Last updated: October 12, 2026
The operator of personal data processed through mark-42.co is Rodion Shchebentovskiy, a private individual and citizen of the Republic of Kazakhstan, trading as Mark-42 Studio ("we", "us"). Contact: hello@mark-42.co.
This policy follows the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" and also describes your rights under the GDPR if you are in the EU/EEA.
_ga, _ga_*).Enquiries are stored in our own CRM (ERPNext) on servers of Hetzner Online GmbH in Germany. We do not sell personal data. Processors involved:
Using these providers means a cross-border transfer of personal data, including to the USA. We transfer only the data listed in section 2 and only for the purposes in section 3.
Necessary storage remembers your language and cookie choice. The m42_consent cookie lasts one year and is shared on mark-42.co and its subdomains; browser local storage supports older saved choices. On mark-42.co marketing pages and the pilot pages under karandash.mark-42.co/s/, analytics cookies (_ga, _ga_*) are set only after you click "Allow analytics". On Karandash marketing and pilot pages, consent also enables campaign attribution cookies: m42_lt (last campaign touch, 90 days) and m42_ft (first touch, 180 days). They contain campaign tags, landing page, referrer host, and time, and are shared with karandash.mark-42.co. Change your choice via "Cookie settings" or Do Not Sell or Share My Personal Information; withdrawing removes accessible analytics and attribution cookies. The main Karandash app outside /s/ has a separate analytics setting for PostHog; this shared cookie does not control it.
You can request access to your data, correction, deletion, restriction of processing, data export, and withdraw consent at any time. You may also complain to the data protection authority of your country. Write to hello@mark-42.co — we answer within 10 working days.
Data is encrypted in transit (TLS). Access to the CRM is limited to the studio, secrets are kept in HashiCorp Vault.
The current version is always on this page; the date at the top shows the last change.
Karandash turns your project files into client pages for changes, updates, and milestone approvals. The pilot stores your business email, uploaded documents and files, client name and email for signing, signatures and document versions, and view events. Product view events do not store IP addresses or user-agent strings. Infrastructure security logs and consented Google Analytics are separate from those view events.
We use this information to prepare and deliver pages, send signing codes, record decisions, and support your business. Authorized support may view uploaded files to prepare your pages and answer requests. Files are available to your business, the clients you invite, and authorized support. Upload only files you are authorized to provide, and inform your clients about the service.
Pilot data is stored in US/EU cloud infrastructure. We do not sell your files or use them for advertising. Sub-processors and service providers are Hetzner (hosting), Cloudflare (delivery and security), Paddle (Merchant of Record for paid Karandash subscriptions), and Google Analytics (site analytics only with consent). Paddle receives subscription purchaser and billing information; it does not process payments from your clients to your business.
The main Karandash app at karandash.mark-42.co outside /s/ also uses PostHog for product analytics, processing usage events such as pages viewed and interactions. Its frontend configuration uses PostHog EU cloud at eu.i.posthog.com. The app has its own analytics setting, stored separately as karandash_analytics_consent. Use that setting to turn off PostHog analytics; the marketing and pilot opt-out does not control PostHog.
Pilot files are automatically deleted after 90 days of inactivity, or on request to hello@mark-42.co. Associated pilot client and view records follow the same schedule. Restricted backups are kept for up to 90 days and then rotated; deleted pilot data can remain in those backups until they expire. Records we must retain for tax, billing, or legal obligations are kept only as required. We never handle your clients' payments; they pay your business directly.
California residents may request to know and access the categories and specific pieces of personal information we hold, their sources, purposes, and recipients; delete personal information; correct inaccurate information; and opt out of sale or sharing for cross-context behavioral advertising. You may also request limits on eligible uses of sensitive personal information. We do not use sensitive personal information to infer characteristics about you and do not discriminate for exercising privacy rights.
The categories, sources, purposes, recipients, and retention periods are described above. We receive pilot data from businesses and their invited clients, and usage information from interactions with the service. Email hello@mark-42.co to make a request, including through an authorized agent. We may verify your identity for access, correction, and deletion using information already held, and may ask an agent for proof of authority. Opt-out does not require an account or identity verification.
We do not sell personal information or share it for cross-context behavioral advertising. Use Do Not Sell or Share My Personal Information to disable optional Google Analytics and campaign attribution for your browser on mark-42.co marketing pages and the pilot pages under karandash.mark-42.co/s/. We honor Global Privacy Control as an opt-out on those pages. The main Karandash app outside /s/ has its own PostHog analytics setting; the shared marketing and pilot cookie does not control it. You can also email us to exercise your rights. Essential processing needed to provide the service continues.