Privacy Policy | Siamang Cloud

Siamang Cloud is an open-beta service operated by Siamang Labs LLC, a Wyoming limited liability company, the team behind the source-available siamang research-as-code engine.

This Privacy Policy explains what personal data Siamang Labs LLC collects and uses when you use the Siamang Cloud console, how we handle survey respondent data that you process through the Service, and what runs on our public website at siamang.org.

This Policy applies to Siamang Cloud and to the siamang.org website. It does not replace the privacy notice that you may need to provide to people who respond to surveys you create.

1. Who is responsible for the data

Siamang Cloud may process two different categories of data in different legal roles.

Account and Service data

For information about you as an account holder or user of Siamang Cloud, such as account details, usage data and support communications, Siamang Labs LLC acts as the controller (or equivalent role under applicable privacy law).

Survey respondent data

For personal data that you collect from people through surveys deployed with Siamang Cloud, you decide what to collect, why to collect it, and how it will be used. For purposes of the GDPR, UK GDPR and similar laws, you generally act as the controller and Siamang Labs LLC acts as your processor, processing that data on your behalf and according to your instructions.

You are responsible for determining an appropriate lawful basis, giving respondents any notices required by law, obtaining consent where required, and responding to data-subject requests relating to your surveys.

2. Information we collect

Account information you provide

We may collect:

your email address and display name;
the organizations and projects you create or join;
account authentication information, such as securely hashed passwords where applicable;
API credentials, SSH public keys and similar credentials that you choose to add to the Service;
communications you send to us about your account, support requests or the Service.

Content you create

The Service stores content needed to operate your projects, including questionnaires, analysis scripts, project configuration, repositories, files, generated artifacts, reports and related project metadata.

Survey respondent data processed on your behalf

Deployed surveys may collect responses and other information that you configure the survey to collect. That information is stored and processed as part of your project in order to provide the Service to you.

Depending on the survey you design, respondent data may include sensitive or special-category personal data. You are responsible for deciding whether collecting such data is lawful and appropriate and for configuring your survey accordingly.

Technical and usage data

We collect limited technical information needed to operate, secure and improve the Service, such as:

request metadata and timestamps;
authentication and security events;
an audit trail of actions within organizations, such as deploys, runs and invitations;
error and diagnostic logs;
basic information about how Service features are used.

We do not run third-party advertising trackers in the Siamang Cloud console, and we do not sell personal data. Our public website at siamang.org runs one advertising measurement tag, from Google; section 4 describes it.

Information you send through the siamang.org website

The website has two forms. The contact form sends your name, email address, organization, chosen topic and message to our team inbox so that we can reply. The “Notify me at 1.0” form stores your email address with our email delivery provider so that we can send you one announcement when version 1.0 is released. You can ask us to remove your address at any time by writing to info@siamang-team.org.

Both forms are protected against automated abuse by Cloudflare Turnstile, which may process technical information about your browser and connection for that purpose.

3. Cookies and local storage

The Siamang Cloud console uses cookies and local storage that are necessary to sign you in, maintain your session and remember preferences such as interface settings.

We do not use third-party advertising or cross-site tracking cookies in the console.

The siamang.org website uses cookies and similar identifiers set by the Google Ads tag described in section 4, and privacy-preserving visitor analytics that set no cookies. The console at app.siamang.org, the demo at demo.siamang.org and hosted surveys carry no advertising tag.

A survey that you create may optionally use analytics or other functionality that you configure. If you enable those features, you are responsible for determining whether additional notice, consent or other compliance measures are required.

4. Advertising and measurement on siamang.org

This section applies only to the public marketing website at siamang.org (including pages such as /pricing and /textbook). It does not apply to the Siamang Cloud console, the demo, or surveys deployed with the Service.

Visitor analytics

siamang.org uses Vercel Web Analytics and Vercel Speed Insights to count visits, see which pages are read and measure page performance. These services are served from the site itself, do not set cookies and do not build cross-site profiles.

When you click “Start the open beta” or “Open the live demo”, or when one of the website forms is submitted successfully, the website records that event with Vercel Web Analytics together with the campaign parameters in the page address (for example which advertisement you arrived from). This tells us which advertisements bring people who go on to try the product. It does not include your name, email address or anything you typed into a form.

The Google Ads tag

We advertise Siamang Cloud on Google, Reddit and LinkedIn. Of those, only Google has a tag on this website: the Google tag (gtag.js) of Google Ads (Google LLC). It measures whether Google advertisements lead to visits, demo views, form submissions and clicks through to sign up, and allows us to show our Google advertisements to people who have visited siamang.org before.

The Google tag may set cookies or read identifiers in your browser, record which pages you visited and which button you clicked, and share that information with Google, which may combine it with information it already holds about you under its own privacy policy. We use the resulting reports only in aggregate form, for example how many people who clicked an advertisement went on to the sign-up page.

Reddit and LinkedIn have no tag on this website. They only know that an advertisement was shown or clicked on their own platform; nothing you do on siamang.org is reported to them.

When you submit the contact form or the “Notify me at 1.0” form, Google is told only that a submission happened. The name, email address and message you entered are not shared with Google.

A click on “Start the open beta” or “Open the live demo” is reported as a conversion event before your browser leaves siamang.org. Nothing that happens after that, including whether you actually create an account, is reported by the console.

Your choices

You can decline or remove these cookies in your browser settings, and you can opt out of personalized Google advertising at adssettings.google.com.

Browser extensions that block advertising trackers also block the Google tag; the website works without it.

Where the law of your country requires your consent before such a tag is used, we rely on that consent and will ask for it before the tag runs.

5. How we use information

We use account, content and technical data to:

create and administer accounts and organizations;
authenticate users and maintain sessions;
validate, preview and deploy surveys;
collect and store responses on your behalf;
run analysis and generate reports or other project outputs;
provide collaboration, repository and project-management functionality;
maintain security, prevent abuse and investigate technical problems;
operate backups and disaster-recovery processes;
communicate with you about your account or important Service changes;
understand aggregate or de-identified usage patterns and improve the Service.

Where the GDPR, UK GDPR or similar laws apply, our legal bases for processing account and Service data may include performance of our agreement with you, our legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where consent is required.

For survey respondent data, we process personal data on your documented instructions as needed to provide the Service, subject to applicable law.

We do not use your questionnaires, scripts, survey responses, or other project content to train general-purpose machine-learning models. We may still use aggregate or de-identified Service-level information to understand usage, maintain security and improve the operation of Siamang Cloud, as described above.

6. Service providers and subprocessors

Siamang Cloud depends on third-party infrastructure and service providers that process data on our behalf. Our current core providers are:

Google Cloud: cloud hosting, compute and service infrastructure used to operate Siamang Cloud;
Supabase: user authentication and session-management infrastructure.

The siamang.org website additionally relies on:

Vercel: hosting of the website and its forms, and cookie-free visitor analytics;
Resend: delivery of contact-form messages and of the 1.0 announcement mailing list;
Cloudflare: DNS, content delivery and the Turnstile protection on the website forms;
Google: the Google Ads tag described in section 4. Google acts as an independent controller for the data its tag collects, under its own privacy policy.

These providers receive only the information reasonably necessary for them to perform their functions for Siamang Cloud. We may use additional infrastructure or service providers where reasonably necessary to operate, secure or maintain the Service.

Where Siamang Labs LLC acts as a processor of respondent data, a third party that processes that data on our behalf acts as a subprocessor. We remain responsible for selecting service providers appropriate for the Service and for imposing contractual data-protection obligations where required by applicable law.

If you require information about the subprocessors used for a particular deployment, contact us at info@siamang-team.org.

7. International data transfers

Siamang Cloud may process or store personal data in countries other than the country where you or your respondents are located, including the United States.

Where applicable law requires safeguards for an international transfer, we will rely on an appropriate legal transfer mechanism or other safeguard available under that law.

Because you control the categories of respondent data collected through your surveys, you are responsible for determining whether your own collection and use of respondent data involves additional international-transfer obligations.

8. Data retention and deletion

Account and project content is generally retained while the relevant account, project or organization remains active.
When you delete a response, project, organization or account, associated data is removed from active systems according to the Service’s deletion processes.
Residual copies may remain temporarily in backups, logs or disaster-recovery systems until they are overwritten or expire in the ordinary backup cycle.
Security, audit and operational logs are retained only for as long as reasonably necessary for security, debugging, fraud prevention, compliance and operation of the Service.
We may retain limited information for longer where required by law, necessary to resolve a dispute or necessary to enforce our agreements.

Deletion from active systems does not necessarily mean immediate erasure from every backup copy, but backup data is not ordinarily restored except for disaster recovery or system integrity purposes.

9. Your rights and choices

Depending on where you live, applicable law may give you rights to access, correct, delete, restrict, object to processing of, or obtain a copy of personal data relating to you.

Within the Service, you may be able to:

access and export project data and datasets;
correct account information;
delete individual survey responses;
delete projects or organizations where your permissions allow it;
delete your account.

If you are a survey controller and need assistance responding to a respondent’s lawful request, you may contact us and we will provide reasonable assistance consistent with our role as processor and the capabilities of the Service.

If a survey respondent contacts Siamang Labs LLC directly about data controlled by one of our users, we will generally direct the respondent to the relevant survey controller where we can identify that controller.

To make a privacy request concerning your Siamang Cloud account, email info@siamang-team.org. Please do not post private or sensitive information in a public GitHub issue.

You may also have the right to complain to a competent data-protection or privacy authority in your jurisdiction.

10. Security

We use reasonable technical and organizational safeguards designed to protect information processed through Siamang Cloud. Depending on the part of the Service, these safeguards include project isolation, sandboxed execution of user code, credential hashing, authentication controls and access restrictions.

No online service can guarantee absolute security. You are responsible for using a strong password, protecting API credentials and SSH keys, controlling access to your organizations and projects, and configuring your surveys appropriately for the sensitivity of the information you collect.

If we become aware of a security incident affecting personal data, we will take reasonable steps to investigate, contain and remediate the incident and will provide notifications where required by applicable law.

11. Children

Siamang Cloud accounts are not intended for people under 16.

If you use Siamang Cloud to collect personal data from children or minors, you are responsible for determining whether that collection is lawful and for obtaining any parental authorization, consent or other protection required by applicable law.

12. Business transfers and legal disclosures

We may disclose information where reasonably necessary to comply with law, legal process or enforceable governmental requests; to protect the rights, security or integrity of Siamang Labs LLC, the Service or other users; or to investigate abuse or fraud.

If ownership of Siamang Cloud or substantially all relevant business assets is transferred, information may be transferred as part of that transaction, subject to applicable law. We will continue to apply this Policy until a replacement privacy policy takes effect and will provide notice where required.

13. Changes to this Policy

We may update this Privacy Policy as Siamang Cloud evolves. The “Last updated” date will change when we revise it.

If a change is material, we will take reasonable steps to bring it to users’ attention through the Service or another appropriate channel.

14. Contact

For privacy questions, requests or data-protection matters, contact:

Siamang Labs LLC
30 N Gould St Ste N
Sheridan, WY 82801
USA

Email: info@siamang-team.org

Siamang Cloud is an independent open-beta project. This Privacy Policy is written in plain language and is intended to describe our current practices. It is not legal advice.