Privacy policy

This policy explains how privacy works on the SharkNet website. It covers browsing the pages, sending a private briefing and using the free website check.

It also covers the client portal (projects, requests, documents, invoices and payments) and the separate staff sign-in. The site sends no marketing messages. Data a client entrusts to SharkNet within an engagement (for example systems, backups or website content) is governed by the data processing agreement for that engagement.

SharkNet is the brand under which the services on this site are provided. The data controller is SharkNet Group LLC, registered in the State of Wyoming, USA, with the official correspondence address: 30 N Gould St, Sheridan, WY 82801, USA.

For questions and requests about data protection you can contact the company at that address or by email at [email protected]. This mailbox is active and monitored.

This contact channel is for exercising your rights under Articles 15–22 of Regulation (EU) 2016/679. A request may also be sent to the official correspondence address. We reply within one month of receiving a request and, for complex requests, within the extended period under Article 12(3).

The briefing form asks for your name, company, business email, an area of interest, an indicative budget and timeline and a description of the goal; a phone number and website are optional. It is sent to SharkNet and stored in our client-relationship system so that a partner can reply and prepare a first conversation.

The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) of Regulation (EU) 2016/679). Only SharkNet staff with access to the CRM see the briefing. A briefing that does not lead to an engagement is deleted within 24 months of the last contact, or earlier on request.

Use only the information needed for an initial description. Do not include passwords, access keys, payment card data, health information or confidential data of third parties; we can sign an NDA before you share anything sensitive.

Access to the client portal is by invitation from SharkNet or from an owner at your company. We process your name, title, work email, role and a hash of your password (the password itself is never stored). The portal holds the relationship records: engagements, milestones and approvals, requests and messages, shared documents, invoices and an audit log of sign-ins and changes, which your company can review.

Invoices can be paid by bank transfer or online. Online payments are processed by Whop as merchant of record and, once our own payment account is active, by Stripe. SharkNet does not receive or store card data; the payment provider receives the invoice number and amount. In demonstration mode nothing is charged and no data is sent to a payment provider.

The legal basis is the performance of the contract with your company (Article 6(1)(b) of Regulation (EU) 2016/679) and, for the audit log and account protection, our legitimate interest in the security of the service. Portal data is kept for the duration of the relationship and until accounting retention periods for invoices expire; audit records for up to 12 months.

Our cookieless analytics measures visits to our clients' websites as a processor under contract with them. The script sets no cookies and uses no browser storage; the IP address and browser are used only in memory to count unique daily visits and to prevent abuse, and are not stored. Only aggregated daily counts per page, source and device type are kept. The Do Not Track signal is honoured.

The free website check processes only the public address you enter and the publicly available responses of the site and its DNS; the result is not stored. If you choose to leave an email, it is recorded as an enquiry and used only to send the report and a related offer, until you withdraw.

Loading a web page requires a connection between your browser and the infrastructure that serves it. On public hosting this connection may involve your IP address, the time of the request, the requested address, browser information and the server's technical response. This is separate from the content of a briefing.

The specific records, recipients and retention periods depend on the configuration of the public hosting and the site's protection. They must be confirmed and described before this version goes live on a public domain; a local preview does not prove the behaviour of the future infrastructure.

A briefing is used only to reply to you and to prepare a proposal. It is never used for marketing lists, never sold and never shared outside SharkNet.

Portal and invoicing data are used to deliver and bill the engagement your company contracted, and to protect the accounts that access it.

For technical records that protect the public site, necessity, minimal data and the applicable legal basis must be determined. This policy does not present future or unverified processing as active.

Briefings that do not lead to an engagement are deleted within 24 months of the last contact. Client relationship records are kept for the duration of the relationship and the accounting retention period that applies to invoices.

Your browser may offer to autofill or restore text according to its own settings. These features are not controlled by the site.

Retention periods for public server logs and for future correspondence are not yet confirmed. Specific periods or clear deletion criteria must be set before they are activated.

Briefings are stored in SharkNet's own client-relationship system on our infrastructure; they are not sent to an external CRM, email marketing tool or AI service. The pages contain no embedded behavioural analytics or advertising pixels.

The domain uses Cloudflare for DNS, and Yandex is listed as the email provider. This alone does not establish where data from the public site will be processed.

Before the public launch, the providers with access to personal data, their functions, the processing regions and the conditions for any transfer outside the European Economic Area must be specified.

Public pages set no cookies for analytics, advertising or remembering a language choice. Only after you sign in to the client portal or the staff console is a strictly necessary session cookie set (sn_client or sn_staff) — HttpOnly, inaccessible to scripts, time-limited and deleted on sign-out. It requires no consent.

Additional features of the public hosting may change this behaviour. Before they are enabled we will check what data they use and whether consent is needed.

When your personal data is processed you can request access and rectification. Subject to the applicable conditions you also have the rights to erasure, restriction, portability and objection. Where processing is based on consent, you can withdraw it for the future.

As a rule we answer a request within one month. If an extension of up to two further months is needed because of complexity or the number of requests, you should be notified with reasons within the first month.

If you believe your rights have been infringed, you can lodge a complaint with a competent supervisory authority, in particular in the EU member state where you live or work.

The site does not use form data for profiling, automated scoring of prospective clients or decisions with legal or similarly significant effects. A briefing is not sent to an AI model.

Describing AI as part of how we work does not mean that visitor data is given to an AI provider. Any such future processing requires its own purpose, legal basis, recipients and safeguards before it is introduced.

Revision of 9 October 2026. Changes to the contact form, hosting, measurement or providers require this policy to be reviewed before they are activated.

The date marks a revision of the text, not a certificate of legal compliance or a public launch date.