Last updated: 6 September 2026
This policy explains how personal data is handled on maheshika.com. The data controller is Dr. Maheshika Halbeisen, trading as Eternal Raine Ltd (registered in England and Wales, company number 16505815). Contact: maheshika@maheshika.com.
Forms and assessments. When you use a form or an assessment on this site, what you enter is collected: typically your name, your email address, your role and organisation, and your answers. It is used to deliver what you asked for and to reply to you.
The Business X-Ray. To prepare a Business X-Ray, your name, work email, role, company name, company website and your answers to the application questions are collected. Dr. Halbeisen reads the public pages of the website you give, in the way any visitor or search engine would: only pages that are already public, never anything behind a login, and respecting robots.txt. She then prepares your X-Ray personally. In doing so she may use AI tools under her own accounts as part of her analysis; your application itself is never published, never sold, and never used to train any model. Patterns across many applications may be described in aggregate, in a form from which no company or person can be identified. The finished X-Ray is delivered to you at a private web address containing a long random token. It is not indexed, not listed and not shared; anybody who has the full link can open it, so treat it as you would any private link.
The AI Risk Score. When you use the free AI Risk Score, the job title and answers you enter are sent to Anthropic's Claude API to generate your result, under API terms that do not use your inputs to train models. No account is created. If you choose to give an email address to receive the fuller result, that address is stored with your result.
The Expertise Ownership Score runs entirely in your browser and sends nothing unless you choose to get in touch afterwards.
Campaign source. Where you arrive from a link that carries campaign tags (utm_source and similar), the tags and the page you landed on are kept for that browser tab and attached to any enquiry you then submit, so it is known which content brought you here.
Analytics, only with consent. If you allow it in the cookie banner, Google Analytics 4 is used to understand how the site is used, with cookies and pseudonymous identifiers rather than your name. The site also has its own measurement layer which, once switched on, records pages, referring sites, country, device class and the actions you take on the site; it never records what you type, and without your consent it uses no identifier that can be linked across days. Nothing in this paragraph happens if you choose Essential only. Every cookie and storage key is listed in the cookie policy.
Delivering what you asked for (an X-Ray, an assessment result, a reply): performance of a contract, or steps taken at your request before one. Marketing emails: consent, which you can withdraw at any time using the unsubscribe link. Site security, improvement and the analytics you have allowed: consent for anything stored on your device, and legitimate interests for the rest. Requesting something and agreeing to marketing are two separate things; a box for marketing is never pre-ticked and is never a condition of receiving what you requested.
Vercel (hosting), Google (form records held in Google Sheets and Drive, email, and Google Analytics where you have allowed it), the email service used to send confirmations, and Anthropic (the AI Risk Score only). When the site's own measurement layer is switched on it will run on Supabase in the EU; this policy will be updated on that day. Personal data is not sold. Some providers process data outside the UK and EEA under appropriate safeguards such as the UK addendum to the standard contractual clauses.
Enquiries, applications and X-Rays: until the matter is closed and for up to two years afterwards, so that a later conversation has its context. Assessment results held against an email address: until you ask for deletion. Mailing-list data: until you unsubscribe. Raw analytics events in the site's own store: 13 months, after which only aggregate figures that identify nobody are kept. Records required for tax and accounting: six years.
Under UK GDPR you can ask for access to, correction of, or deletion of your personal data, object to or restrict processing, and take your data elsewhere. Write to maheshika@maheshika.com; requests are answered within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Essential storage keeps your cookie choice and, for one browser tab, the campaign tags described above. Analytics cookies are set only after you allow them, and you can change your choice at any time through the Cookie settings link in the footer of every page. The full list is in the cookie policy.
When this policy changes, the date at the top changes with it. Material changes to what is collected are described here rather than applied silently.