Privacy Policy

1. Operator and scope

The operator of ul1dev.com is Igor Svyatoslavovich Ulanov, a self-employed individual based in Russia. This policy covers website visits and project enquiries. The website does not accept online payments.

The website is intended for an international Russian-speaking and English-speaking audience, primarily outside Russia, including Europe and CIS countries. Visitors from Russia may also read the website and submit project enquiries. A website language, IP address or VPN does not remove mandatory law or rights applicable to a particular processing activity.

Privacy enquiries: [email protected]. Postal correspondence: Igor Svyatoslavovich Ulanov, poste restante, Post Office 192077, 29 Slavyanskaya Street, Ust-Slavyanka, Saint Petersburg, 192077, Russia.

2. Information you provide

An enquiry may contain your name, optional company, email address, telephone number or another contact address, project description and optional attachments. The website records its language, source page, receipt time, processing status, consent version and technical identifiers used to handle the enquiry and prevent duplicate submissions. At least one contact method and a project description or attachment are required; company details and attachments are otherwise optional.

Provide only information relevant to your project. Do not submit passwords, payment-card details, identity documents, health information or other sensitive data. If a document contains information about someone else, ensure that you may provide it and remove unnecessary personal data.

3. Purposes and grounds for processing

Enquiry information is used to review your request, contact you, clarify requirements and discuss possible cooperation. Form submission records your consent. Where applicable law permits, necessary communications may also rely on steps requested before a contract or legitimate interests in answering business enquiries, which do not authorise unrelated use.

Technical processing supports website delivery, file handling, access control, troubleshooting and protection against abuse. Its grounds are provision of requested functionality and, where applicable, legitimate interests in maintaining a secure service. Project contracts and their records are handled separately.

4. Optional website statistics

First-party analytics are disabled until you allow them. They measure visits, page and article views, reading activity, traffic sources and interactions such as enquiry submission. Records include short-lived random session identifiers, event times, page paths without query parameters, language, device category and the referring domain without the full address. Approximate country or region is available only when a local GeoIP database is enabled.

An IP address is available temporarily on the server and may determine an approximate region, which is not always available or accurate. Analytics do not retain raw IP addresses. GPS location is not requested. Statistics are not used for advertising, sale of personal data or decisions with legal or similarly significant effects.

You can refuse analytics without losing access to content or the enquiry form. Use the website statistics settings to change your choice or withdraw consent. Withdrawal stops future optional collection; it does not make earlier lawful processing unlawful or identify your contribution within totals that no longer contain identifiers.

5. Cookies and browser storage

Local storage remembers your analytics choice and its version under starter.metrics-consent.v1. The choice has no automatic expiry and remains until changed or cleared. A new policy version requires a new choice. Use “Website statistics settings” in the footer or your browser controls to change it. Withdrawal stops future collection and removes active analytics cookies and the current session association; it does not automatically recalculate existing aggregated totals.

After analytics permission, first-party cookies starter_site_session and starter_metric_session maintain random sessions for up to 30 minutes. In production they use Secure, HttpOnly and SameSite=Lax. Administrative authentication has a separate necessary one-hour session cookie for the protected administration area. Upload sessions expire after 30 minutes; this is separate from attachment retention. Blocking necessary functionality may prevent the corresponding protected or upload operation.

6. Hosting, communications and recipients

The main website server and enquiry database are hosted in Germany. Bunny.net stores website files, private attachments and encrypted backups in Germany with a replica in Sweden. Public website files are delivered through a CDN; private attachments and backups are not delivered through the public CDN.

Cloudflare provides DNS, protected reverse proxying and website delivery. It receives network addresses, browser and request information and technically processes website traffic, including form requests. Its infrastructure operates across countries. Necessary security-check cookies may be used; these are separate from optional website analytics. Provider information: https://www.cloudflare.com/privacypolicy/

Yandex 360 provides email and email delivery in Russia. The operator is based in Russia and accesses enquiries through a protected administration interface. Providers receive the technical access necessary for their services, and administrative access is limited by purpose and permissions.

Hosting in Germany does not mean that all provider operations or operator access occur in the EEA. Where the GDPR or a comparable regime applies, transfers outside the relevant territory require an applicable legal mechanism, such as an adequacy decision or appropriate safeguards, including standard contractual clauses where required. You can request information about recipients and applicable safeguards. Ordinary enquiry consent is not separate permission for an unrestricted international transfer or a derogation from these requirements.

When enabled, Telegram sends the operator a notification containing a service reference and a link to the protected administrative record. The enquiry name, contact details, description and files are not included in that notification. Telegram is a separate platform whose infrastructure and rules differ from those of the website; an internal reference may remain linkable to an enquiry by the operator.

Access to enquiry content is restricted to the operator and authorised administration roles. Information may also be disclosed when required by a lawful request or applicable legal obligation. It is not sold or supplied for targeted advertising.

7. External links and YouTube

External links open services governed by their own privacy terms. If you choose to contact the operator through email or a messaging platform, that provider processes your communication under its own rules.

YouTube previews are served locally. Activating an embedded player connects your browser to Google and may disclose your IP address, browser information and the address of the current page. The privacy-enhanced player reduces personalisation but does not prevent all processing by Google. You can use the website without activating it. Google privacy information: https://policies.google.com/privacy.

8. Retention and deletion

Enquiries and their attachments in the website system are automatically deleted 180 days after receipt, irrespective of their status. They may be deleted earlier when their purpose is fulfilled or a valid request requires it, unless another lawful ground applies. Correspondence outside the form and documents subsequently created for a project are separate records, retained according to the ongoing discussion, the agreement, legal requirements and protection of rights. This does not extend the website enquiry retention period. Incomplete uploads expire after 30 minutes and unused files are removed through scheduled cleanup.

Processed raw analytics events are removed after 48 hours from aggregation. Daily aggregated reports are retained for 13 months. Lifetime article totals may be retained longer without browser or session identifiers. Cleanup runs through background jobs, which retry after a technical failure. Minimal records of security operations, consent and deletion are retained for necessary verification and protection of rights, without enquiry content or attachments.

Backups rotate on a 30-day schedule. The latest usable backup is retained until a replacement exists, so a backup copy can remain longer if replacement has not occurred. Backup access is restricted. An erasure ledger is applied after restoration to prevent deleted enquiries from becoming active again.

9. Your choices and rights

Contact [email protected] to request access, correction or deletion, ask about processing, or withdraw enquiry consent. Include information to locate the enquiry. Proportionate identity verification may be requested. Requests are handled within applicable legal periods; relevant restrictions or legal reasons for retaining information will be explained.

Where applicable law grants them, you may also request restriction or portability, object to processing and complain to a competent supervisory authority. Where the GDPR applies to a particular processing activity, this includes the authority in your country of habitual residence, place of work or an alleged infringement. Choosing a website language does not remove rights granted by applicable law.

Where the GDPR applies, requests are normally handled within one month. If a lawful extension is needed, its reasons and duration are communicated within the first month. A shorter mandatory period under another applicable law remains applicable.

The website does not sell personal data or use cross-site targeted advertising. Browser Do Not Track signals do not replace the website analytics choice; optional analytics remain subject to your permission in the website settings.

10. Security, children and changes

Technical and organisational measures include access restrictions, protected administrative authentication, restricted attachment access and upload checks. No online transmission or storage method can be guaranteed free of risk. If a personal-data incident occurs, notifications and other measures are taken where required by applicable law.

The website is intended for adults discussing professional projects. It does not intentionally request personal data from children. If you believe a child has provided information, contact the operator so that the circumstances can be assessed and the information removed where appropriate.

The date shown on this page identifies the current policy version. Changes are published here; processing for a new purpose or consent requirement will be communicated and additional consent obtained where required. Earlier information is not automatically subject to an unrelated new purpose merely because this policy changes.