Terms of Service

• "Site": danielmashkov.com and its subdomains.
• "Service": Web development, e-commerce, and automation services presented and delivered by Daniel Mashkov.
• "User": Any individual or entity browsing the site, submitting a contact form, or engaging a service.
• "Sub-processor": A third-party vendor that processes data on the site operator's behalf (Vercel — including Web Analytics — Supabase, Airtable CRM, Resend, Upstash, Google/GA4, Google Gemini API, Sentry, Cal.com, Cloudflare, Telegram).

The site provides information about web development services. Any specific project engagement is governed by a separate, signed work agreement defining scope, timelines, pricing, and delivery terms.

Responses to contact form submissions and quote requests do not constitute a binding agreement — they are the opening of a conversation only.

The site's own content — its code, design, text and graphics — belongs to Daniel Mashkov and is protected under Israeli and international copyright law. Reproduction, distribution, transmission, or derivative works are prohibited without explicit written consent.

Client names and logos, screenshots of client websites, client testimonials, and third-party product names and logos (such as WordPress, Shopify or WooCommerce) belong to their respective owners. They appear only to describe work I did or tools I use; showing a product's name or logo does not mean its maker endorses me.

Source code delivered to clients as part of a project is transferred under the terms specified in that project's individual agreement.

As of September 2026, user data is processed and stored by the following sub-processors:

• Vercel (hosting): USA / global edge — DPA + SCCs.
• Supabase (database): EU (Ireland, eu-west-1) — DPA + SCCs; Row-Level Security enforced.
• Airtable (CRM lead sync): USA — documented under vendor terms; free tier has no DPA.
• Resend (email): USA — documented under vendor terms; free tier has no DPA.
• Upstash (Redis): EU (Frankfurt, eu-central-1) — hashed IP addresses for 60 seconds (rate limiting), hashed email addresses for 24 hours (lead-magnet and data-subject-request duplicate checks).
• Google Analytics 4: USA + EU — DPA + SCCs; GA4 does not log or store IP addresses.
• Google Gemini API (operations bot): USA — receives the name, company and message of a new inquiry (to draft a reply the site owner approves by hand), and an inquiry's details when the owner asks the private operations bot about it; not used for marketing. Documented under Google's paid API terms.
• Sentry (monitoring): EU (Germany) — DPA + SCCs; personal data scrubbed before sending.
• Vercel Web Analytics: USA — cookieless, aggregate page views; no personal identifiers.
• Cal.com, Inc.: USA — External service — user-initiated only.
• Cloudflare (CDN / edge): USA / global edge — reverse proxy in front of the whole site; also hosts the operations bot Worker. Documented under vendor terms; Cloudflare offers a DPA + SCCs.
• Telegram (notifications): Global — receives operational new-lead alerts (owner-only, not marketing). Documented under vendor terms.

Cross-border transfers are documented vendor by vendor. Where a processor offers a DPA and SCCs, those safeguards are used; where they are unavailable on a free tier, that limitation is disclosed explicitly in the Privacy Policy and compliance documentation. Israel holds an EU adequacy decision (Commission Decision 2011/61/EU) recognizing it as providing adequate data protection.

Israel's Protection of Privacy Law Amendment 13 (PPL Am. 13), enacted in 2024 and in force since 14 August 2025, gives the Privacy Protection Authority (PPA) expanded enforcement powers. The points that matter for this site:

• Financial sanctions: Administrative fines that can reach millions of shekels, scaled by the size of the database and the type of violation.
• Immediately — Severe security incidents: Reported to the PPA under the Protection of Privacy Regulations (Data Security), 2017 (regulation 11).
• 30 days — Data subject rights: Requests to access, correct or delete your data are answered within 30 days.
• 24 months — Retention schedule: Site-form submissions in the site database — deleted automatically after this period.

Submit DSR requests via the DSR Request Form — see the button below.

• No sale of personal data: This site does not sell or share personal information for cross-context behavioral advertising. See Privacy Policy section 8 — Do Not Sell or Share.
• CCPA enforcement (Cal. Civ. Code §1798.155, §1798.199.90): Whether or not the CCPA's thresholds apply to this site, I handle California residents' data as if they do. For reference, violations carry fines or civil penalties of up to $2,663 per violation, or $7,988 per intentional violation or violation involving the data of consumers under 16 (amounts adjusted on 1 January 2025).
• Right to access, delete, and correct: Submit a Data Subject Request (DSR) — I respond within 30 days; opt-out of sale/sharing requests are acted on within 15 business days.
• Non-discrimination: Exercising CCPA/CPRA rights will not result in denial of service, price changes, or reduced service quality.

The CCPA's risk-assessment regulations apply to businesses above its thresholds. I run a comparable review voluntarily; this is the record of it for danielmashkov.com:

1. Responsible party identification

Daniel Mashkov, Licensed Business (Israel) — determines processing purposes and means, and is personally responsible for privacy compliance under PPL Amendment 13.

2. Risk assessment schedule

A record of processing activities (what is stored where, for how long, and by whom) is maintained and updated with each change.

3. Compliance attestation

I attest that this site's privacy practices — including data minimization, the IP-address TTL policy, sub-processor terms (including Supabase as the active lead database), and incident response procedures — are designed to meet PPL Amendment 13 and, voluntarily, the CCPA/CPRA, as detailed in the Privacy Policy. This attestation is renewed annually.

Signed: Daniel Mashkov, Owner & Operator, danielmashkov.com — March 2026

4. AI and automated processing

The scope estimator and the 2-minute quote use deterministic rules only — no machine learning and no profiling — and their results are non-binding recommendations. The site assistant currently answers on the site itself, from a fixed set of answers written from this site's content; question text is not sent to any AI provider. If a live AI model is connected, question text — without names or contact details — would be sent through Cloudflare AI Gateway to the model provider, and the Privacy Policy will name that provider first.

Limitation of Liability

Information on this site is provided "as is." Daniel Mashkov is not liable for indirect, consequential, strategic, or punitive damages arising from reliance on site content. Direct liability is limited to the amount actually paid for a specific service engagement, if any.

External Links

The site may contain links to external services (e.g. Cal.com, GitHub, LinkedIn, WhatsApp). These links do not constitute endorsement of external content, and I am not responsible for their privacy practices or terms.

Changes to These Terms

These terms may be updated periodically. Material changes will be marked with an updated date at the top of this page. Continued use of the site after changes are published constitutes acceptance of the revised terms.

For legal inquiries, DSR requests, or questions about these terms, use the Submit a DSR Request button below, or email info@danielmashkov.com.