Legal
Privacy Policy
This policy explains what personal data qaldy.com collects, why, where it is processed and how long we keep it. It covers the website, the AI assistant Qaldy and the project request form. It follows the Law of the Republic of Kazakhstan No. 94-V “On Personal Data and Their Protection” and, where it applies to you, the EU General Data Protection Regulation (GDPR).
Last updated September 24, 2026Policy version 2026-09-24.1
Draft under legal review. The wording may change before it is final.
Who is responsible
Qaldy AI, Astana, Republic of Kazakhstan (“Qaldy AI”, “we”, “us”) decides how and why your personal data is processed on this website. Under Law No. 94-V we are the owner and operator of the database; under the GDPR we are the controller.
You can reach us on Telegram at @tairqaldy, through WhatsApp from the Start a project page, or with the form on that page. We do not use email for privacy requests at the moment.
What we collect
- Conversations with Qaldy. When you talk or type to the assistant, we store the text transcript, a short summary, the detected conversation language, the time and length of the session, whether it was voice or text, and the results of automated safety checks (for example, whether a card number appeared). We do not keep recordings of your voice.
- Your project request. The details you check and confirm on the card or the form: name, company, role, email, phone, Telegram username, your problem and goals, current tools, budget range and timeline, plus a request code and your consent.
- Files. File uploads are switched off at the moment. If we switch them on, files are scanned for malware and kept in private storage; the retention rules below apply.
- Technical data. A salted one-way hash of your IP address and of your browser’s user agent (never the raw values), your country as reported by our hosting provider, the site language, the referring page and campaign (UTM) tags.
- Usage analytics, only if you allow them. Page views and how the assistant is used (for example, which suggested question you tapped). Without your permission we record only service events we need to run the site: a confirmed request, a click on a messenger button, and file upload results.
- Error reports. If something breaks, our error monitoring receives a technical report configured without IP addresses, cookies or request bodies.
Why we use it and on what basis
Where Law No. 94-V applies, we rely on your consent. You give it when you start a conversation with Qaldy (the notice under the assistant says so), when you tick “I agree to the Privacy Policy” on a request, and when you allow analytics in the cookie banner. You can withdraw consent at any time; this does not affect processing that already happened.
Where the GDPR applies, the legal bases are:
- answering you and preparing a proposal you asked for: steps at your request before a contract (Art. 6(1)(b)) and your consent (Art. 6(1)(a));
- usage analytics: your consent (Art. 6(1)(a));
- keeping the service secure, preventing spam and abuse (rate limits, bot protection, error monitoring): our legitimate interest in a safe service (Art. 6(1)(f));
- keeping records of consent and of requests: our legal obligations and legitimate interests (Art. 6(1)(c) and (f)).
We do not sell personal data, we do not use it for advertising, and we make no decisions with legal or similarly significant effects about you by automated means.
The AI assistant
Qaldy is an AI assistant, not a person. It answers from information we have approved and can still make mistakes. Its answers are not legal, financial or other professional advice. A member of our team follows up on requests personally.
The website is available in English and Kazakh. Qaldy replies in the language you use, including Russian and other languages it supports, and your conversation is stored in the language it took place in.
Please do not share passwords, bank card numbers, your IIN or other sensitive data in a conversation. Qaldy will not ask for them, and our automated checks flag them so we can delete them.
Who processes data for us, and where
We use the service providers below. They process data only on our instructions and under their data processing terms. Most of them process data outside Kazakhstan.
| Provider | What it does for us | Where |
|---|---|---|
| Vercel | Hosts and serves the website and its server functions | Frankfurt, Germany (company in the USA) |
| Railway | Hosts our database (conversations, requests, consents) | Amsterdam, the Netherlands (company in the USA) |
| ElevenLabs | Speech recognition, AI replies and the assistant’s voice; it uses AI model providers as its sub-processors | United States |
| Cloudflare | Bot protection (Turnstile) when it is switched on; file storage if uploads are switched on | Global network (company in the USA) |
| Telegram | Notifies our team about a new request: request code, language, company and the first 140 characters of the problem, with no contact details | Telegram’s infrastructure |
| PostHog | Usage analytics, only if you allow them | Frankfurt, Germany (EU Cloud) |
| Sentry | Error monitoring, without IP addresses, cookies or request bodies | United States |
When you press a Telegram or WhatsApp button, you continue in that app, and its own privacy policy applies to what you send there.
Cross-border transfers
Because the providers above are located or process data outside Kazakhstan, your personal data is transferred abroad, mainly to the European Union and the United States. By starting a conversation, sending a request or allowing analytics, you consent to this cross-border transfer in line with Article 16 of Law No. 94-V.
Where the GDPR applies, transfers outside the European Economic Area rely on an adequacy decision or on the providers’ Standard Contractual Clauses.
How long we keep data
| Data | How long |
|---|---|
| Conversations that did not lead to a confirmed request (transcript, summary, session data) | Deleted 180 days after the conversation |
| Confirmed requests and the conversation behind them | Until you ask us to delete them, or earlier once we no longer need them |
| Conversation data kept by ElevenLabs | Up to 30 days under our account settings |
| Recordings of your voice | Not stored |
| Files (if uploads are on) | Unfinished uploads 24 hours; files not linked to a confirmed request 30 days; files that fail the security scan are deleted at once |
| Usage analytics events | 400 days |
| Consent records | Kept as proof of consent; the IP hash in them is removed after 180 days |
| Rate-limit counters | 1 day |
| Error reports | Up to 90 days |
Your rights
You can ask us to tell you what data we hold about you and to give you a copy, to correct it, to delete it, to stop or limit processing, and to withdraw your consent. Where the GDPR applies, you can also object to processing based on legitimate interests and ask for your data in a portable format.
Write to us on Telegram at @tairqaldy or use the form on the Start a project page. If you have a request code (it looks like Q-XXXXXX), include it so we can find your data quickly. We may ask you to confirm it is you, and we answer within the time limits set by law.
To change your analytics choice, use “Cookie settings” at the bottom of any page.
You can also complain to the authorised body for personal data protection in Kazakhstan or, in the EU and EEA, to your local data protection authority.
How we protect data
All traffic is encrypted (HTTPS). Only our team can open the admin console, with individual accounts and passkeys. We store hashes instead of raw IP addresses, limit how often the assistant and the forms can be used, filter out automated spam, and delete data automatically when its retention period ends.
Children
This website is meant for adults contacting us about their business. It is not intended for people under 18, and we do not knowingly collect their data.
Changes to this policy
We version this policy. When we change it in a way that matters, we update the version and the date at the top, and the cookie banner asks for your choice again.