Privacy and Evidence-Handling Notice

Qadarim requests only the evidence needed to reconstruct and assess the one workflow named in the SOW, support the five diagnostic outputs, administer the engagement, and preserve required transaction records.

Do not provide passwords, authentication codes, API keys, credentials, production-system/database/codebase/admin/payment-account access, payment-card or bank-account data, protected health information, identifiable customer information, customer lists, sensitive personal data, or information unrelated to the selected workflow.

Before submission, the client must remove customer names and other identifying details from examples and screenshots. Qadarim must not ask the client to weaken this redaction requirement to make analysis easier.

Access is restricted to the person performing the diagnostic. Evidence must be stored only in access-controlled Qadarim systems.

A separate client subfolder and retention record must be created for each paid diagnostic before evidence is accepted. External sharing, if later required for a real engagement, must be limited to the minimum necessary party and must be separately authorized and verified.

Non-public evidence is used only for the selected diagnostic and its administration. It may not be reused for marketing, model training, another client, or another workflow without explicit written permission.

Client diagnostic evidence: delete 90 calendar days after final delivery, or earlier upon a valid contractual request, unless a legal obligation requires longer retention.

Contracts, invoices, payment records, and legally required records: retain for the applicable legal period.

Opt-out suppression data: retain only the minimum form needed to prevent re-contact.

The retention register must record category, deletion due date, and deletion completion.

If prohibited data is received unintentionally:

1) stop processing it;

2) isolate it from diagnostic analysis;

3) notify the sender that the material is outside the permitted boundary;

4) delete it securely as soon as practicable; and

5) record the incident and deletion action.

Do not copy prohibited data into the tracker, notes, screenshots, email, or AI prompts.

Business contact: ronatal@qadarim.com.

This route must pass current send/receive verification before SPA v0.2 outreach is released.