Privacy Notice

Who this notice covers

This draft notice describes the public website and its protected member room. The business name is Santech. Business address: [To be added]. Direct privacy contact: [To be added]. Gatekeeper, Connect, Vault, Telegram, exchanges and wallets involve separate services and need appropriate service-specific notices.

Information used by the website

Requests involve technical information such as IP address, browser information, URL and request time. Hosting and security providers may process it to deliver and protect the site. Public pages can be viewed without signing in. Owner administration uses the host’s Sign in with ChatGPT. The member room uses Telegram sign-in: the server verifies Telegram identity, checks current Gatekeeper access and issues an encrypted, time-limited session cookie. A short first name from the verified Telegram profile may be kept in that encrypted session and used for your welcome message. No separate website password is stored.

The Telegram sign-in flow requests identity and basic profile scope, not a phone number or permission to send messages. There is no advertising script or added analytics tracker. The website does not request seed phrases, exchange credentials or card details.

Connected activity data

The server makes predefined read-only source queries and returns aggregate trade, assessment and user-interaction counts. The supplied historical Telegram-ID list is held in protected server configuration and deduplicated against connected user records. The website publishes the total, not the underlying list; interaction does not establish paid membership. Individual trade details, Telegram IDs, member names, wallet addresses and connection credentials are not included in the activity response.

The original history is a dated aggregate import without customer identifiers in its published snapshot. The underlying membership services can hold personal records; their processing belongs in the relevant service notice.

Browser storage and cookies

A session-storage flag remembers whether the home-page brand reveal has appeared in the current tab session. Local storage remembers whether optional motion is paused, until the preference or site data is cleared. In the member room it also remembers your selected guide, playback position and steps you mark as reviewed. Learning progress is stored under a derived member reference on that browser, not sent to Gatekeeper or used to grant access. Use Reset learning progress in the member room or clear site data to remove it. Shared devices can retain this progress after sign-out.

When member sign-in is configured, essential HttpOnly, Secure cookies hold an encrypted login-flow record for up to five minutes and an encrypted member session for up to four hours or the current membership expiry, whichever comes first. Server-side access is checked again for protected pages and media; cookies do not extend membership. Sign out clears the member session on that browser. The site adds no advertising or analytics cookies. The host may use authentication or security cookies for owner administration. You can manage site data through your browser. Reduced-motion preferences are respected.

Purposes and lawful basis

Technical data supports delivery and security. Display preferences remember your interface choice. Aggregate queries provide activity information.

The controller must confirm and document the lawful basis for its own personal-data processing, including any legitimate-interest assessment, before public launch. This draft does not claim that visiting constitutes consent. Future optional analytics or marketing requires its own assessment and notice.

Providers and external links

The site is hosted through OpenAI Sites and Cloudflare infrastructure. Connected databases use Neon. Service links may take you to Telegram or a separate Santech service; their data practices apply. Public blockchain transactions are visible according to the network’s design.

The final notice must confirm processor relationships, transfer locations and safeguards. This draft does not assert that all data stays in the UK or that an unverified safeguard is in place.

Retention

The member room has no separate password database. Private support requests are stored in the website’s Cloudflare D1 database. Each request contains a derived member reference, a pseudonymous ownership key, the topic, selected product and mode, title, messages, status and timestamps. Only the signed-in member and the exact website owner can access that conversation. Support replies stay in the member room; the website does not send Telegram notifications. Do not include account credentials or other unnecessary personal information. A retention period and direct support/privacy contact must be confirmed before public launch. Training media is kept in private object storage and served after access checks. The protected member room shows the signed-in member a derived member reference, membership plan, current expiry, existing primary referral code and link, and their own aggregate recorded referral rewards. These details come from read-only Gatekeeper queries and are returned only after member access checks, with private, no-store responses. A separate protected payment centre reads the signed-in member’s own invoice and receipt history, including amounts, statuses and dates. It uses derived record references and does not return payment-wallet addresses, raw Telegram IDs or other members’ records. Downloaded personal payment summaries remain on the member’s device. Other member identities and payout wallets are not returned. Individual details do not enter the public activity response. Its aggregate cache lasts up to 45 seconds per server instance. The reveal flag normally lasts for the tab session; the motion preference lasts until changed or cleared.

Host, security and membership records have separate retention needs. Their actual periods or criteria must be confirmed in the final notices. Membership expiry is not a promise that financial or security records are immediately deleted.

Your privacy rights

Depending on the processing and applicable law, you may request access, correction, erasure, restriction or portability, and withdraw consent where processing relies on consent.

Right to object: you may object where processing relies on legitimate interests. A direct privacy contact and identity-verification process must be confirmed before public launch. This private website has no automated rights-request form.

UK users can raise concerns with the Information Commissioner’s Office. Other jurisdictions may have their own supervisory authority.

Automation and security

The website displays aggregate figures. Those counts do not decide individual eligibility or start trades. The member room separately checks existing Gatekeeper entitlement and locks protected content when access is inactive or cannot be checked. Membership and trading products can use separate automated processes and require their own explanation.

Credentials remain server-side. No system can promise absolute security. Never send seed phrases or private keys through a website or support conversation.

Notice changes

This draft notice is dated 22 October 2026. Update it when actual data collection, providers, contacts or flows change. Operator details and outstanding service-specific items must be completed before public launch.