Privacy Policy | Siamang Cloud and Siamang Studio

Siamang Cloud and Siamang Studio are beta services operated by Siamang Labs LLC, a Wyoming limited liability company, the team behind the source-available siamang research-as-code engine.

This Privacy Policy explains what personal data Siamang Labs LLC collects and uses when you use the Siamang Cloud console (app.siamang.org) or the Siamang Studio console (studio.siamang.org), how we handle survey respondent data and contact lists that you process through the Services, and what runs on our public website at siamang.org.

This Policy applies to Siamang Cloud, Siamang Studio, the surveys they host and the siamang.org website. It does not replace the privacy notice that you may need to provide to people who respond to surveys you create or whom you invite by email.

1. Who is responsible for the data

The Services may process different categories of data in different legal roles.

Account and Service data

For information about you as an account holder or user of a Service, such as account details, usage data, billing records and support communications, Siamang Labs LLC acts as the controller (or equivalent role under applicable privacy law).

Survey respondent data and contact lists

For personal data that you collect from people through surveys deployed with a Service, and for the contact lists you upload to Siamang Studio to invite respondents, you decide what to collect, why to collect it, and how it will be used. For purposes of the GDPR, UK GDPR and similar laws, you generally act as the controller and Siamang Labs LLC acts as your processor, processing that data on your behalf and according to your instructions.

You are responsible for determining an appropriate lawful basis, giving respondents any notices required by law, obtaining consent where required, and responding to data-subject requests relating to your surveys and invitations.

Identity providers, payment and panel providers

Google and Microsoft (when you sign in with them), our payment provider, the deposit repositories you publish to and the panel providers that supply respondents to your surveys act as independent controllers of the data they process, under their own privacy policies.

2. Information we collect

Account information you provide

We may collect:

your email address and display name;
when you sign in with Google or Microsoft: the email address, name and account identifier the provider shares with us; we do not receive your password;
the organizations and projects you create or join;
account authentication information, such as securely hashed passwords where applicable;
API credentials, SSH public keys, project secrets and connector credentials that you choose to add to a Service, stored encrypted;
study metadata you enter for citation, such as author names, affiliations and ORCID identifiers;
communications you send to us about your account, support requests or the Services.

Billing information

When you buy a plan, our payment provider (Stripe) collects your payment details directly; card numbers never reach our systems. We keep the customer and subscription identifiers Stripe assigns, the plan you bought, invoices and payment status.

Content you create

The Services store content needed to operate your projects, including questionnaires, analysis flows and scripts, project configuration, repositories, files, generated code, every saved version, reports, live dashboard tiles and related project metadata.

Survey respondent data processed on your behalf

Deployed surveys may collect responses and other information that you configure the survey to collect, together with technical metadata that the survey runtime attaches to a submission, such as timestamps, completion status and any identifiers passed in the survey address (for example a panel provider’s respondent id or an invitation token).

Depending on the survey you design, respondent data may include sensitive or special-category personal data. You are responsible for deciding whether collecting such data is lawful and appropriate and for configuring your survey accordingly.

Contact lists and email invitations (Siamang Studio)

When you invite respondents by email, we store the contacts you upload (email address, optional name and attributes), the personal invitation token of each contact, the message you wrote, and the delivery status of each email: queued, sent, failed, bounced, reported as spam, unsubscribed, started or completed. Our email provider reports bounces and spam complaints to us so that the address is not emailed again. We do not track whether an invitation email was opened.

Technical and usage data

We collect limited technical information needed to operate, secure and improve the Services, such as:

request metadata and timestamps;
authentication and security events;
an audit trail of actions within organizations, such as saves, deploys, runs, mailings, invitations, share links and deposits;
error and diagnostic logs;
basic information about how Service features are used.

We do not run third-party advertising trackers in the consoles or in hosted surveys, and we do not sell personal data. Our public website at siamang.org runs one advertising measurement tag, from Google; section 4 describes it.

Information you send through the siamang.org website

The website has two forms. The contact form sends your name, email address, organization, chosen topic and message to our team inbox so that we can reply. The “Notify me at 1.0” form stores your email address with our email delivery provider so that we can send you one announcement when version 1.0 is released. You can ask us to remove your address at any time by writing to info@siamang-team.org.

Both forms are protected against automated abuse by Cloudflare Turnstile, which may process technical information about your browser and connection for that purpose. The sign-up and sign-in forms of the consoles may be protected the same way.

3. Cookies and local storage

The consoles use cookies and local storage that are necessary to sign you in, maintain your session and remember preferences such as interface settings.

We do not use third-party advertising or cross-site tracking cookies in the consoles.

Hosted surveys (on surveys.siamang.org for Siamang Cloud and study.siamang.org for Siamang Studio) use local storage only to keep a respondent’s progress within the survey. They carry no advertising tag.

The siamang.org website uses cookies and similar identifiers set by the Google Ads tag described in section 4, and privacy-preserving visitor analytics that set no cookies.

A survey that you create may optionally use analytics, custom JavaScript or other functionality that you configure. If you enable those features, you are responsible for determining whether additional notice, consent or other compliance measures are required.

4. Advertising and measurement on siamang.org

This section applies only to the public marketing website at siamang.org (including pages such as /pricing and /textbook). It does not apply to the consoles, the demo, or surveys deployed with the Services.

Visitor analytics

siamang.org uses Vercel Web Analytics and Vercel Speed Insights to count visits, see which pages are read and measure page performance. These services are served from the site itself, do not set cookies and do not build cross-site profiles.

When you click “Start the open beta” or “Open the live demo”, or when one of the website forms is submitted successfully, the website records that event with Vercel Web Analytics together with the campaign parameters in the page address (for example which advertisement you arrived from). This tells us which advertisements bring people who go on to try the product. It does not include your name, email address or anything you typed into a form.

The Google Ads tag

We advertise on Google, Reddit and LinkedIn. Of those, only Google has a tag on this website: the Google tag (gtag.js) of Google Ads (Google LLC). It measures whether Google advertisements lead to visits, demo views, form submissions and clicks through to sign up, and allows us to show our Google advertisements to people who have visited siamang.org before.

The Google tag may set cookies or read identifiers in your browser, record which pages you visited and which button you clicked, and share that information with Google, which may combine it with information it already holds about you under its own privacy policy. We use the resulting reports only in aggregate form, for example how many people who clicked an advertisement went on to the sign-up page.

Reddit and LinkedIn have no tag on this website. They only know that an advertisement was shown or clicked on their own platform; nothing you do on siamang.org is reported to them.

When you submit the contact form or the “Notify me at 1.0” form, Google is told only that a submission happened. The name, email address and message you entered are not shared with Google.

A click on “Start the open beta” or “Open the live demo” is reported as a conversion event before your browser leaves siamang.org. Nothing that happens after that, including whether you actually create an account, is reported by the consoles.

Your choices

You can decline or remove these cookies in your browser settings, and you can opt out of personalized Google advertising at adssettings.google.com.

Browser extensions that block advertising trackers also block the Google tag; the website works without it.

Where the law of your country requires your consent before such a tag is used, we rely on that consent and will ask for it before the tag runs.

5. How we use information

We use account, content and technical data to:

create and administer accounts and organizations;
authenticate users and maintain sessions;
validate, compile, preview and deploy surveys;
collect and store responses on your behalf;
send survey invitations and reminders to the contacts you upload, and honour unsubscribes, bounces and complaints;
run analysis and generate reports, live dashboards or other project outputs;
provide collaboration, versioning, repository and project-management functionality;
make deposits in external repositories on your instruction;
bill paid plans, apply trials and offers, and send billing and trial notices;
maintain security, prevent abuse, protect the deliverability of our sending domain and investigate technical problems;
operate backups and disaster-recovery processes;
communicate with you about your account or important Service changes;
understand aggregate or de-identified usage patterns and improve the Services.

Where the GDPR, UK GDPR or similar laws apply, our legal bases for processing account and Service data may include performance of our agreement with you, our legitimate interests in operating and securing the Services, compliance with legal obligations, and consent where consent is required.

For survey respondent data and contact lists, we process personal data on your documented instructions as needed to provide the Services, subject to applicable law. Suppressing an address after an unsubscribe, bounce or complaint is part of those instructions: it is how the opt-out is honoured.

We do not use your questionnaires, flows, scripts, contact lists, survey responses, or other project content to train general-purpose machine-learning models. We may still use aggregate or de-identified Service-level information to understand usage, maintain security and improve the operation of the Services, as described above.

That commitment describes what we do with your content. It does not extend to the optional AI assistant in Siamang Studio, which sends the text you are working on to a third-party model provider that processes it under its own terms. The assistant is off unless an organization owner turns it on; section 6 sets out what it sends, what it never sends, and to whom.

6. Service providers and subprocessors

The Services depend on third-party infrastructure and service providers that process data on our behalf. Our current core providers are:

Cloud hosting providers: virtual servers, databases and object storage used to operate the Services (currently Google Cloud for Siamang Cloud); the provider used for a particular deployment is available on request;
Supabase: user authentication and session-management infrastructure, including sign-in with Google and Microsoft;
Resend: delivery of platform email (sign-up confirmation, password reset, team invitations, trial and billing notices, failure alerts) and, from a separate sending domain, of the survey invitations and reminders you send from Siamang Studio;
Stripe: payment processing, invoices and subscription management;
Cloudflare: DNS, content delivery and the Turnstile protection on forms;
DeepSeek: the optional AI assistant in Siamang Studio, which reviews the wording of a questionnaire or of an analysis when someone asks it to.

The assistant works differently from the providers above, so it is described separately. It is off by default, and only an organization owner can turn it on. It sends only text that someone in your organization wrote: the questionnaire’s title and description, page titles, question wording and help text, answer labels, and the labels and measurement scales of your variables; for a review of an analysis, the steps of the pipeline, their settings, and the codebook they run against. It does not send survey responses, contact lists, your account details, your organization’s name, or the custom JavaScript a questionnaire may carry. Turning the assistant on records who agreed and when, and an owner can turn it off again at any time.

DeepSeek processes what the assistant sends under its own terms of use and privacy policy. By enabling the assistant, you accept those terms for the content your organization sends through it.

The siamang.org website additionally relies on:

Vercel: hosting of the website and its forms, and cookie-free visitor analytics;
Google: the Google Ads tag described in section 4. Google acts as an independent controller for the data its tag collects, under its own privacy policy.

Services you connect yourself are not subprocessors: connectors you configure, panel providers, and repositories such as Zenodo or OSF receive data only when you instruct a Service to send it, and process it under their own terms.

These providers receive only the information reasonably necessary for them to perform their functions. We may use additional infrastructure or service providers where reasonably necessary to operate, secure or maintain the Services.

Where Siamang Labs LLC acts as a processor of respondent data or contact lists, a third party that processes that data on our behalf acts as a subprocessor. We remain responsible for selecting service providers appropriate for the Services and for imposing contractual data-protection obligations where required by applicable law.

If you require information about the subprocessors used for a particular deployment, or a data-processing agreement, contact us at info@siamang-team.org.

7. International data transfers

The Services may process or store personal data in countries other than the country where you or your respondents are located, including the United States.

Where applicable law requires safeguards for an international transfer, we will rely on an appropriate legal transfer mechanism or other safeguard available under that law.

Where the AI assistant in Siamang Studio is enabled, the text described in section 6 is processed in China. It therefore leaves the United States, Canada and Europe, and while it is outside your country it may be reachable by courts or public authorities there under local law. For organizations in the European Economic Area or the United Kingdom, note that China is not covered by a European Commission adequacy decision. This applies only to organizations whose owner has turned the assistant on, and only to that text. If your organization cannot accept that transfer, leave the assistant off; every other part of the Services works without it.

Because you control the categories of respondent data collected through your surveys and the contacts you upload, you are responsible for determining whether your own collection and use of that data involves additional international-transfer obligations.

8. Data retention and deletion

Account and project content, including every saved version of a project, is generally retained while the relevant account, project or organization remains active.
When a trial ends without a paid plan, the organization becomes read-only and its data is kept so that you can export it or choose a plan; we may delete organizations that stay inactive for an extended period after giving notice.
When you delete a response, contact, project, organization or account, associated data is removed from active systems according to the Service’s deletion processes. Deleting a response is permanent and is recorded in the audit trail without the response’s content.
Unsubscribe, bounce and complaint records are kept for as long as the project’s contact list exists, so that a suppressed address is not emailed again.
Live dashboard share links stop working as soon as you revoke them or your plan no longer includes them.
Residual copies may remain temporarily in backups, logs or disaster-recovery systems until they are overwritten or expire in the ordinary backup cycle.
Security, audit and operational logs are retained only for as long as reasonably necessary for security, debugging, fraud prevention, compliance and operation of the Services.
Billing records are kept for as long as tax and accounting laws require.
We may retain limited information for longer where required by law, necessary to resolve a dispute or necessary to enforce our agreements.

Deletion from active systems does not necessarily mean immediate erasure from every backup copy, but backup data is not ordinarily restored except for disaster recovery or system integrity purposes.

9. Your rights and choices

Depending on where you live, applicable law may give you rights to access, correct, delete, restrict, object to processing of, or obtain a copy of personal data relating to you.

Within the Services, you may be able to:

access and export project data, datasets, generated code and research bundles;
correct account information;
delete individual survey responses;
delete contacts or an entire contact list;
revoke live dashboard share links;
delete projects or organizations where your permissions allow it;
delete your account.

If you received a survey invitation

Every invitation or reminder email sent from Siamang Studio carries an unsubscribe link and supports one-click unsubscribe in mail clients that offer it. Unsubscribing stops further emails from that project immediately. Reporting an email as spam has the same effect. The organization that invited you is the controller of your contact details; if you cannot identify it, write to us and we will help you reach it.

If you are a survey controller and need assistance responding to a respondent’s lawful request, you may contact us and we will provide reasonable assistance consistent with our role as processor and the capabilities of the Services.

If a survey respondent contacts Siamang Labs LLC directly about data controlled by one of our users, we will generally direct the respondent to the relevant survey controller where we can identify that controller.

To make a privacy request concerning your account, email info@siamang-team.org. Please do not post private or sensitive information in a public GitHub issue.

You may also have the right to complain to a competent data-protection or privacy authority in your jurisdiction.

10. Security

We use reasonable technical and organizational safeguards designed to protect information processed through the Services. Depending on the part of the Service, these safeguards include tenant isolation enforced in the database, sandboxed execution of survey builds and analysis without network access, credential hashing, encryption of stored secrets, authentication controls, rate limits and access restrictions.

No online service can guarantee absolute security. You are responsible for using a strong password or a trusted identity provider, protecting API credentials, SSH keys and project secrets, controlling access to your organizations, projects and share links, and configuring your surveys appropriately for the sensitivity of the information you collect.

If we become aware of a security incident affecting personal data, we will take reasonable steps to investigate, contain and remediate the incident and will provide notifications where required by applicable law.

11. Children

Accounts are not intended for people under 16.

If you use a Service to collect personal data from children or minors, you are responsible for determining whether that collection is lawful and for obtaining any parental authorization, consent or other protection required by applicable law.

12. Business transfers and legal disclosures

We may disclose information where reasonably necessary to comply with law, legal process or enforceable governmental requests; to protect the rights, security or integrity of Siamang Labs LLC, the Services or other users; or to investigate abuse or fraud.

If ownership of a Service or substantially all relevant business assets is transferred, information may be transferred as part of that transaction, subject to applicable law. We will continue to apply this Policy until a replacement privacy policy takes effect and will provide notice where required.

13. Changes to this Policy

We may update this Privacy Policy as the Services evolve. The “Last updated” date will change when we revise it.

If a change is material, we will take reasonable steps to bring it to users’ attention through the Services or another appropriate channel.

14. Contact

For privacy questions, requests or data-protection matters, contact:

Siamang Labs LLC
30 N Gould St Ste N
Sheridan, WY 82801
USA

Email: info@siamang-team.org

Siamang Cloud and Siamang Studio are independent beta projects. This Privacy Policy is written in plain language and is intended to describe our current practices. It is not legal advice.