Legal
Privacy Policy
- Effective
- Applies to
- syrosin.com
1. Who we are
This policy explains how Syrosin (“Syrosin”, “we”, “us”) handles personal information on syrosin.com (the “Site”). We are responsible for that information as its controller. You can reach us about anything in this policy at privacy@syrosin.com.
It does not cover TYPEMUSE, including its pre-registration and emails, which is described at typemuse.com/privacy, or other websites we link to.
2. What we collect
When you visit
- Request data. Our hosting provider, Cloudflare, processes your IP address, browser and device details, the page you request and the referring page in order to deliver the Site and protect it from attacks. Cloudflare may set strictly necessary security cookies, such as
__cf_bm, to tell people from bots. - Cloudflare Web Analytics. Counts page views, referrers, countries and device types in aggregate. It uses no cookies or local storage, does not fingerprint your device and does not follow you across sites.
- Google Analytics — only where described in How the Site is measured: the pages you view and how you arrived, device and browser type, approximate location derived from your IP address, and a random identifier stored in first-party cookies.
When you contact us
If you email us, we receive your email address, your name if you include it, your message and anything you attach.
What we don’t collect
The Site has no accounts, sign-ups, comments or payments, and it asks for nothing about you. We do not collect sensitive information, and we do not buy information about you from others.
3. How the Site is measured
We measure the Site in two layers, and neither is used for advertising:
- Cloudflare Web Analytics runs for everyone and is cookieless.
- Google Analytics loads only after the page has finished loading, and only when all of these are true: your browser does not send a Global Privacy Control signal; you have not turned it off below; and our server, from the country Cloudflare associates with your connection, confirms you are outside the European Economic Area, the United Kingdom and Switzerland. If your country is unknown, it does not load. Visitors in those regions are never sent to Google.
Where Google Analytics runs, advertising features, Google signals, ad personalization and data sharing with Google are turned off, so Google processes this information on our behalf. It sets these first-party cookies:
| Cookie | Purpose | Expires |
|---|---|---|
_ga | Distinguishes visitors with a random identifier | 2 years |
_ga_H72G4GT58K | Keeps the state of a visit | 2 years |
Google explains how it processes this information in How Google uses information from sites that use its services.
Your choice on this browser
Checking your settings…
4. How we use information, and our legal bases
| Purpose | Legal basis (EEA, UK, Switzerland) |
|---|---|
| Delivering the Site and keeping it secure | Our legitimate interest in operating a safe, reliable website |
| Measuring how the Site is used, in aggregate, to improve it | Our legitimate interest in understanding our audience |
| Answering your messages | Our legitimate interest in responding to you, or steps you ask us to take before an agreement |
| Meeting legal obligations and protecting our rights | Legal obligation; our legitimate interest in defending legal claims |
You don’t have to give us any personal information to use the Site; if you don’t email us, we can’t answer you. We do not make decisions about you based solely on automated processing.
5. Who we share information with
We share personal information only with:
- Cloudflare, Inc. — hosting, security, cookieless analytics and email routing, as our service provider.
- Google LLC — Google Analytics where it runs, and our email service, as our service provider.
- Authorities and others where the law requires it, or where needed to protect the rights, safety or security of our users, the public or us.
- A successor in a merger, acquisition or sale of assets, subject to this policy.
We do not sell or share personal information as those terms are defined in US state privacy laws, and we do not use it for targeted advertising. We require our service providers to protect it and to use it only to provide their services to us.
6. International transfers
Our service providers process information in the United States and in other countries where they operate. Where the law requires it, transfers rely on appropriate safeguards, such as the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, under which Cloudflare and Google are certified, or the European Commission’s Standard Contractual Clauses.
7. How long we keep information
| Information | How long |
|---|---|
| Google Analytics event data | 14 months |
| Cloudflare Web Analytics | Aggregated only, without identifiers |
| Cloudflare request and security logs | For the short periods Cloudflare needs to operate and protect the Site |
| Emails and requests you send us | As long as needed to help you, then up to 24 months as a record |
8. Your rights
Everyone. You can ask us what personal information we hold about you, and ask us to correct or delete it. We honor these requests wherever we reasonably can.
EEA, United Kingdom and Switzerland. You also have the rights to restrict processing and to data portability, and to complain to your data protection authority — we would appreciate the chance to help first.
Your right to object. Where we rely on our legitimate interests, you can object at any time on grounds relating to your particular situation, and we will stop unless we have compelling legitimate grounds or need the information for legal claims.
United States. Depending on your state, you have the rights to know, access, correct and delete personal information, to receive a portable copy, to appeal our decision, and not to be discriminated against for using these rights. We do not sell or share personal information, and we treat a Global Privacy Control signal as a request to opt out on this browser.
How to ask. Email privacy@syrosin.com with the subject “Privacy request” and tell us what you would like us to do. Because the Site has no accounts, we will ask only for what we need to find the information — for example, the email address you wrote from. We respond within one month in the EEA, UK and Switzerland and within 45 days in the United States. To appeal a decision, reply with the subject “Privacy appeal”.
9. Children
The Site is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, contact privacy@syrosin.com and we will delete it.
10. Security
The Site is served over HTTPS with strict security headers, runs no server-side code beyond a one-bit region check, and stores nothing about you. No system is perfectly secure; if you find a vulnerability, see our security page.
11. Changes to this policy
We will update this policy when the Site or the law changes, and post the new version here with a new effective date. If a change materially affects how we use information you have already given us, we will say so on this page before it takes effect.
12. Contact
Privacy questions and requests: privacy@syrosin.com. You can write to us in English; we will do our best to help in other languages.