Privacy Policy

This policy explains what data DStudio receives about you when you use dstudio.com.ua, message our Telegram bots, order a voice review or interact with our Instagram and Facebook accounts: why we need it, who we share it with, how long we keep it and how to delete it.

1. Who is responsible for your data

ФОП Садченко Дмитро Анатолійович (sole proprietor Dmytro Sadchenko, brand DStudio).
Address: 9 Prorizna St, Hostomel, Bucha district, Kyiv region, 08290, Ukraine.
Data enquiries: info@dstudio.com.ua · Telegram: @dmitriy_sadchenko.

We process data in line with the Law of Ukraine “On Personal Data Protection” and, for visitors from the European Union, the EU General Data Protection Regulation (GDPR).

2. What data we receive and why

2.1. Website requests

Forms on the home page and on niche pages, the “Find a system” quiz, the developer application form.

• What: name, contact details (phone, e-mail or Telegram), business name and description, your message, answers to short questions (team size, when to start, budget).
• Automatically: IP address, browser type, the page the request was sent from, ad tags (utm, fbclid, gclid) — so we know where the request came from.
• Why: to reply to you and prepare a proposal. Legal basis: your request (you send the form yourself).

2.2. Business diagnostics

The “Where your money leaks” (/vytoky) and “Diagnostics” (/diagnostic) questionnaires.

• What: name, phone, optionally e-mail and company, answers about your business: niche, average order value, number of clients, working hours, staff costs, what holds growth back.
• Why: to work out where the business is losing money and send you the review. Answers are analysed by artificial intelligence (Google Gemini) and the result is checked by a person.

2.3. Paid voice review

• What: phone, language, name, company, business description, the recording and text transcript of your conversation with the voice assistant and, once you connect Telegram, your Telegram id and username.
• Payment: made on a Monobank page (АТ «Універсал Банк», Universal Bank JSC). The bank only receives the amount and the payment purpose. We never see your card details — the bank only sends us masked digits (the last 4 are visible) so you can restore access.
• Voice: the conversation is run by a voice assistant on the ElevenLabs platform (USA). ElevenLabs receives your voice and the context of the review; the language model behind the assistant is provided by an ElevenLabs partner (OpenAI or Google). Your summary is prepared by Google Gemini.
• Why: to carry out the review you paid for and send you the result. Legal basis: contract (see Terms of Use).

2.4. Telegram bots

@DStudioAI_Bot, @DS_AiBot, the /cabinet account area, AI review, business brief, gift for event participants.

• What: your Telegram id, name and username, your messages, answers to questions, voice messages and their transcripts, whether you are subscribed to our channel (for the gift).
• Why: to reply to you, prepare a review or brief and send you materials. Answers and voice messages are processed by Google Gemini. We see the conversation in our admin panel so we can continue it in person.
• Instagram gift: if you sent a code word in Direct, our messaging service (SendPulse) passes us your username and id so we can issue a personal link. The materials page sets a device cookie (no more than 3 devices per link).

2.5. Instagram and Facebook

• What: comments and messages you leave under our posts or send us in Direct: text, username, technical Instagram id, time.
• Why: if you sent a code word, we send the promised material to your Direct once; we answer your questions. This works through the official Meta API.
• Statistics for our posts (views, reach, saves) — aggregated figures only, with no data about specific people.

2.6. Finding requests in public Telegram groups

We look through public Telegram groups where business owners look for contractors (websites, CRM, automation) and save messages containing such requests: the text, group name, author's name and username, and a link to the message. We do not collect phone numbers. The message text (without name or id) may be assessed by artificial intelligence (Anthropic Claude) to tell whether it is a genuine request. We do not send mass messages: a person replies, and only to a specific request. Legal basis: legitimate interest. If you don't want your messages stored, write to us — we will delete them and stop storing them.

2.7. Visit statistics

• Our own counter: which page was opened, where the visit came from (domain only), utm tags, device type. IP is not stored: visitors are counted using an anonymised code that changes daily.
• Google Analytics 4 and the Meta pixel — only if you clicked “Accept” in the cookie banner (see section 4).
• Server logs (IP, time, page address, browser) — for security and troubleshooting.

2.8. Client systems

We build and maintain CRMs, websites and bots for clients. The data these systems collect (our clients' customers, orders and staff) belongs to the client — the client owns it and decides how it is processed. DStudio processes it only on the client's instructions, within the contract, and does not use it for its own purposes.

We do not sell personal data, do not share it for third-party advertising and do not send mass messages. Decisions affecting you are not made automatically: AI reviews are a suggestion, and a person makes the decision.

3. Who we share data with

Some services are located outside Ukraine and the EU (including in the USA). We choose services that use the EU Standard Contractual Clauses or equivalent data protection safeguards, and we share only what is needed for the specific task.

4. Cookies and similar technologies

On your first visit we show a banner. Until you click “Accept”, Google Analytics sets no cookies and the Meta pixel is not loaded. You can change your choice at any time using the “Cookie settings” link at the bottom of every page.

5. How long we keep data

• Requests, questionnaires, conversations with bots: while we are in contact or working together, plus 3 years after the last contact — for accounting and tax reporting. After that we delete or anonymise them.
• Voice messages and call recordings: up to 12 months.
• Payment data (amount, date, masked card digits): as long as tax law requires.
• Messages from public Telegram groups: up to 12 months or until you ask us to delete them.
• Instagram code word log: up to 12 months.
• Server logs: about 5 weeks. Backups: up to 14 days.
• Aggregated statistics (no personal data): no time limit.

6. Your rights

At any time you can:

• find out what data we hold about you and get a copy;
• correct inaccurate data;
• delete your data (see Data Deletion);
• restrict or object to processing, including processing based on legitimate interest;
• withdraw your cookie consent — this does not affect the lawfulness of processing before withdrawal;
• complain to the Ukrainian Parliament Commissioner for Human Rights or the data protection authority of your EU country.

Send requests to info@dstudio.com.ua. We reply within 30 days.

7. Security

The website works only over a secure connection (HTTPS). Service access keys are stored separately from the code and are never shared with third parties. Internal server folders and files are closed to access from the internet. Only the owner of DStudio has access to requests and conversations; developers and partners receive separate, limited access only to the projects they need.

8. Children

Our services are intended for business owners and companies. We do not knowingly collect data from children under 16. If you believe a child has sent us data, write to us and we will delete it.

9. Changes to this policy

If the policy changes, we will update this page and the date at the top. We will announce significant changes on the website.