1. Who is responsible
HSKL Consulting, operated by Hanbin Tan, is responsible for the personal information described in this notice unless a client agreement says otherwise.
Privacy questions and requests can be sent to hello@hskl.tech.
2. Scope
This notice covers the public HSKL website, consulting inquiry process, invited client workspace, transactional service messages, and optional public-site analytics.
It does not cover a third-party website reached through an external link. That provider's notice applies after you leave HSKL.
3. Notice at Collection
The table below describes the categories HSKL may collect and the business purpose for each. A category is collected only when the related feature is used or configured.
| Category | Examples | Purpose | Source |
|---|---|---|---|
| Inquiry and contact data | Name, work email, business or team, selected focus, description of the constraint, desired outcome, and referral source | Review fit, respond, prevent duplicate intake, and plan a requested consulting conversation | You, through the inquiry form or direct email |
| Client and engagement data | Account role, organization, scope, proposal decision, project status, work items, meetings, metrics, activity history, and deliverables | Authenticate invited users, deliver the engagement, preserve decisions, and keep work accountable | You, your organization, and HSKL during delivery |
| Private files | Approved consulting deliverables and file metadata | Provide authorized client access and maintain project evidence | HSKL and authorized client users |
| Technical and security data | Requested URL, timestamp, browser and device signals, approximate network location, IP address, authentication events, and error metadata | Deliver the site, detect abuse, troubleshoot failures, and protect accounts | Your browser, hosting infrastructure, and security services |
| Optional analytics data | Public page path and a random anonymous browser identifier | Count public page visits and understand which consulting information is useful | Your browser, only after consent and only when PostHog is configured |
| Consent preference | Analytics allowed or declined | Remember and honor your Cookie choice | Your selection or an active browser privacy signal |
Please do not submit passwords, payment card numbers, government identifiers, health information, or other sensitive information that is not needed for the consulting request.
4. Why information is used
HSKL uses information to take steps you request before a possible engagement, perform a consulting engagement, operate and secure the service, send transactional updates, meet recordkeeping obligations, and improve public information when you consent to optional analytics.
Where a law requires a legal basis, HSKL relies on consent for optional analytics, requested pre-contract steps or contract performance for consulting delivery, legitimate operational and security interests where permitted, and legal obligations where applicable.
5. Cookies and similar technology
A cookie is a small value stored by the browser and sent back to the same site. Browser storage and similar identifiers can be regulated in the same way as cookies. HSKL uses the following limited set.
| Name or service | Type | Purpose | Typical duration |
|---|---|---|---|
hskl_consent_v1 | Strictly necessary | Stores only whether optional analytics were allowed or declined | 180 days |
| Better Auth session cookie | Strictly necessary for invited users | Keeps an authenticated client or administrator session secure | Until expiry, sign-out, or session revocation |
| PostHog first-party identifier | Optional analytics | Distinguishes an anonymous browser so duplicate public page views can be understood without creating a person profile | Up to 180 days, only after consent |
| Vercel Analytics and Speed Insights | Optional measurement | Measures aggregate traffic and public-page performance | Loaded only after consent; provider retention settings apply |
All optional analytics are disabled before consent. Analytics on login, client, administrator, and API routes, along with session replay, automatic click capture, form capture, and advertising tracking, remain disabled even after consent.
You can change your choice at any time. Declining removes accessible optional analytics cookies from this site and stops future collection in the browser.
6. How anonymous analytics works
When a PostHog project token is configured and you choose Allow analytics, the browser creates a random first-party identifier and sends a custom public_page_view event containing only the public route path. Query strings, referrer URLs, form values, email addresses, account identifiers, session replay, heatmaps, automatic clicks, surveys, and person profiles are not sent by this implementation.
The consent cookie is not an analytics identifier. It contains only granted or denied. Without a configured project token, HSKL sends no PostHog events even if analytics are allowed.
7. Providers and disclosure
HSKL uses service providers only for functions needed to operate the site and consulting service. Current or planned providers are:
- Vercel for application hosting, delivery, aggregate analytics, and performance measurement.
- Convex for authentication integration, application data, workflows, and private file storage when connected.
- Resend for transactional email when connected.
- PostHog for consented public-page analytics when a project is configured.
Providers process data under their own contractual and security terms. HSKL may also disclose limited information when legally required, to protect rights or service security, or as part of a business transaction with appropriate notice and safeguards.
HSKL does not sell personal information and does not share it for cross-context behavioral advertising. HSKL does not use third-party advertising pixels.
8. Retention
- Consent preferences and PostHog browser identifiers expire after no more than 180 days unless renewed by browser use.
- Optional analytics event history is intended to be limited to no more than 12 months in the production PostHog workspace.
- Unqualified inquiries are reviewed after 12 months of inactivity and deleted when no longer needed for follow-up, security, or dispute handling.
- Client engagement records and deliverables are kept for service delivery, accountability, contractual needs, and any applicable legal recordkeeping period, then deleted or de-identified.
- Successful email content and complete addresses are removed from the internal notification record after delivery. Terminal notification metadata is removed after 30 days.
- Hosting and security logs follow the provider's configured retention and may be kept longer when needed to investigate abuse or a security incident.
If a fixed period is not practical, HSKL uses the shortest period consistent with the purpose, sensitivity, legal requirements, and unresolved obligations.
9. Your choices and rights
Depending on where you live, you may have rights to know or access personal information, correct inaccurate information, request deletion, receive a portable copy, object to or restrict certain processing, withdraw consent, or appeal a denied request.
HSKL may need to verify a request and may retain limited records when required by law, security, fraud prevention, or an unresolved agreement. HSKL will not discriminate against someone for using an applicable privacy right.
Send a request to hello@hskl.tech with enough context to locate the relevant record. Do not email sensitive identity documents unless HSKL requests a safe verification method.
10. Browser privacy signals
If the browser exposes Global Privacy Control or Do Not Track as active, this site treats optional analytics as declined and keeps the analytics controls off. The essential preference cookie records that decision so it is not repeatedly requested.
11. International processing
Providers may process information in the United States and other countries where they operate. Those locations may have different privacy laws. HSKL uses provider contracts and available safeguards appropriate to the service and information involved.
12. Security
HSKL uses role-scoped access, protected server functions, private file delivery through an authorized application route, input validation, reduced notification payloads, and environment-separated secrets. No internet service is risk-free, so information should be limited to what the engagement needs.
13. Children
HSKL is a business consulting service and is not directed to children under 16. HSKL does not knowingly collect personal information from children through this site.
14. Changes to this notice
Material changes will be posted here with a new effective date. If a change requires a new consent choice, optional analytics will not rely on the old choice.
15. Contact
Email privacy questions, rights requests, or concerns to hello@hskl.tech.