Privacy policy
Last updated 13 November 2026
1. Who we are
1.1 This policy covers vlad.devmand.com (the “site”): what personal data we collect, why, who receives it, how long we keep it and what rights you have.
1.2 Controller. The controller of your personal data is DEVMAND TECHNOLOGIES L.L.C, a limited liability company registered in the Emirate of Dubai, United Arab Emirates, commercial licence No. 1662945 issued by the Dubai Department of Economy and Tourism, commercial register No. 2948012, registered office at Office 304-075, Stadium Point, Al Hebiah Fourth, Dubai, United Arab Emirates (“we”, “us”). The site presents the work of Vladimir Skvortsov.
1.3 Contact. E-mail vlad@devmand.com and mark your message “Privacy”.
2. What we collect
2.1 When you ask for the free playbook: your e-mail address and, if you fill it in, a short answer to “What are you building?”.
2.2 When you send a request (the ProCode Extended waitlist, a consultation, an MVP build, fractional CTO support or an AI search pilot): your first and last name, country, e-mail address, what you tell us about your project, the confirmation that your project is not in an excluded area, and which request it is.
2.3 When you write to us: your e-mail address and what you write.
2.4 When you visit: technical data your browser sends, such as your IP address, browser and device type and the pages you request. Our server logs record requests without your name or e-mail address.
2.5 Bot protection: on our forms, Cloudflare Turnstile checks signals from your browser and device to tell people from automated programs. We receive only a pass or fail token.
2.6 Analytics: only as section 6 allows, Google Analytics measures which pages are visited and which forms are sent, and passes the forms sent after a visit from one of our ads to our Google Ads account, to see which ads help. Only if you press Allow, Google Ads also adds your browser, by Google’s cookie id, to lists of people who visited our pages, so we can show our ads again to them (remarketing). Google never receives what you type into a form, your name or your e-mail address. Only if you press Allow, the OpenAI ads pixel tells OpenAI when a form is sent, so we can see which of our ads in ChatGPT help. With it, it sends the e-mail address and, if the form asks for it, the first and last name you typed, each hashed: turned into a code that can’t be read back, which OpenAI matches against the details of its own users to tell which ad you saw. It never sends the rest of what you write.
2.7 Our own visit counts: which pages are viewed and which buttons are pressed, and the campaign tags (utm_*) of the link you came by. No cookie and no identifier: we can’t tell one visitor or visit from another. Your browser keeps the campaign tags in that tab only, until you close it, so a request you send in the same visit records which campaign brought it.
2.8 The confirmation of your request or sign-up: whether you opened it and which of its buttons you pressed, linked to your request. To see the opening, the e-mail loads a tiny invisible image from our site; the buttons pass through our site on the way to their page. Your e-mail program may load the image without you reading the e-mail, or block it; showing images is up to you. Nothing else reads your e-mail.
2.9 We do not ask for payment details on this site, and we do not knowingly collect sensitive data. Please don't include any in your project description.
3. Why we use it and our legal bases
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Sending you the playbook and the e-mail series that comes with it | 2.1 | Your consent, given when you sign up; you can withdraw it any time with the unsubscribe link (Art. 6(1)(a)) |
| Answering your request, booking a call, telling you when the course opens | 2.2, 2.3 | Steps you ask for before a possible contract, and our legitimate interest in replying (Art. 6(1)(b) and (f)) |
| Counting which pages, buttons and campaigns help | 2.7 | Our legitimate interest in knowing what works, with no identifier and nothing shared (Art. 6(1)(f)) |
| Seeing whether our confirmations arrive and help | 2.8 | Our legitimate interest in knowing that our e-mails reach you and which links are useful (Art. 6(1)(f)); you can object any time, or turn off images in your e-mail program |
| Keeping the site secure and the forms free of spam | 2.4, 2.5 | Our legitimate interest in protecting the site (Art. 6(1)(f)) |
| Understanding which pages and ads help, as section 6 allows | 2.6 | Your consent; in the regions in section 6.2 where measurement is on by default, our legitimate interest in knowing what works (Art. 6(1)(a) or (f)) |
| Showing our ads again to people who visited (remarketing), and measuring our ads in ChatGPT | 2.6 | Your consent, given by pressing Allow; you can withdraw it any time with “Cookie settings” (Art. 6(1)(a)) |
| Complying with the law, handling legal claims | any | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) |
3.1 We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell it.
4. Who receives it
| Who | What for |
|---|---|
| Cloudflare | Delivering and protecting the site (DNS, content delivery, firewall) and Turnstile bot protection. Traffic between your browser and the site passes through Cloudflare. |
| Google Cloud | The servers and database that run the site and store requests, in the European Union. |
| Resend | Sending our e-mails: the playbook, its e-mail series and the confirmation of your request. |
| Telegram | Our notice that a request or sign-up arrived, with what you sent in it (2.1, 2.2), in a private chat only we read. |
| Google Workspace | Our mailbox, which receives your e-mails. |
| Google Analytics | Measuring visits, only as section 6 allows. |
| Google Ads | Measuring our ads, from what Google Analytics passes to it (2.6), and, if you press Allow, keeping the lists of visitors we show our ads to again. Only as section 6 allows. Google's own privacy policy applies to what it does with that data. |
| OpenAI | Measuring our ads in ChatGPT, only if you press Allow: that a form was sent, with your e-mail address and name in hashed form (2.6). OpenAI's own privacy policy applies to what it does with that data. |
| Calendly | Booking a consultation, if you choose to book. What you enter there is covered by Calendly’s own privacy notice. |
| GitHub | Hosting the playbook. When you open it, GitHub’s privacy statement applies. |
| YouTube | Playing our videos. Nothing loads from YouTube until you press play; from then on, Google’s privacy policy applies. When you watch our videos on YouTube itself, Google may let us show our ads to people who watched them; Google keeps those lists under its own privacy policy and shows us only how many people are in them. |
4.1 These providers act on our instructions, except where the table says their own notice applies. We may also disclose data where the law requires it.
5. International transfers
5.1 We are based in the United Arab Emirates, and some providers above process data outside your country, including in the United States. Where data leaves the European Economic Area or the United Kingdom, we rely on an adequacy decision or on the European Commission’s standard contractual clauses that these providers offer.
6. Cookies
6.1 The brand_consent3 cookie keeps your answer to the cookie banner for a year. It is needed for the banner to work.
6.2 Google Analytics cookies (_ga, _ga_*, kept up to two years) are set only after you press Allow. In the United States, Canada outside Quebec and Australia, measurement is on until you press Decline; everywhere else it is off until you press Allow. A Global Privacy Control signal from your browser counts as Decline. When you arrive from one of our ads, Google Ads cookies (their names begin with _gcl_, kept up to 90 days) follow the same rules. Advertising personalisation, including remarketing (2.6), stays off everywhere unless you press Allow. The OpenAI ads pixel loads only after you press Allow, in every region; its cookies (__oppref, which ad brought you, kept 30 days, and __obref, a random id for this browser, kept a year) go when you press Decline.
6.3 Turnstile may store what it needs on your device to run its check, for security only.
6.4 YouTube (privacy-enhanced mode) may store what its player needs on your device once you press play on one of our videos. Before that, the page shows only our own copy of the video’s cover.
6.5 Campaign tags (section 2.7) sit in your browser tab’s session storage, not in a cookie, and go when you close the tab. They carry no identifier.
6.6 You can change your answer at any time with “Cookie settings” at the bottom of every page, or by deleting cookies in your browser.
7. How long we keep it
- Requests and your e-mails: up to 24 months after our last contact, unless we start working together; then as long as the contract and the law require.
- Playbook sign-ups: until you unsubscribe. After that, only your e-mail address stays on a do-not-email list, so we don’t write to you again.
- Server logs: 30 days.
- Backups: up to 14 days, then overwritten.
- Google Analytics data, our visit counts, and the openings and button presses of our e-mails: 14 months.
- Remarketing lists in Google Ads: a browser leaves a list at most 540 days after its last visit, or when you press Decline under “Cookie settings”.
8. Your rights
8.1 You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time; this doesn’t affect what we did before.
8.2 To use any of these rights, e-mail vlad@devmand.com. We answer within 30 days and may ask you to confirm it is you.
8.3 You can also complain to the data protection authority where you live or work. If you are in the United Arab Emirates, the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) gives you similar rights.
9. How we protect it
9.1 Data travels encrypted, the database is private and encrypted at rest, access is limited to the people who need it, and our logs leave out names and e-mail addresses.
10. Children
10.1 The site is meant for adults building products and businesses. We don’t knowingly collect data from anyone under 16; if you think we have, write to us and we will delete it.
11. Changes
11.1 We will post any change here with a new date at the top. If a change matters for what you agreed to, we will tell you by e-mail.