Privacy policy
Version 4.
In short: we hold your email address, your password in a form that cannot be read back, and the studies you upload. We do not ask for your name. We use no analytics, no advertising and no tracking. Your account and studies are stored in London. Studies are kept for six months, can then be downloaded for 30 days, and are then deleted. If you join our mailing list, which is separate from your account, your address is held for that in Ireland.
Who is responsible
Syntagm Ltd is the controller of the personal data described here. We are registered in England (company number 01895345), and our registered office is at 10 Oxford Road, Abingdon OX14 2DS, United Kingdom. Our registration with the Information Commissioner's Office has been applied for and is pending.
For anything about your data, email [email protected].
What we hold about you, and why
| What | Why | Lawful basis |
|---|---|---|
| Your email address | It is how you sign in, and where we send the emails your account needs: confirming your address, resetting your password, and telling you when a study closes. | Contract |
| Your password | Stored only as a one-way hash. Nobody, including us, can read it back. | Contract |
| When you signed up, and which versions of the terms and this policy you accepted | To show what was agreed, and when. | Contract; legitimate interests |
| For each study you upload, whether you declared it free of personal identifiers (and when, and which version of the declaration) or had its IDs coded in your browser | To show how each study's participants are protected. | Contract; legitimate interests |
| The studies you upload, and what you make from them: merged sets, subsets and analyses | To provide SynCaps to you. | Contract |
| Security records: your IP address in our web server's logs, with the time, the page and your browser type; and, after failed sign-ins or repeated requests, a counter based on a scrambled form of your IP address | To keep the service secure, and to stop password guessing and abuse of the sign-up and password reset forms. | Legitimate interests |
| A copy of each email we send you, while it waits to be sent | So that email is sent reliably, and so that a delivery failure can be investigated. | Contract; legitimate interests |
We do not collect your name, your organisation, your phone number or any payment details. We do not use your account for marketing: our mailing list is separate, and you are on it only if you ask to be. We do not sell your data or share it except as described below.
Our mailing list
You can ask for occasional news about SynCaps V4 on syncapsv4.com. This is separate from any SynCaps account: you do not need one to join, and having one does not put you on it.
- What we hold: your email address, when and where you asked to join, and when you confirmed it.
- Why: to send you news about SynCaps V4, about once a month.
- Lawful basis: your consent. We add you only after you confirm, using the link we email to the address you gave.
- Who holds it: Amazon Web Services keeps the list and sends the emails for us, from its Ireland region (see below).
- Leaving: every email has a link to unsubscribe, which takes one click. You can also email us. Your address is then deleted from the list within a day.
Your participants
SynCaps is designed so that we never receive information that identifies your participants. For every study you upload, you either declare that it contains no names, email addresses, panel IDs or other personal identifiers, or have its participant IDs coded in your browser. For studies whose IDs are coded, we never receive the participant IDs and do not store them; only you hold the map from IDs to codes. Comment lines, and lines SynCaps does not recognise, are removed from every file on upload. We do not try to identify anyone from a study.
If we believe a study contains personal identifiers, we will suspend it and tell you what must be done to lift the suspension. While it is suspended, only you can reach it, and only to download or delete it. If the problem is not resolved within 30 days, we delete the study.
Who else handles your data
We use a small number of service providers, each under contract to process data only on our instructions:
- DigitalOcean hosts SynCaps and its database, in London.
- Amazon Web Services delivers our emails: account emails from its London region, and the mailing list, which it also holds, from its Ireland region. It sees your email address and the message. If an email to you bounces, or you report one as spam, Amazon records your address so that we do not email it again. Ireland is in the European Economic Area, whose protection of personal data UK law recognises as adequate.
- Cloudflare carries all traffic to SynCaps and protects it from attack. It runs the security check on the sign-up form (Cloudflare Turnstile). It sees your IP address and the requests your browser makes, and may process them outside the UK. Transfers to Cloudflare are made under the UK's arrangements for international transfers.
If we begin to charge for SynCaps, payments will be taken by a payment provider, and this policy will be updated first to say who.
We may disclose data if the law requires us to.
How long we keep it
| What | For how long |
|---|---|
| Your account (email address, password, what you agreed to) | Until you close it, from your account page or by asking us. If you never confirm your address, the account is deleted after 7 days. |
| Studies | Six months from import, then 30 days in which they can only be downloaded, then deleted. You can delete one sooner. A suspended study is deleted if the problem is not resolved within 30 days. |
| Mailing list | Until you unsubscribe; then deleted within a day. A request to join that you do not confirm is deleted after 3 days. |
| Web server logs containing your IP address | 14 days |
| Sign-in and request counters | An hour at most |
| Copies of emails we have sent | 14 days, or 30 days if sending failed |
| Database backups | About a month, so anything deleted is gone from the backups within about a month of being deleted. |
Cookies
SynCaps sets only the cookies it needs to work, so it does not ask for your consent to them:
sessionidkeeps you signed in, for up to two weeks.csrftokenprotects the forms you submit from being forged by another site. It lasts a year.
On the sign-up page, Cloudflare Turnstile may store information in your browser to tell people from automated programs. It is not used for advertising or to follow you across sites. Cloudflare may also set its own security cookies.
Your rights
You have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Email [email protected]. We will answer within one month. You can also download your studies and delete them yourself at any time.
If you are unhappy with how we have handled your data, please tell us. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
Changes to this policy
If we change this policy, we will publish the new version here with a new version number and email you about any change that matters.