Pilot & Demo Data Handling Policy

1. Introduction

Dmytro Belykh (hereinafter "Benedict Corp.") respects your privacy and is committed to protecting your personal and enterprise information.

This document outlines how data is collected, processed, stored, and handled during pilot programs and demonstration sessions of solutions developed by Benedict Corp., including but not limited to:

• Benedict Finance
• other Benedict Corp. software, including products in development
• related tools and prototypes

This policy applies specifically to non-production environments used for testing, evaluation, and demonstration purposes.

This Policy covers three different things, which should not be confused: hosted public demo environments, dedicated customer-specific pilots, and the browser-only interactive demo of Benedict App. The browser-only demo is described separately in Section 1A. Benedict App's internal evaluation environment, which is not available to anyone outside Benedict Corp., is described in Section 1B for clarity. Everywhere else in this Policy, "demo environment" means a hosted public demo environment.

It does not apply to production deployments in a customer's own Microsoft 365 tenant or Azure subscription, or to software that runs on a customer's own devices. Those are covered by the Terms of Use and the Privacy Policy.

Pilot and demo environments serve different purposes and operate under different conditions.

Pilot environments are:

• provisioned for a specific client or organization
• access-restricted to authorized participants
• intended to simulate real usage scenarios
• more controlled in terms of data access and visibility

Demo environments are:

• shared across multiple users and organizations
• not restricted to a single client
• intended for general product evaluation and demonstration
• not isolated between users

As a result, demo environments provide a lower level of data isolation compared to pilot environments.

This Policy applies when you take part in a demo or pilot session of Benedict Corp. solutions. Contractual terms for a pilot are agreed with the participating organization; information about personal data processing in this Policy is provided for transparency and does not depend on your agreement.

1A. Browser-Only Interactive Demo (Benedict App)

Separately from the hosted public demo environments and dedicated pilots covered by the rest of this Policy, Benedict Corp. offers the Benedict App interactive demo at app.benedictcorp.store, a browser-only demo. It is a set of static files that run entirely in your own browser, using fictional people, clients, projects, and amounts. It is not a hosted environment and not a pilot, and the sections of this Policy about shared environments, pilot data, and processor obligations do not apply to it.

Customer-specific pilots are different: they are dedicated environments prepared for one organization and are covered by Sections 3, 7, 8, 10, and 11.

What the Demo Does With What You Enter

All inputs are optional and only personalize the demo on your own screen: a display name (up to 60 characters; "Alex Taylor" is used if left blank), an hourly rate and currency (120 EUR by default), a starting role (User, Team Lead, or Admin; Admin by default), and the time entries, descriptions, edits, and timer details you create while exploring. None of it is sent to Benedict Corp., Microsoft, or anyone else. The demo uses a fixed placeholder email address (you@example.com).

You can type anything into free-text fields, and the demo cannot stop you from entering real personal details. Please do not enter real personal or confidential information. Even then, it stays on your device.

Export buttons download pre-built sample files. They never contain your name or your changes.

Where It Is Stored and For How Long

The demo uses two standard browser storage areas on your own device. Both belong to the demo's own web address only, and their contents are not sent to Benedict Corp.:

• Session storage holds your details, the fictional dataset, and your changes. It survives a page refresh, each tab has its own copy, and it normally ends when you close the tab — but a browser that restores your previous session may restore it too. Reset demo clears it.
• Local storage holds a running or stopped timer (project, description, start and stop time) until you save or discard the entry, start the demo again, press Reset demo, or clear your browser's site data. It can remain after the tab is closed.

So closing the tab normally removes your session data, unless your browser restores the session, and does not remove a saved timer. Reset demo clears both. If your browser blocks storage, the demo runs in memory only and everything is gone when the page closes. Nothing is synchronized between devices or tabs.

What Microsoft Processes

The demo's files are delivered by Microsoft Azure Static Web Apps (Free plan; the resource is in the West Europe region, and Microsoft may also deliver static files from other locations). Microsoft's servers handle standard connection data — your IP address, browser and device type, the address requested, and the time — to deliver the files and protect the service, under Microsoft's own terms and privacy statement. As of 17 October 2026 no Application Insights or other monitoring is connected and no diagnostic settings or log export are enabled, so Benedict Corp. does not collect or keep request logs for the demo. The demo has no application backend: no server-side code, API, or database.

What the Demo Does Not Use

• Cookies, analytics, tracking pixels, advertising, or session recording.
• Third-party resources: fonts, images, and scripts are served from the demo's own address.
• Sign-in or accounts, or forms that submit data to any address.
• Camera, microphone, location, or payments.
• Referrer information: the demo sends none to other sites.
• Real customer data: the demo never connects to the real Benedict App, its API, or its databases.

If the demo changes in any of these respects, this Policy and the Privacy Policy will be updated before the change is released.

The User, Team Lead, and Admin roles in the demo are simulated in your browser. Switching role is not a security boundary and gives no access to any real Benedict App system.

1B. Benedict App Evaluation Environment

Benedict App also has an internal evaluation environment: a non-production installation of the full application, with Microsoft sign-in, server-side logic, and a database holding test records. Benedict Corp. uses it for development and testing. People outside Benedict Corp. are not given access to it, and it is separate from the browser-only demo in Section 1A and from any customer's own installation.

Evaluation with an organization's own data is arranged as a dedicated pilot, not in the evaluation environment.

2. Purpose of the Demo

Demo environments are made available to demonstrate the features, user experience, and overall capabilities of Benedict Corp. solutions.

Access to demo environments may be shared across multiple users, organizations, or potential clients and is not restricted to a single entity. The demo environment is a shared, non-production environment intended solely for evaluation purposes.

Users should not treat demo environments as secure or isolated environments.

3. Purpose of the Pilot

Pilot environments are provided to:

• evaluate usability and functionality
• validate workflows and reporting accuracy
• test system performance under real-life scenarios
• collect feedback for further development

Pilot environments are not intended for production use. Pilot environments are provided on a per-customer basis, and data in such environments is accessible only to the customer's users and Benedict Corp. personnel responsible for development, maintenance, and support.

4. Data Collected

During pilot usage, the following types of data may be collected:

• personal data such as full name, business email, and phone number (for contacting during the pilot/demonstration)
• user-provided inputs (e.g., time logs, descriptions, comments)
• project and task-related data
• organizational structure references (e.g., projects, clients, entities)
• system-generated data (e.g., timestamps, calculated metrics, KPI values)

Benedict Corp. does not intentionally collect sensitive personal data unless explicitly required and agreed in advance.

5. Data Usage

Collected data is used exclusively for:

• operating and demonstrating the functionality of the solution
• generating reports, dashboards, and analytics
• testing integrations and workflows
• improving performance, usability, and system design

Data is not used for marketing, resale, or unrelated purposes.

6. Data Storage and Processing

Pilot data is stored in a controlled environment managed by Benedict Corp., typically using Microsoft 365 services, including:

• SharePoint
• Power Apps
• Power Automate
• Power BI

Data may be processed within these systems to support application functionality. Microsoft, as the underlying cloud infrastructure provider, acts as a sub-processor for any personal data processed within these services, under Microsoft's own data processing terms.

7. Data Access

Access to pilot data is restricted to:

• authorized participants involved in the pilot
• Benedict Corp. personnel responsible for development, maintenance, and support

Access is granted on a need-to-know basis and may be centrally managed during the pilot.

Access to demo environments is not restricted and may be granted to any user. Users must not upload or enter sensitive, confidential, or privileged information into a shared demo environment. To the extent permitted by applicable law, Benedict Corp. is not liable for loss or damage resulting from information a user enters contrary to this instruction, including its visibility to other users of the same environment. This does not exclude or limit liability that cannot be excluded or limited by law — including for damage caused intentionally or through gross negligence, for death or personal injury, or for Benedict Corp.'s own obligations under the GDPR, such as security of processing and the handling of personal data breaches — or any mandatory consumer rights.

8. Data Retention and Deletion

Pilot data is temporary.

• At the end of a pilot, pilot data is deleted or returned as agreed with the participating organization, unless retention is required by law.
• Benedict Corp. does not retain pilot data for long-term storage or reuse.
• Participants may request deletion of pilot data at any time.

Demo Data

Benedict Corp. will take reasonable steps to remove data entered during demo sessions after their completion. We do not promise that demo data is removed immediately or automatically after each session. Due to the shared nature of demo environments, such data may be visible to other users while it remains in the environment.

Service logs kept by Microsoft's own platforms are subject to Microsoft's retention practices and are outside our control.

9. Participant Responsibilities

Participants are responsible for:

• ensuring that no highly sensitive or confidential data is entered unless explicitly agreed
• using the system strictly for evaluation purposes

Pilot environments should not be used for:

• production operations
• legally binding or critical reporting

10. GDPR and Data Protection

Benedict Corp. is committed to handling data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).

During pilot and demo usage:

• data is processed on a limited, purpose-specific basis
• only data necessary for evaluation and testing is collected
• access to data is restricted and controlled where applicable

In pilot environments:

• data is typically isolated per client or testing group
• Benedict Corp. acts as a data processor, while the participating organization remains the data controller, with respect to any personal data the organization submits into the pilot environment for processing on its behalf

In demo environments:

• environments may be shared across multiple users and organizations
• data entered during demo sessions may be visible to other users within the same environment
• demo environments are not intended for processing personal or sensitive data

Participants are responsible for ensuring that no sensitive personal data is entered into demo environments.

Benedict Corp. will take reasonable steps to delete data after the completion of pilot or demo sessions, unless otherwise agreed.

Participants have the right to:

• request access to their data
• request correction or deletion
• raise concerns regarding data handling

11. Processor Obligations During Pilots

Where Benedict Corp. processes personal data on behalf of a participating organization during a pilot, the binding processing terms required by Article 28 of the GDPR will include at least the following obligations. Benedict Corp.:

• processes personal data only on the documented instructions of the participating organization, including with regard to any pilot-specific purpose agreed with that organization
• ensures that any personnel authorized to process the data are subject to confidentiality obligations
• takes appropriate technical and organizational measures as described in Section 12
• engages Microsoft as a sub-processor for underlying cloud infrastructure, under Microsoft's own data processing terms, and will not otherwise engage a sub-processor without informing the participating organization
• assists the participating organization, where reasonably possible, in responding to data subject requests and in meeting its own obligations under Articles 32 to 36 of the GDPR
• deletes or returns pilot data at the end of the pilot, as described in Section 8, unless retention is required by law
• makes available to the participating organization the information reasonably necessary to demonstrate compliance with this section

Before Benedict Corp. processes any personal data on a participating organization's behalf in a pilot, appropriate binding processing terms that meet Article 28 of the GDPR must be in place with that organization. This does not depend on the sensitivity or scale of the data. This Policy describes the substance of Benedict Corp.'s role, but it is not by itself a complete data processing agreement and does not replace one.

A software license that covers a group of companies does not by itself put processing terms in place for each company in that group; binding processing terms are agreed with each organization on whose behalf personal data is processed.

12. Security Measures

Reasonable technical and organizational measures are implemented to protect data within pilot and demo environments, including:

• access controls
• role-based permissions
• secure Microsoft cloud infrastructure
• restricted administrative access

In pilot environments:

• access is typically limited to authorized users within a defined testing group
• additional controls may be applied depending on the scope of the pilot

In demo environments:

• environments may be shared across multiple users and organizations
• access controls may be limited due to the shared nature of the environment

Accordingly, demo environments are not intended for storing or processing sensitive or confidential information.

While Benedict Corp. applies reasonable security measures, pilot and demo environments may not reflect full production-grade security configurations.

13. Pilot & Demo Limitations

During the pilot and demo phase:

• certain features (e.g., automation, reporting, integrations) may be partially restricted
• some processes may be centrally executed by Benedict Corp.
• performance may vary depending on test conditions

These limitations are part of the evaluation process.

14. Transition to Production

In a full production deployment:

• the solution is installed in the client's own environment — a Microsoft 365 tenant or Azure subscription for web-based products, or the client's own devices for desktop software
• production data remains under the client's control
• full functionality, automation, and security configurations are enabled

15. Support and Authorized Access

Benedict Corp. does not access a customer's production environment, data, or devices as part of normal operation.

Support or implementation that needs access — for example a screen-sharing session, a temporary guest or administrator account, or a copy of a configuration — happens only when the customer explicitly authorizes it, for the purpose and period the customer agrees. We access only what is necessary for that purpose and act on the customer's instructions, and the customer may withdraw its authorization at any time.

Where such access involves personal data processed on the customer's behalf, Benedict Corp. acts as a processor, and binding Article 28 processing terms must be in place before that processing begins (see Section 11).

16. Contact

For any questions regarding this policy or data handling practices, or to arrange the processing terms for a pilot, please contact:

info@benedictcorp.com