privacy notice

controller and contact

sistemalabs research OÜ is the controller for information collected through this website. Contact hello@sistemalabs.com with privacy questions or requests.

website measurement

Short-lived server access logs record requests, including IP address and browser user agent. We use them to understand aggregate traffic, reliability, caching, errors, country, device, and automated traffic. Our legal basis is our legitimate interest in operating and improving a secure, reliable website.

If you accept analytics preferences, we also collect a random client identifier, a random session identifier, page paths, hostname-only referrers and outbound destinations, limited campaign labels, stable link identifiers, and network-signup funnel steps. We use this information to understand use of the website, improve it, and support our research. Our legal basis for this browser collection and these purposes is your consent. We do not send signup form values, use advertising identifiers, or capture page contents, mouse movement, or session replay.

Your analytics consent also covers converting eligible browser events into candidate journeys without identifiers or event properties for journey-model research. Candidates remain restricted while linkable source data exists. Only after an automated deletion check confirms that corresponding raw data and working versions are gone are journeys shuffled across multiple source periods into the anonymous research dataset.

retention and recipients

Raw access logs and consented browser events are deleted after seven days. Pending journey candidates expire after at most 30 days. Daily aggregate metrics are retained for 25 months, dated reports for 13 months, and application and access logs for 30 days. Fully anonymized journey batches have no automatic expiry and are reviewed at least annually for continuing necessity and re-identification risk. Aggregate reports omit low-volume dimension rows.

Amazon Web Services processes this information as our hosting provider. Processing is primarily in the European Union, with CloudFront and related control-plane or log-delivery resources in the United States where the service requires it. Where personal data is transferred internationally, we rely on applicable contractual safeguards, including standard contractual clauses where required.

your choices and rights

You can reopen analytics preferences from every page. Declining or withdrawing analytics stops all future browser collection and clears local analytics state; server access logs are collected independently. Withdrawal does not erase information already received or anonymous data that can no longer be linked to you.

Subject to applicable law, you may request access, correction, erasure, restriction, portability, or object to processing, and may withdraw consent at any time. You may also complain to your local data-protection authority. Email us to make a request; we may need enough information to verify and locate records, and some aggregate data cannot be linked back to an individual.