Privacy & Cookie Policy

1. Introduction

Dmytro Belykh, trading as Benedict Corp. ("we", "our", "us"), respects your privacy and is committed to protecting your personal information.

This Privacy & Cookie Policy explains how we collect, use, and safeguard your data when you visit our website (https://benedictcorp.com), buy or use our software, or take part in demos or pilots (collectively, the "Services").

This Policy provides information about how personal data is processed. Where consent is required, we request it separately; visiting the website or submitting a form does not by itself constitute consent to optional processing.

2. Who We Are

Dmytro Belykh, an individual activity holder in the Republic of Lithuania, trading under the brand name "Benedict Corp." Benedict Corp. is a trading name only — it is not a separate incorporated company or legal entity.

• Legal name: Dmytro Belykh
• Trading name: Benedict Corp.
• Individual Activity Certificate No.: 1459602
• VAT ID: LT100020794610
• Correspondence address: Skroblu st. 14-21, Vilnius, LT-03142, Lithuania

Contact: info@benedictcorp.com

Website: https://benedictcorp.com

We build and distribute digital solutions based on Microsoft technologies.

Our website is hosted on Microsoft Azure Static Web Apps. Hosted public demo environments and dedicated pilots, where we provide them, are operated within our Microsoft 365 tenant. Benedict App's evaluation environment runs in our own Azure environment and is used only internally (see Section 3(c)), and the Benedict App interactive demo at app.benedictcorp.store is separate from both (see Section 3(d)).

Roles at a Glance

The table below summarizes who decides how data is used in each situation. The sections that follow give the detail.

3. What Personal Data We Collect

We collect only the minimum information required to provide and improve our services.

a) Website Contact Form

When you submit our contact form, we collect the information you provide — your name, email address, company name (optional), and your message — for the purpose of responding to your inquiry, providing information, or scheduling a demo.

Submitting the form also involves the following technical processing, described in more detail in Section 4:

• A verification check (Cloudflare Turnstile) to confirm the submission is not automated.
• Short-term storage of a pseudonymised (keyed-hash) form of your IP address to limit repeated submissions; your raw IP address is passed to Cloudflare for the verification check but is not stored by us.

b) During Sales or Purchase

When you purchase a product or service, or enter into a contractual engagement with us, we may collect:

• Full name
• Company name
• Email address
• Billing address
• Bank transfer details (if you pay by bank transfer)
• Tax or business registration information

This information is kept in our business and accounting records, which we use to manage client relationships, licenses, and invoicing.

It is used solely for:

• Contract execution and license management
• Issuing invoices and maintaining accounting records
• Providing client support and updates

Accounting documents — such as invoices, payment records, and the documents supporting them — are kept for 10 years, as required by Lithuanian accounting and record-keeping rules. Other records in this category, such as correspondence, contracts, and license records, are kept for the periods set out in Section 9.

We do not share this information with third parties other than payment processors (including Paddle, for Benedict Invoice purchases processed through it), accounting partners, or where legally required.

Purchases Through Paddle (Benedict Invoice)

Benedict Invoice is the only product we sell through Paddle, which acts as Merchant of Record. When you buy Benedict Invoice through Paddle, Paddle, not Benedict Corp., collects your payment and billing details, calculates and remits sales tax, and issues your receipt. Paddle is a controller of that data under its own privacy policy: Paddle Privacy Policy.

Paddle may share with us the information that is necessary to provide the product you ordered (typically contact and order details). We do not receive your full payment card details. We use what we receive to deliver and license the product, provide support, keep accounting records, and meet legal obligations.

Benedict Invoice purchases through Paddle are also governed by Paddle's Buyer Terms and Refund Policy, together with our Terms of Use and Refund Policy.

Our other products and services — Benedict App, Benedict Finance, custom development, implementation, consulting, and support — are sold directly by us under an agreed order or contract and invoice, as described in (b) above.

Licensing and Desktop Software

Desktop software operates locally on your device. If a product includes license activation, update checks, or other optional online features, its product page will say so, and this Policy will describe the data involved before that product is released.

c) Pilot & Demo Testing and Trial Access

If you take part in a hosted public demo or a dedicated pilot of our applications (this does not describe the browser-only interactive demo, which is covered in (d) below):

• You connect to an environment that we host in our own Microsoft 365 tenant.
• Your Microsoft account information (name, email, organization) and activity logs may be collected automatically by Microsoft for security and performance monitoring.

This data is processed for demonstration purposes. We take reasonable steps to remove data entered into demo environments after demos, and to delete or return pilot data at the end of a pilot, as described in the Pilot & Demo Data Handling Policy. We do not promise that demo data is removed immediately or automatically after each session, so please do not enter personal or confidential data into a demo.

Benedict App's evaluation environment is an internal, non-production installation of the full application that Benedict Corp. uses for development and testing, with test records. People outside Benedict Corp. are not given access to it. It is separate from the browser-only interactive demo described in (d) and from any customer's own installation.

d) Benedict App Interactive Demo (Browser-Only)

The Benedict App interactive demo at app.benedictcorp.store lets you try Benedict App with fictional data, without registering or signing in. It is a set of static files with no application backend, database, sign-in, cookies, analytics, or third-party services of its own, and it is separate from the hosted public demo, pilot, and evaluation environments described in (c).

Anything you choose to enter — a display name, an hourly rate and currency, a starting role, time entries and descriptions, or timer details — is processed only in your own web browser. It is all optional, none of it is sent to Benedict Corp., Microsoft, or anyone else, and we do not receive or access it. The demo uses a fixed placeholder email address (you@example.com) and makes no use of a real email address.

The demo keeps this in your browser, on your device, in two standard storage areas. Both belong to the demo's own web address only, and their contents are not sent to us:

• Session storage holds your details, the fictional dataset, and your changes. It survives a page refresh, is separate in each tab, and normally ends when you close the tab — but if your browser restores your previous session (for example when reopening a closed tab or after a restart), it may restore this data too. Choosing Reset demo clears it.
• Local storage holds a running or stopped timer (project, description, start and stop time). It stays until you save or discard the timer entry, start the demo again, press Reset demo, or clear your browser's site data. It can remain after you close the tab.

If your browser blocks storage (for example in some private modes), the demo runs in memory only, and everything is gone when the page closes. Nothing is synchronized between devices or between tabs.

The demo's export buttons download pre-built sample files. They do not contain your name or any change you made.

The User, Team Lead, and Admin roles in the demo are simulated in your browser. Switching role gives no access to any real Benedict App system.

You can type anything into free-text fields, and the demo cannot stop you from entering real personal details. Please do not enter real personal or confidential information. Even if you do, it stays on your device.

Separately from what you type, the demo's files are delivered by Microsoft Azure Static Web Apps. The Azure resource is in the West Europe region; Microsoft may also deliver static files from other locations. As with any website, Microsoft's servers handle standard connection data — such as your IP address, browser and device type, the address requested, and the time — to deliver the files and protect the service, under Microsoft's own terms and privacy statement. We have not enabled request logging, monitoring, or log export for the demo (checked 17 October 2026), so we do not collect or keep request logs for it.

The demo sets no cookies; see the Cookie Policy for the storage it uses. Because the demo runs on its own domain, cookies from benedictcorp.com are not sent to it. This section describes the demo as it works at the effective date above.

4. Technical Data, Contact Form Security, and Data Flow

Our website uses limited technical processing to operate and protect the contact form, which applies regardless of your cookie choices and is described below. Optional analytics (Microsoft Clarity) and advertising measurement (Google Ads) are used only according to the choices you make in the cookie banner; they are described in Section 13 and in our Cookie Policy. Neither tool is loaded until you opt in to its category.

a) Hosting

Our website is hosted on Microsoft Azure Static Web Apps. The Azure resources used for the website are configured in European regions where applicable. Microsoft may deliver static content through its global infrastructure and may process technical connection data in accordance with its applicable terms. This statement is not a guarantee that every network request or technical processing operation remains exclusively within the European Union.

b) Spam and Bot Protection (Cloudflare Turnstile)

Our contact form uses Cloudflare Turnstile to verify that a submission comes from a real visitor rather than an automated script.

• Turnstile may use cookies or similar browser storage on your device as part of this verification, for the security purpose of assessing the submission. See the Cloudflare Privacy Policy for details.
• As part of this verification, Cloudflare receives your IP address to assess the request. We do not store this raw IP address ourselves — see below.
• Cloudflare processes this data under its own privacy policy: Cloudflare Privacy Policy.

c) Rate Limiting and IP Address Handling

To prevent abuse of the contact form (e.g. automated flooding), our system temporarily records submission attempts. Rather than storing your IP address directly, we store a keyed one-way hash of it (an HMAC with a secret key) — a value from which your IP address cannot practically be recovered without that key.

• This keyed hash (HMAC), together with a timestamp, is stored in Azure Table Storage in Microsoft's Sweden Central region (locally redundant storage, with no secondary region).
• It is used solely to detect and limit an unusually high number of submissions from the same origin within a short window.
• This data is automatically deleted, typically within 24 hours of being recorded. In periods of very low website traffic, deletion may occasionally take somewhat longer, since cleanup runs as part of normal form processing rather than on a separate fixed schedule.

d) How a Submission Is Processed (Data Flow)

When you submit the contact form, your information (name, email, company, message) is sent to an Azure Function that runs as part of our Azure Static Web App, configured in Microsoft's West Europe region. After the security checks described above, your submission is forwarded over an encrypted (HTTPS) connection, which our flow accepts only with a shared secret, to a Microsoft Power Automate flow, which:

• Creates a corresponding record in a SharePoint list used internally to manage inquiries; and
• Sends an email notification to us, and an automatic confirmation email to you.

Power Automate and SharePoint operate within our own Microsoft 365 tenant, subject to Microsoft's own data processing and retention practices, including the standard operational logging Microsoft applies to flow runs. See Microsoft's Privacy Statement.

5. How We Use Your Data

We use your data to:

• Respond to inquiries and schedule demos
• Provide and maintain our products and services
• Manage licenses, billing, and accounting
• Communicate about updates, releases, or technical support
• Ensure system security, prevent misuse, and comply with legal obligations

We do not sell or rent personal data.

6. Marketing and Business Communication

We send direct marketing by email, text message, or other electronic communications only where the law that applies to the recipient allows it.

• Individuals (natural persons), including sole traders and individual activity holders: we contact you for direct marketing only with your prior consent or, if you are our customer, about our own similar products or services — in which case you can refuse when we collect your email address and in every message.
• Legal entities in Lithuania: under Article 81 of the Law on Electronic Communications of the Republic of Lithuania, as amended with effect from 22 April 2026, direct-marketing messages to a subscriber or registered user that is a legal entity do not require prior consent, provided every message offers a clear, free, and easy way to opt out. According to the State Data Protection Inspectorate's guidance, this also covers a company's general and named work email addresses and work phone numbers, and an opt-out may come from the company's manager or from the employee the contact belongs to.
• Recipients outside Lithuania: the rules differ from country to country, and many require prior consent even for business recipients. Lithuanian law does not by itself make outreach to recipients in other countries lawful; when we contact recipients elsewhere, we follow the rules that apply to them.

Every marketing message identifies Benedict Corp. as the sender and includes a free way to opt out. If you or your organization opt out — by replying "unsubscribe" or emailing info@benedictcorp.com — we stop without undue delay and keep a record of the opt-out so that you are not contacted again. Where business contact details identify a person (for example a named work email address), they are personal data and the GDPR also applies, including your right to object to direct marketing at any time.

We do not sell or share contact data for marketing purposes.

7. Business Outreach

From time to time, we may contact potential business clients using business contact information that is publicly available (such as a company website, a public business register, or a professional profile such as LinkedIn) to introduce products or services relevant to the recipient's professional role, within the rules described in Section 6. We rely on our legitimate interest in business development (Article 6(1)(f) GDPR) only where the applicable electronic-communications rules do not require prior consent. Our first message identifies us, explains where we obtained the contact details, and links to this Policy. Recipients can object at any time by replying "unsubscribe" or emailing info@benedictcorp.com.

8. Legal Basis for Processing (GDPR)

The legal basis depends on the specific activity:

This table does not replace the separate requirement to obtain consent for non-essential cookies and similar technologies, which we request through the cookie banner (see Section 13). Information on transfers of personal data outside the European Economic Area is in Section 10.

9. Data Retention

• Ordinary website inquiries (contact-form submissions: name, email, company, and message): kept in our SharePoint inquiry list for up to 12 months from submission, then deleted. An inquiry that leads to a contract is kept with the related contract records instead (see below).
• Hashed IP addresses used for rate limiting: typically deleted within 24 hours, as described in Section 4(c).
• Accounting documents (invoices, payment records, and their supporting documents): for the period required by applicable Lithuanian accounting and record-keeping rules, which is 10 years.
• Contracts, orders, license records, and correspondence associated with a completed transaction or contract: for as long as necessary to administer the contract, verify perpetual license entitlements, provide agreed services, meet legal obligations, and establish, exercise, or defend legal claims.
• Other copies: deleting an inquiry from our list does not instantly remove every copy. Deleted list items can remain in Microsoft 365's recycle bins and backups for a limited period under Microsoft's standard retention before they are permanently removed, and copies of an inquiry can also exist in our email mailbox — the notification we receive and any correspondence with you. We keep mailbox copies only as long as needed to handle your inquiry and any follow-up, and do not use these copies for any other purpose.
• Records of marketing opt-outs: kept for as long as needed to make sure we do not contact you again.
• Hosted demo and pilot environment data: handled as described in the Pilot & Demo Data Handling Policy. We do not promise automatic deletion after each demo session.
• Browser-only interactive demo: we hold no demo data. What you enter stays in your browser's storage for the periods described in Section 3(d).

10. Data Sharing and Transfers

We may share limited data with the following providers:

• Microsoft Corporation — for website hosting (Azure), Power Automate, SharePoint, and hosted public demo environments;
• Paddle — where a Benedict Invoice purchase is processed through Paddle as Merchant of Record (see Section 3);
• Google (Google Ireland Limited and Google LLC) — for Google Ads conversion measurement, only if you accept Marketing (see Section 13);
• Microsoft Clarity (operated by Microsoft Corporation) — for session analytics, only if you accept Analytics cookies (see Section 13);
• Cloudflare, Inc. — for contact form spam/bot protection (Turnstile);
• Stripe, LLC — for payment processing, including voluntary contributions;
• Other payment processors or accounting partners, as required by law;
• Legal authorities, when necessary for compliance.

Their roles depend on the service:

• Microsoft (Azure hosting, Power Automate, SharePoint, and the hosted public demo environments) processes data on our behalf as a service provider, under Microsoft's own data protection terms.
• For the browser-only interactive demo we receive no data. Microsoft's hosting servers handle standard connection data (IP address, browser and device type, address requested, time) under Microsoft's own terms and privacy statement.
• Paddle acts as a controller for the payment, billing, and tax data it collects as Merchant of Record, and shares with us what is necessary to provide the product you ordered.
• Google (Google Ads) receives data only if you accept Marketing, and Microsoft (Clarity) only if you accept Analytics. They process it under their own terms and policies and may use some of it for their own purposes — see their privacy information below.
• Cloudflare (Turnstile) processes data to assess whether a form submission is automated, under its own privacy policy.
• Stripe processes data under its own privacy policy for the payments and contributions that take place on its service.

Their privacy information:

• Microsoft Privacy Statement
• Paddle Privacy Policy
• Google Privacy Policy
• Microsoft Clarity Privacy
• Cloudflare Privacy Policy
• Stripe Privacy Policy

We do not control how these providers run their own services; where a provider acts as a controller, its own policy governs that processing.

International Data Transfers

Some of these providers are established, or process data, outside the European Economic Area (EEA). Where personal data leaves the EEA, the transfer relies on a mechanism under Chapter V of the GDPR, as set out in each provider's own data protection terms:

You can ask us at info@benedictcorp.com for more information about these safeguards.

Customer-Hosted and Desktop Software

When Benedict Corp. software is deployed into a customer's own Microsoft 365 tenant or Azure subscription, or runs on the customer's own devices, the customer's production data stays under the customer's control. We do not access, monitor, or manage it as part of normal operation, and the customer is the controller of the personal data in its environment.

If a customer explicitly authorizes us to access its environment — for example for support or implementation — we access only what is needed for that purpose and act on the customer's instructions. Where we process personal data on a customer's behalf in that situation, we act as a processor, and appropriate binding processing terms that meet Article 28 of the GDPR must be in place with the customer before that processing begins. This Privacy Policy is not by itself a complete data processing agreement.

A software license that covers a group of companies does not by itself put processing terms in place for each company in that group; binding processing terms are agreed with each entity on whose behalf we process personal data.

11. Payment Processing

Payments for products or services offered by Benedict Corp. may be made through Paddle (for Benedict Invoice, sold through Paddle as Merchant of Record), by bank transfer, or through other third-party payment processors, including Stripe. Processing of payment-related data is necessary for the performance of a contract.

When you buy Benedict Invoice through Paddle, Paddle processes your payment and billing data as described in the Paddle Privacy Policy; we do not receive your full payment card details.

When payments are made through Stripe, certain information required to process the transaction (such as your name, billing information, and payment details) may be transmitted directly to the payment provider.

Benedict Corp. does not store or receive full payment card details. Card payments for Benedict Invoice purchases through Paddle are processed by Paddle as Merchant of Record (see "Purchases Through Paddle" in Section 3). Card payments made through Stripe, for example voluntary contributions, are processed by Stripe under its own security and compliance standards.

When payments are made by bank transfer, only the information necessary to complete the transaction (such as billing details and invoice information) is processed.

You can review Stripe's privacy policy here: https://stripe.com/privacy

12. Voluntary Contributions

Users may choose to support Benedict Corp. or its open-source projects through voluntary contributions processed via Stripe.

Benedict Corp. does not collect or store full payment card details. Voluntary contributions are processed by Stripe under its own privacy and security policies.

Depending on the transaction, Stripe may process personal data such as name, email address, and payment information.

For more information, please refer to Stripe's Privacy Policy: https://stripe.com/privacy

13. Cookies and Tracking Technologies

Our website shows a cookie banner on your first visit with three choices: Accept all, Reject optional, or Choose selection. Choose selection lets you turn Analytics and Marketing on or off separately. Necessary cookies are always on, and Analytics and Marketing stay off until you opt in.

Strictly necessary technology is used regardless of your choice, since some parts of the site cannot function securely without it — this includes Cloudflare Turnstile (see Section 4(b)), used to verify that contact form submissions are not automated, and the storage of your cookie choice itself.

Your choice is stored in your browser (not as a cookie itself) and is not shared with any third party. You can change or withdraw it at any time using the "Manage cookie preferences" link in the footer of every page.

For the cookies and similar browser storage that we know this website and its tools set, what each one does, how long it lasts, and how long your consent choice is remembered, see our Cookie Policy.

If you use our hosted public demo environment, Microsoft may also set temporary cookies to ensure secure access and authentication. See Microsoft's Privacy Statement.

The browser-only interactive demo sets no cookies (see Section 3(d) and the Cookie Policy).

You can also manage or delete cookies in your browser settings at any time.

Google Ads

We use Google Ads to measure the effectiveness of our advertising, including recording when a visitor who arrived through one of our ads submits our contact form (a "conversion"). The Google tag is loaded only if you accept Marketing:

• If you do not accept Marketing, the Google tag is not loaded and our website sends no request to Google — including when you submit the contact form.
• If you accept Marketing, conversion tracking operates normally, which may include cookies used to attribute a conversion to a specific ad or campaign. If you later withdraw your choice, the tag is no longer loaded and we delete the Google Ads cookies our site can identify.

See the Google Privacy Policy for how Google itself processes this data.

Microsoft Clarity

We use Microsoft Clarity, a session-recording and heatmap tool, to understand how visitors use our website — for example, which pages get the most attention, where visitors click, and where they run into friction. Clarity only loads if you accept Analytics cookies; otherwise it does not load at all.

Microsoft is the controller for the data Clarity collects. Clarity customers in the EU contract with Microsoft Ireland Operations Limited, and recordings are available to us for up to 30 days. Clarity is a Microsoft product, separate from Microsoft's role hosting our infrastructure (see Section 10) — see Microsoft Clarity Privacy for how Microsoft itself processes this data. Clarity masks text typed into form fields, such as our contact form, in every masking setting, so it is not included in recordings; other page content may also be masked, depending on Clarity's masking settings.

14. Social Media

Benedict Corp. maintains an official company page on LinkedIn and may also use other social media platforms.

Please note that Benedict Corp. has no control over the data collection, processing, or privacy practices of these platforms. Any personal data you provide while interacting with our pages is processed under the respective platform's own privacy policy and terms of service. We strongly recommend reviewing those policies before sharing any personal or corporate information.

If you contact us via social media, we may process only the minimum personal data necessary to respond to your enquiry — such as your name, contact details, and message content. The lawful basis for such processing is our legitimate interest in responding to your request (Article 6(1)(f) GDPR).

Your personal or corporate data will not be shared, by us, with third parties or used for direct marketing purposes unless you have provided explicit consent.

Each platform is responsible for its own processing. Where Benedict Corp. and a platform are joint controllers — for example for the page statistics a platform provides to page administrators — the responsibilities are allocated in the platform's joint-controller terms, and you can exercise your rights with either party. Otherwise, to the extent permitted by applicable law, Benedict Corp. is not responsible for processing, tracking, or security incidents on the platforms themselves.

15. Data Security

We use reasonable technical and organizational measures to protect your data against unauthorized access, alteration, or loss. These include, where appropriate to the data involved, accepting contact-form submissions only from our own website, requiring a shared secret for the connection that passes submissions to our internal workflow, storing IP addresses only in keyed-hash form, and limiting the retention of technical data to what is operationally necessary.

Microsoft and Cloudflare provide encryption, access control, and data isolation as part of their own infrastructure and compliance programs.

No system is 100% secure, but we take privacy and data protection seriously.

16. Your Rights Under GDPR

You have the right to:

• Access your data and receive a copy
• Correct inaccurate information
• Request deletion of your data
• Restrict or object to processing, including the right to object at any time to the use of your data for direct marketing
• Withdraw consent at any time, without affecting processing carried out before the withdrawal
• Request data portability
• File a complaint with a supervisory authority — in Lithuania the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, https://vdai.lrv.lt), or the authority in the EU or EEA country where you live or work, or where an alleged infringement took place

To exercise your rights, contact us at info@benedictcorp.com

Providing your contact details is not a legal or contractual requirement, but we need them to respond to an inquiry; the details needed to issue invoices are required by law when you buy from us. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

17. Changes to This Policy

We may update this Privacy & Cookie Policy periodically. The latest version will always be available on our website with the "Effective date" shown above. We suggest you review this page periodically.

18. Additional Notice for U.S. Residents (California and Similar Laws)

If you are a resident of the United States, including the State of California, you may have certain privacy rights under local laws such as the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

We do not sell personal information. If you accept Marketing cookies, Google Ads receives limited data as described in Section 13, and some state laws treat that kind of advertising measurement as "sharing" for cross-context behavioral advertising. You can turn Marketing off at any time using "Manage cookie preferences" in the footer.

However, you may request to:

• Access the information we hold about you
• Correct or delete your personal data
• Opt out of any future marketing communications

To exercise these rights, please contact us at info@benedictcorp.com. Requests will be handled in accordance with applicable U.S. state privacy laws.

19. Children's Data

Our services and products are intended for professional and business use only and are not directed toward children under 16.

We do not knowingly collect or process data from minors.

If you believe a child has provided us with personal information, please contact us immediately at info@benedictcorp.com, and we will delete it.

20. Benedict PDF (Open-Source Tool)

Benedict PDF is an open-source solution designed to operate within the user's own Microsoft 365 and Azure environment.

Benedict Corp. does not collect, receive, process, or store PDF documents processed using Benedict PDF.

All document processing occurs within the user's own infrastructure, including Microsoft 365 services such as Power Apps, Power Automate, Azure Functions, and SharePoint or OneDrive.

Benedict Corp. does not have access to user files, document content, or processing results, unless explicitly agreed as part of separate support, implementation, or consulting services.

Any personal data processed through Benedict PDF remains solely under the control of the user's organization and is subject to their internal policies and Microsoft's data processing terms.

Any website interactions (such as contact forms or voluntary contributions) are governed by the general Privacy Policy described above. All provisions described above in this Privacy Policy do not apply to document processing performed through Benedict PDF, unless explicitly stated otherwise.