI analyses the information you submit and suggests directions and actions. Its output is a recommendation; Sidartly does not use it to make decisions with legal or similarly significant effects about you. You decide whether to act on it. Do not assume an AI-generated inference is a verified fact.

Cookies and device storage

Necessary sign-in cookies keep your account session; access cookies normally last about one hour and refresh cookies up to 30 days. Local browser storage saves assessment drafts, an email prefill and report interaction state. These can remain until you clear browser storage. Clearing them may remove unsent work or access details. Your advertising-cookie choice is saved in this browser for up to 180 days. You can change it using Cookie settings in the footer.

Optional advertising measurement (Meta Pixel)

With your consent, we use Meta Pixel (ID 1734532477782713) on our homepage and assessment page to measure advertising and support advertising personalization. Meta Platforms Ireland Limited may receive your IP address, browser and device information, page URL, advertising identifiers and visit time, and may associate these with your Meta account. Meta may use cookies such as _fbp and _fbc. Meta may process information outside the EEA, including in the United States. See Meta’s Privacy Policy and Cookie Policy for its processing, retention and transfer safeguards.

This optional processing relies on consent under Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG for device storage and access. Declining does not prevent use of Sidartly. The pixel is not loaded before permission. We disable automatic event configuration and do not intentionally send assessment answers, email addresses, private reports, account pages or access tokens. This integration records public PageView events, the start of checkout after a checkout link is created, and a Purchase event if you return to Sidartly and our site confirms payment. The Purchase event contains no answers, email address or checkout identifiers. If you do not return after paying, this browser integration cannot record the purchase. You can withdraw permission at any time through Cookie settings; this stops future tracking by this integration and clears accessible Meta cookies on our domain, without affecting prior lawful processing or deleting data already held by Meta.

Withdrawal requests

When you use the withdrawal form, we store your name, email, purchase description, receipt time and delivery status to process your declaration and meet legal obligations. A hashed connection identifier helps limit automated abuse. Resend sends the notice to support and a confirmation to you. These records are retained as necessary for contract administration, legal obligations and claims.

Retention

Curator messages remain in your account until you request their deletion or your account is deleted, subject to applicable legal retention needs. Assessment, report and progress data are kept to provide ongoing access while your account or report remains in use. You can request deletion of your account, report, drafts or feedback through support. Deletion requests are reviewed for applicable legal retention obligations and outstanding disputes; necessary records may be retained for those purposes. Backup copies may remain until the provider's backup cycle expires. Consent history is retained as needed to document your preferences and respond to legal claims. No automatic expiry of saved reports or local drafts is promised.

Your rights

Subject to the GDPR, you may request access, correction, deletion, restriction and portability, object to processing based on legitimate interests, and withdraw consent. You can complain to a supervisory authority, including the authority for Lower Saxony or where you live or work. We may need to verify identity before providing or deleting private data.

Legal reference: General Data Protection Regulation.