Legal
Privacy Policy
This policy explains what personal data qaldy.com collects, why, where it is processed and how long we keep it. It covers this website, including the project request form and the Qaldy Cloud product page at qaldy.com/cloud. It follows the Law of the Republic of Kazakhstan No. 94-V “On Personal Data and Their Protection” and, where it applies to you, the EU General Data Protection Regulation (GDPR).
Last updated October 13, 2026Policy version 2026-10-13.1
Who is responsible
Your personal data on this website is controlled by «Qaldy AI» Limited Liability Company (BIN 241140033566), registered on 26 November 2024, at 8 K. Mukhamedkhanov St., non-residential premises 5, Nura district, Astana 010000, Republic of Kazakhstan (“Qaldy AI”, “we”, “us”). Under Law No. 94-V we are the owner and operator of the database; under the GDPR we are the controller.
For anything about your personal data, write to tair@qaldy.com or to us on Telegram at @tairqaldy. You can also reach us through WhatsApp or the form on the Start a project page.
What we collect
- Your project request. What you enter in the form on the Start a project page: your name, company, role, email, phone, Telegram username, the problem and goals you describe, your current tools, budget range and timeline. We also keep the request code we give you, the time, the site language and a record of your consent to this policy, with its version.
- Technical data. When you send a request or make a choice in the cookie banner, we store a salted one-way hash of your IP address (with a request, also of your browser’s user agent), never the raw values. With a request we also store the country our hosting provider reports for your connection. To deliver the site, our hosting provider processes your IP address and the pages you request.
- Usage analytics, only if you allow them. If you choose “Allow analytics”, we record which pages you open (the address without query parameters, and the language) and whether you send the form. These records are kept in our own database, carry no name or contact details, and are not shared with an analytics company.
- Service events. Without your permission we record only what we need to run the service: that a request was confirmed, with its code, and which button you pressed afterwards to continue (Telegram, WhatsApp or copying the request).
- Messages you send us. If you write to us by email, Telegram or WhatsApp, we receive your message and the contact details that come with it.
- What we do not collect. The site has no advertising or third-party tracking scripts, does not record your screen or keystrokes, and does not accept file uploads.
Why we use it and on what basis
Where Law No. 94-V applies, we rely on your consent. You give it when you tick “I agree to the Privacy Policy” before sending a request, and when you choose “Allow analytics” in the cookie banner. You can withdraw consent at any time; this does not affect processing that already happened.
Where the GDPR applies, the legal bases are:
- answering your request and preparing a proposal you asked for: steps at your request before a contract (Art. 6(1)(b)) and your consent (Art. 6(1)(a));
- usage analytics: your consent (Art. 6(1)(a));
- keeping the service secure and preventing spam and abuse (rate limits, a hidden spam trap in the form, hashed technical data): our legitimate interest in a safe service (Art. 6(1)(f));
- keeping records of consent and of requests: our legal obligations and legitimate interests (Art. 6(1)(c) and (f)).
We do not sell personal data, we do not use it for advertising, and we make no decisions with legal or similarly significant effects about you by automated means.
AI features
The website does not offer an AI assistant or any other AI feature at the moment. Pages that describe AI tools we build for clients are information only.
If we add an AI assistant, we will first update this policy, its version and the date at the top. The assistant will say that it is an AI and link to this policy before you start.
Who processes data for us, and where
We use the service providers below. They process data only on our instructions and under their data processing terms. All of them process data outside Kazakhstan.
| Provider | What it does for us | Where |
|---|---|---|
| Vercel | Hosts and serves the website, its server functions and the Qaldy Cloud page; processes your IP address and requests to deliver them | Server functions in Frankfurt, Germany; pages delivered through its global network (company in the USA) |
| Railway | Hosts our database (requests, consent records, analytics and service events) | Amsterdam, the Netherlands (company in the USA) |
| Google (Google Workspace) | Our email: messages you send to tair@qaldy.com | Google’s data centres, including in the USA |
Not used today: PostHog (product analytics), Sentry (error monitoring), Cloudflare (Turnstile bot protection and R2 file storage), Telegram notifications to our team, and ElevenLabs (the AI assistant’s voice and replies). They are switched off and receive no data from this website. Before we switch any of them on, we will update this policy and ask for your consent where the law requires it.
When you press a Telegram or WhatsApp button, you continue in that app, and its own privacy policy applies to what you send there.
Cross-border transfers
Your personal data is stored and processed outside Kazakhstan: our database is in the Netherlands, the website’s server functions run in Germany, and our providers are companies based in the USA. By sending a request or allowing analytics, you consent to this cross-border transfer in line with Article 16 of Law No. 94-V.
Where the GDPR applies, transfers outside the European Economic Area rely on an adequacy decision or on the providers’ Standard Contractual Clauses.
How long we keep data
| Data | How long |
|---|---|
| Project requests and the consent given with them | Until you ask us to delete them, or earlier once we no longer need them |
| Consent records from the cookie banner | Kept as proof of consent; the IP hash in every consent record is removed after 180 days |
| Usage analytics and service events | 400 days |
| Rate-limit counters (built from IP hashes) | 1 day |
| Messages you send us by email, Telegram or WhatsApp | As long as we need them to deal with your request; you can ask us to delete them |
| Server logs at our hosting provider | A short period, under Vercel’s log retention |
If we switch on a feature that is not used today, we will add its retention period here first.
Your rights
You can ask us to tell you what data we hold about you and to give you a copy, to correct it, to delete it, to stop or limit processing, and to withdraw your consent. Where the GDPR applies, you can also object to processing based on legitimate interests and ask for your data in a portable format.
Write to tair@qaldy.com or to us on Telegram at @tairqaldy. If you have a request code (it looks like Q-XXXXXX), include it so we can find your data quickly. We may ask you to confirm it is you, and we answer within the time limits set by law.
To change your analytics choice, use “Cookie settings” at the bottom of any page.
You can also complain to the authorised body for personal data protection in Kazakhstan or, in the EU and EEA, to your local data protection authority.
How we protect data
All traffic is encrypted (HTTPS). Only our team can open the admin console, with individual accounts and passkeys. We store hashes instead of raw IP addresses, limit how often the forms can be used, filter out automated spam, and delete data when its retention period ends.
Children
This website is meant for adults contacting us about their business. It is not intended for people under 18, and we do not knowingly collect their data.
Changes to this policy
We version this policy. When we change it in a way that matters, we update the version and the date at the top, and the cookie banner asks for your choice again.