Privacy policy
УкрVersion 1.0 · updated 2026-05-21 · part of the aiadvisoryboard.me ecosystem.
1. Who we are
The AI Experts Catalog is an internal platform of AI Advisory Board that helps companies find vetted AI implementation experts. The data controller is Yaroslav Maksymovych, sole proprietor (contact details below).
2. What data we process
Experts (profile): name, email (from Google SSO), social profiles (LinkedIn / Telegram / GitHub and similar, at your discretion), project descriptions, and rates. Legal basis: your consent and the performance of our offer agreement.
Clients (match request): company name, email, phone or Telegram, and a description of the task. Legal basis: your request and our legitimate interest in recommending a suitable expert.
Technical: IP address, user agent, and sign-in logs — used to prevent bot abuse, investigate fraud, and meet our GDPR obligations.
Page views and case-study link clicks: we record the fact that an expert page was opened (when, and where the visit came from — our catalog, a QR code, or a direct link), and when a visitor selects “See it live”, the fact of that click as well (which case study, and when), so that the expert can see which of their work gets opened. If you are signed in to the catalog at that moment (as an expert or an administrator), we also store who you are. Anonymous visitors remain anonymous: we use no fingerprinting and set no tracking cookies. Legal basis: the expert's legitimate interest in knowing whether their materials work. These records are deleted together with the expert profile (section 5).
3. How long we keep it
- Expert profile: until self-deletion, or 24 months of inactivity.
- Client requests: 24 months from creation, then anonymized automatically.
- Sessions: 7 days (JWT TTL), deleted automatically afterwards.
- Audit log (non-sensitive): 180 days.
- Audit log (sensitive — fraud, security): 180 days.
- Litestream backups: 7 days of rolling WAL and 7 days of snapshots.
4. Who we share it with (sub-processors)
Your data is processed only by the following services, and only to operate the platform:
| Service | Purpose | Location |
|---|---|---|
| Hetzner Cloud | Server and database hosting | Germany (EU) |
| Hetzner Object Storage | Encrypted SQLite backups | Germany (EU) |
| Google OAuth | Sign-in with a Google account | United States (Standard Contractual Clauses) |
| Cloudflare | DNS, CDN, and DDoS protection | Global (SCC) |
| Telegram Bot API | System notifications to the administrator | Netherlands / Dubai |
| LLM providers (Anthropic, OpenAI) | Structuring incoming requests (no personal data in prompts; free text is sanitized) | United States (SCC) |
| NVIDIA NIM | Machine translation of PUBLIC expert profile fields into English | United States (SCC) |
Machine translation. Text fields of a published expert page (headline, city, bio, engagement description, case-study titles and descriptions) are translated into English automatically by an LLM provider; non-public fields and contact details are never included.
5. Your rights (GDPR Art. 15-22)
- Access and export: your account → /me → “Export data” (re-authentication required; delivered as a JSON file).
- Deletion: /me/delete — we anonymize the profile (contacts are deleted; projects are kept without your name).
- Rectification: inline editing in /me.
- Complaint to a data protection authority: the Ukrainian Parliament Commissioner for Human Rights (Ukraine), or the relevant DPA in your country of residence.
6. Security
- HTTPS only, HSTS, secure cookies (__Host- prefix for admin sessions).
- Sessions can be revoked instantly by jti.
- AES-256-GCM for secrets at rest (TOTP secrets).
- Expert contacts are behind a reveal gate — a single-use email link valid for 24 hours, which protects against scraping bots.
- All destructive actions (export, deletion) require re-authentication within the last 5 minutes.
7. Contact
Email: ceo@aiadvisoryboard.me
Telegram: @YaroslavMaxymovych
We respond to data subject requests within 30 days (GDPR Art. 12 §3).