Privacy

Derfos provides educational information and comparison tools. It does not provide legal, tax, accounting or financial advice.

Operator and contact

Studio Monk OÜ · Estonia
Registry code: 17310242
Harju maakond, Tallinn, Kesklinna linnaosa, Järvevana tee 9, 11314
info@derfos.com

Data we use

Declared country, tax residency, nationality and business context, preferences, budget and needs. We do not request documents, name, date of birth, address, phone or tax identifiers. Do not enter identifying data in optional fields.

Session and storage

An HttpOnly gcm_guest cookie protects results. Only a hash of the secret is stored in the database. Drafts live in tab sessionStorage and are removed on completion or with Clear draft. The gcm_lang cookie remembers language for one year.

Retention and deletion

Guest results: up to 30 days, configurable to a shorter period. Delete result removes answers and snapshots and unlinks clicks. Minimal events are kept for 30 days; clicks, without answers or raw IP, up to 90 days. An hourly scheduled purge removes expired records. Encrypted backups are retained for up to 30 days; a restore must reapply deletion requests.

Startup OS

We store business answers, plan and completed steps. Free project: up to 30 days; paid project: up to 90 days from confirmation. The recovery code is stored only as a hash. Anyone with it can access the project and replace the previous session. Deleting a project removes answers, plan and events; it does not issue a refund. Technical order and payment identifiers are retained for up to 365 days for reconciliation and incident handling, detached from answers after deletion.

Stripe processes payment on its page; Derfos does not store cards or send your answers to Stripe. Notion receives normal connection data when you open a bonus. We record minimal project actions: assessment completion, checkout start and payment confirmation, tasks, export and resource opening. We do not install advertising pixels.

First-party measurement

We measure starts, completed steps, completed assessments, viewed results, provider comparison and observed outbound clicks. Analytics session identifiers are not shared with providers. Cloudflare processes technical connection data to limit abuse. Application diagnostics contain only error categories and random references, never answers or cookies. No advertising pixels or session recording. A click is not evidence of a sale.

Processing and third parties

In local demo, the PGlite database stays on the operator’s machine. The published version uses Cloudflare hosting and a dedicated Supabase database in Sydney, Australia. The landing page loads decorative desktop videos from CloudFront; this service receives the technical data of a normal web request. Fonts are served locally. External links open sites with their own policies; we do not send answers, residency, scores or session tokens.

Support and privacy contact: info@derfos.com

Last updated: 2026-10-19 · Asia/Bangkok.