Privacy Policy

Siamang Studio and Siamang Cloud are beta services operated by Siamang Labs LLC, a Wyoming limited liability company (Siamang, we, us).

This Privacy Policy explains what personal data we handle, and why, when you:

• visit our website, siamang.org;
• use Siamang Studio (the app at studio.siamang.org) or Siamang Cloud (app.siamang.org);
• answer a survey hosted with the Services (Studio surveys at study.siamang.org, Cloud surveys at surveys.siamang.org), or receive an invitation to one.

1. Who is responsible for your data

Siamang is the controller of the data about you as a visitor of siamang.org and as a user of our Services: your account, your membership in organizations, billing, support conversations, and security records.

Our customers are the controllers of their survey data. When an organization uses Siamang Studio or Siamang Cloud to run a survey, invite people by email or upload files, that organization decides what is collected and why. We process that data on its behalf, as its processor, under our Data Processing Agreement. If you answered a survey or received an invitation, the organization named in the survey or the email is responsible for your data; see section 9 for how to reach it.

Some services you use alongside ours are independent controllers under their own privacy policies: the sign-in provider you choose (Google, or in Siamang Cloud also Microsoft), Stripe for the payment details you enter on its pages, Google for the advertising tag on siamang.org, and the panel providers and repositories that customers connect.

2. What we collect

Your account

• Your email address and name.
• How you sign in. Sign-in is handled by our provider, Supabase: if you use a password, it goes to Supabase and is stored there only as a hash, and the Services never receive it. If you sign in with Google, or with Microsoft in Siamang Cloud, we receive the email address, name and account identifier the provider shares.
• The organizations you belong to, your role in each, and the teammates you invite (their email addresses).
• Which version of the Terms of Use you accepted, and when.
• API keys you create (in Studio we keep only a hash), and connector credentials and project secrets you add (stored encrypted). In Siamang Cloud, also the SSH public keys you add.
• Citation details you enter for a study, such as author names, affiliations and ORCID iDs.
• What you write to us at support@siamang-team.org.

Billing

When an owner buys a plan, Stripe collects the card and billing details on its own pages; card numbers never reach our systems. We keep the customer and subscription identifiers Stripe assigns, the plan and its status. Invoices and receipts are kept in Stripe.

Your project content

Questionnaires, analysis flows, files you upload, generated code, every saved version, reports, live dashboards, comments and project settings. In Siamang Cloud, each project also has its repository with its full history, and the deposits you make in external repositories such as Zenodo or OSF on your instruction.

Survey respondents, on our customers’ behalf

When you answer a survey hosted with Siamang Studio, the organization running it receives:

• your answers, including partial answers: each move to another page, and each time you leave the tab, sends the answers so far, so they arrive even if you never submit;
• when you started, how long you took, the last page you reached, and three counts: how often you left the tab, for how many seconds the page was hidden, and how many times you pasted (counts only, never what you pasted);
• the captcha result, if the survey uses one;
• anything in the survey link, such as a panel’s respondent identifier or an invitation;
• a random identifier for your interview, which is not linked to your identity.

A survey hosted with Siamang Cloud sends the organization your answers and the technical details its author set it up to collect, such as timestamps, whether you completed it, and anything in the survey link.

Studio does not store your IP address with your responses. It is used to limit abuse and appears in our server’s request logs until they are overwritten. If the survey uses a captcha, Cloudflare Turnstile sees your IP address and browser when you submit, and we send Cloudflare your IP address to verify the check. Videos from YouTube or Vimeo load only when you press play. Any other site the survey owner links to, such as a logo, images or custom code, sees your IP address and browser.

What a survey keeps in your browser is described in section 3.

Email invitations

When an organization invites people to a survey from Siamang Studio, we store on its behalf the contacts it uploads (email address, and an optional name and attributes), a personal survey link for each contact, the message it wrote, each message as sent, and each contact’s status: queued, sent, failed, bounced, reported as spam, unsubscribed, started or completed. Our email provider reports bounces and spam complaints back to us so the address is not emailed again.

Studio does not ask our email provider to track whether an invitation was opened or a link was clicked.

Technical and security data

• Server logs: requests and errors, which can contain IP addresses and email addresses.
• Sign-in records kept by Supabase: the IP address and browser of each sign-in.
• Security events, such as rate limits and failed sign-ins.
• An Activity trail in each organization: saves, publishing, runs, mailings, deletions, member and role changes, turning the assistant on or off.

There are no analytics, advertising or tracking tools in Siamang Studio, Siamang Cloud or the surveys they host, unless a survey’s author adds them in custom code, and we never sell or share the data in the Services. We do not sell personal data for money. The Google Ads tag on siamang.org (below) may count as “sharing” for targeted advertising under some US state laws; it runs only if you allow it, as described in section 3.

On siamang.org

• Contact form: your name, email address, organization, topic and message go to our team inbox so we can reply.
• “Notify me at 1.0” form: your email address is stored with our email provider, Resend, so we can send you one announcement when version 1.0 is released.
• Both forms are protected against bots by Cloudflare Turnstile, which processes technical information about your browser and connection.
• Visitor analytics: Vercel Web Analytics and Speed Insights count visits and measure page speed without cookies or cross-site profiles. When you click a link from this site into Siamang Studio, Siamang Cloud or the Cloud demo, or a form is sent successfully, that event is recorded together with the campaign parameters in the page address (for example, which advertisement you came from). If you choose “Allow” in the cookie banner, those parameters are also kept in your browser’s session storage for the visit, so a click on a later page still carries them. Nothing you type into a form is included.
• The Google Ads tag (gtag.js, from Google LLC) measures whether our Google advertisements lead to visits, demo views, form submissions and clicks to sign up, and lets us show our advertisements to people who visited siamang.org before. It is loaded only if you choose “Allow” in the cookie banner. Then it may set cookies, read identifiers in your browser and record the pages you visit, and Google may combine this with information it already has about you. Until you allow it, or if you decline, the tag is not loaded and siamang.org sends Google nothing. When a form is sent, Google is told only that it happened. We use Google’s reports in aggregate. We also advertise on Reddit and LinkedIn, but neither has a tag on siamang.org.

What you must give us, and where else data comes from

You need to give an email address to create an account; without it we cannot provide the Services. Everything else is optional, except the payment details Stripe needs when you buy a plan. Some data comes from others: a teammate who invites you gives us your email address, your sign-in provider gives us your profile, and a report about a survey may name people.

3. Cookies and browser storage

Siamang Studio sets one cookie, sc_auth, on studio.siamang.org. Its value is just 1: it tells Studio’s web server whether to show you the app or the sign-in page. It lasts 7 days, is renewed when you open Studio, and is removed when you sign out. Studio also keeps your sign-in session and interface preferences (theme, density, panel widths) in your browser’s local storage. All of this is strictly necessary for the service you asked for or remembers a choice you made, so Studio shows no cookie banner.

Siamang Cloud uses cookies and local storage on app.siamang.org only to sign you in, keep your session and remember interface settings. It uses no advertising or cross-site tracking cookies, and shows no cookie banner for the same reason as Studio.

Surveys set no cookies. Once you start answering, a Studio survey keeps in your browser’s local storage for study.siamang.org: a draft of your answers so you can resume, your interview’s identifier, a note that your interview ended, and your light or dark choice. These go 7 days after the survey last wrote them, and the draft is removed as soon as you submit. If the survey owner turned on One per browser, a mark that you already answered stays until you clear your browser data; the survey owner should tell you about it and, where the law requires, ask for your consent first. A Cloud survey on surveys.siamang.org keeps only your progress in local storage, so you can resume.

siamang.org asks before it sets anything that is not needed to show you the site. On your first visit a banner offers Allow and Decline. Only if you choose Allow is the Google Ads tag described above loaded, with its cookies and identifiers, and the campaign parameters of your visit (sm_utm) kept in your browser’s session storage. Until you choose, and if you decline, neither happens. If you later decline, the site deletes the campaign note and the Google cookies it can reach, and tells the tag to stop using them. The site remembers your choice in your browser’s local storage (sm_consent) for 6 months, so the banner does not come back on every page; you can change it at any time with Cookie settings in the footer of every page. If your browser sends a Global Privacy Control signal, the site treats it as Decline and does not show the banner; Cookie settings still lets you choose Allow. The visitor analytics set no cookies and run either way. You can also block or delete cookies in your browser, or opt out of personalized Google advertising at adssettings.google.com.

4. Why we use your data, and our legal bases

Where the GDPR or the UK GDPR applies, we rely on the following legal bases (Article 6(1)):

Survey responses, contact lists and project content are processed only on our customers’ instructions, under the Data Processing Agreement. The customer chooses the legal basis for its survey. Suppressing an address after an unsubscribe, a bounce or a spam complaint is part of those instructions: it is how the opt-out is honored.

Where we rely on legitimate interests, you can object (section 9). We make no decisions about you that are based solely on automated processing and have legal or similarly significant effects.

We do not use questionnaires, flows, scripts, contact lists, responses or other project content to train machine-learning models.

5. The AI assistant in Siamang Studio

Studio has an AI assistant for reviewing and drafting the wording of questionnaires and analyses. During the beta it is not connected to any model provider: it sends no text outside Siamang, and an owner cannot turn it on yet. If we connect a provider, we will add it to the list of subprocessors and tell account holders at least 30 days in advance, and the assistant will send nothing until an owner of the organization turns it on.

6. Who we share data with

• Our subprocessors, the providers that run parts of the Services for us: hosting and backups (Google Cloud), sign-in (Supabase), email delivery (Resend), payments (Stripe), delivery of the Studio web app (Vercel), captcha and DNS (Cloudflare), and support mailboxes (Google Workspace). The list of subprocessors says what each one receives and where it is.
• Services a customer connects, such as connectors, outgoing webhooks, panel providers and repositories, receive what the customer tells Studio to send them.
• Other members of your organization see your name, email address and what you do in its projects.
• Authorities and others where required: we disclose data when the law, a court order or an enforceable request requires it, or where needed to protect the rights, safety or security of our users, respondents or the Services.
• A buyer of our business, if the Services are sold or merged; this policy continues to apply until a new one is announced.

7. International transfers

Siamang Labs LLC is based in the United States. The servers and backups of the Services run on Google Cloud in the United States (Northern Virginia, region us-east4), and sign-in runs on Supabase in the United States (Northern Virginia, region us-east-1). Several providers, including Stripe, Vercel, Resend, Cloudflare and Supabase, are US companies and may process data in the United States.

Where the GDPR or the UK GDPR applies, these transfers rely on the European Commission’s Standard Contractual Clauses, with the UK Addendum, in these providers’ data processing terms and in our Data Processing Agreement. You can get a copy of these safeguards from support@siamang-team.org.

8. How long we keep data

We may keep limited information longer where the law requires it, or to establish or defend a legal claim.

9. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to its use, receive a copy in a portable format, and withdraw consent you gave. You can also complain to a data-protection authority, for example the one where you live or work.

In Studio you can edit your profile, export your projects and data, delete projects, responses and contacts (depending on your role), and revoke share links and API keys.

For anything else, write to support@siamang-team.org from the email address of your account. Deleting your account or an organization you own is done by our support team on request during the beta; there is no button for it yet. We may ask you to confirm the request is yours. We answer within one month; if a request is complex, we may extend that by up to two more months and will tell you why.

If you answered a survey or received an invitation, the organization that ran it decides about your data. Write to it first: its contact details should be in the survey or the email. Every invitation and reminder has an unsubscribe link, which stops further emails from that project at once; reporting the email as spam has the same effect. If you cannot identify the organization, write to us with the survey’s address: we will pass your request on to it. Our support staff cannot look up your answers, and delete responses only on the organization’s written instruction.

Please do not post personal information in a public GitHub issue.

10. Children

Accounts are not for people under 16. Organizations that survey children or minors are responsible for any parental consent or other protection the law requires.

11. Security

We protect the Services with these measures:

• Encryption in transit: every public address uses TLS.
• Credentials: passwords are held by our sign-in provider as hashes; password sign-up requires email confirmation; sign-up and password forms are protected by a captcha; sign-in attempts are rate-limited. API keys and the links that invite teammates to an organization are stored only as hashes, and connector credentials and project secrets are stored encrypted.
• Separation between customers: every request is checked against the organization it belongs to, and every project has its own database schema.
• Sandboxes: survey builds run with no network access, and analyses run with no internet access, reaching only their own project’s data, with limits on memory, time and disk.
• Files are served only through signed links that expire.
• Surveys are served from a separate address that shares no cookies or session with the app, and each survey page carries a security policy that limits what it can load and run.
• Outgoing requests from webhooks and connectors go only to public internet addresses.
• Backups are taken every night, checked, and copied to storage that the server itself cannot delete or overwrite.
• Staff access: our support staff help customers from account and organization metadata; they do not look at response content, contact lists, file contents or questionnaire text, except what a published survey shows any visitor when we review a report about it. Only one or two engineers have administrator access to the production server, which technically reaches all stored data; they use it to run, repair and restore the Services and to carry out deletions customers ask for.

The beta does not hold security certifications such as SOC 2 or ISO 27001. No online service can guarantee absolute security. If a security incident affects personal data, we investigate and contain it, tell affected customers without undue delay, and notify authorities and individuals where the law requires.

12. Changes to this policy

We update this policy as the Services change, and change the date at the top of the page. If a change reduces your protections, we email account holders at least 30 days before it takes effect.

13. Contact

Siamang Labs LLC
30 N Gould St Ste N
Sheridan, WY 82801
USA

Email: support@siamang-team.org, for privacy questions and requests.

---

This Privacy Policy is written in plain language to describe our current practices. It is not legal advice.