Privacy
How we use visitor data
Effective 6 October 2026. This notice explains how visitor data is processed on sciloop.dev (the “Site”). It is written to meet the transparency requirements of Articles 13 and 14 of the EU and UK General Data Protection Regulation (“GDPR”) and applies to every visitor, wherever they are. The contributor platform at platform.sciloop.dev is covered by its own terms.
This legal version is the governing text. The fairy tale version on this page is an informal summary only; if the two differ, this version prevails.
1. Who is responsible
Sciloop, Inc. (“Sciloop”, “we”, “us”), 1395 22nd St., San Francisco, CA 94107, United States, is the controller of the personal data described here. Contact us about anything in this notice at team@sciloop.dev.
2. What we process
| Category | What it includes | Source |
|---|---|---|
| Usage data | Pages viewed, scroll depth, links and buttons clicked, time on page | Your browser |
| Referral data | Referring website and campaign (UTM) parameters in the URL | Your browser |
| Device data | Browser, operating system, device type, screen size, page performance metrics | Your browser |
| Approximate location | Country, region and city derived from your IP address | Vercel, PostHog |
| Network organisation | Name, domain and type (e.g. company, university, ISP) of the organisation that owns your IP address, and whether it is a VPN or data centre | ipapi.is |
| Session recordings | A replay of page interactions (clicks, scrolling, page changes). Text typed into fields is masked and never recorded. Only with your consent. | Your browser |
| Identifiers | A random visitor ID stored in your browser. Only with your consent; otherwise a daily, non-reversible hash is used to count unique visits. | Your browser, PostHog |
Your IP address is used in transit to derive location and network organisation and, for visitors who have not accepted cookies, to compute a daily-rotating, non-reversible hash used only to count unique visits. It is not stored with analytics data by us or by PostHog. Our hosting provider, Vercel, records IP addresses in short-lived request logs for security and operations (currently retained for about one day). To avoid repeat lookups, our server keeps a salted, non-reversible key derived from your IP address in memory for up to one hour; it is never written to disk.
Apart from the form described below, we do not collect names, email addresses or other contact details on the Site. Network organisation data is used to understand interest at the level of organisations, not individuals. Because the owner of a very small or personal network can sometimes be a single person, we do not use these lookups to identify, profile or contact individuals, and we do not combine them with other data to do so.
Expert contact list
If you join the expert list (/experts/join), we store your name, email, field of expertise and, if you choose to provide them, a profile link and your CV. Joining the list is not an application and does not guarantee work.
3. Why we process it, and on what legal basis
- Measurement without device storage (visit counts, pages, referrers, device data, approximate location, network organisation): to understand how the Site is used and which organisations are interested in Sciloop, including by looking up the organisation that owns a visitor's IP address. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR) in operating, improving and marketing the Site. We have assessed that this does not override your interests, because nothing is stored on your device, IP addresses are not retained with analytics data, and lookups are not used to identify individuals.
- Cookies, persistent identifiers and session recordings: to recognise returning visitors and see where people get stuck. Legal basis: your consent (Art. 6(1)(a) GDPR, and Regulation 6 PECR / Art. 5(3) ePrivacy Directive), given through the cookie banner. Nothing in this category runs until you click “Accept”.
- Expert contact list: to contact you if we have work in your field. Legal basis: your consent (Art. 6(1)(a) GDPR), given when you join the list. You can withdraw it at any time by emailing us, and we will delete your details. Your details are reviewed by our team and are not used for automated decisions.
- Strictly necessary storage: remembering your cookie choice and display preferences. This is exempt from consent because the Site cannot honour your choice without it.
4. Cookies and browser storage
| Name | Purpose | Type | Duration |
|---|---|---|---|
__ph_opt_in_out_* | Records whether you accepted or declined analytics cookies | Strictly necessary | Until you reset it |
ph_*_posthog | Random visitor and session ID used by PostHog analytics | Analytics (consent) | Up to 1 year |
sciloop_visitor_org | Caches the network-organisation lookup for the current tab. Only stored after you accept; otherwise the lookup is held in page memory and nothing is written to your device. | Analytics (consent) | Until the tab is closed |
sciloop_privacy_version | Remembers which version of this notice you prefer | Functional | Until cleared |
5. Who receives it
We use the following service providers, who process data only on our documented instructions under data processing agreements:
- PostHog, Inc. (United States): product analytics and session recordings.
- ipapi.is (Berlin, Germany): network-organisation lookup. It receives your IP address for the lookup only.
- Vercel, Inc. (United States): website hosting and approximate geolocation.
- Supabase, Inc. (United States): database and private file storage for the expert contact list and CVs.
If you book a call with us, the booking is handled by Calendly, which processes the details you enter under its own privacy policy.
We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising. We may disclose data where required by law.
6. International transfers
PostHog and Vercel process data in the United States. PostHog, Inc. is certified under the EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. Data Privacy Framework, and Vercel, Inc. is certified under the EU–U.S. Data Privacy Framework; transfers to them rely on the corresponding adequacy decisions (Art. 45 GDPR). Where a certification does not cover a transfer, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum (Art. 46 GDPR), including for Supabase, which stores expert contact data in the United States. ipapi.is processes data in Germany, so no international transfer takes place for that service. You can request a copy of the relevant safeguards at team@sciloop.dev.
7. How long we keep it
- Analytics events: kept only as long as they are useful for the purposes above. We review stored analytics data at least once a year and delete data we no longer need.
- Session recordings: 30 days, then deleted automatically.
- IP addresses: not stored with analytics data; held in hosting request logs for about one day; a salted in-memory key for up to one hour.
- Expert contact list and CVs: up to 24 months after you join or after our last contact with you, then deleted. You can ask us to delete your details at any time.
- Browser storage: as listed in section 4.
8. Your rights
Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing (including processing based on legitimate interests, Art. 21 GDPR), and to data portability. Where processing is based on consent, you can withdraw it at any time without affecting processing that took place before. California residents have equivalent rights to know, delete and opt out under the CCPA/CPRA.
To exercise any right, email team@sciloop.dev. We will respond within one month. Because we do not hold names or contact details for visitors, we may ask for information that helps us locate your data, such as the approximate time of your visit. You also have the right to complain to a data protection supervisory authority, such as the one in your country of residence.
Change or withdraw your cookie consent here at any time:
9. Other information
- No automated decisions. We do not make decisions with legal or similarly significant effects based solely on automated processing.
- Not required. You do not have to provide any of this data. Declining cookies does not limit your use of the Site.
- Children. The Site is intended for professionals and is not directed at children under 16.
- Security. Data is encrypted in transit, access to analytics is restricted to authorised staff, and our providers maintain recognised security certifications.
- Changes. We will update the effective date above when this notice changes, and highlight material changes on the Site.