Privacy policy

This policy explains what Sigmer does with personal information. It covers three situations, and which one you are in changes what applies to you.

• You are reading this website. It records very little: section 4 says what, and section 11 says what it keeps on your device, which is nothing.
• You use Sigmer as a researcher, or you are a member of a workspace. All of this policy applies to you.
• You took part in a study that runs on Sigmer. Your answers belong to the research team that ran the study, and we hold them for that team. section 3 explains what that means, and section 7 is written for you.

We have written it in plain language on purpose. If anything in it is unclear, ask us and we will explain.

Sigmer, of Charlottetown, Prince Edward Island, Canada, makes Sigmer, software for research with people.

Our privacy officer is responsible for how we handle personal information, and for this policy. For a question, a request about your information, or a complaint, write to hello@sigmer.io and mark it for the privacy officer.

This section matters most, so it comes early.

Information about the people who use Sigmer

When a researcher creates an account or joins a workspace, we decide what we collect about them and why, and we are responsible for it under this policy. That covers your account, your workspace's members and billing, and the record of what is done in Sigmer.

Information about the people who take part in studies

A study belongs to its research team. The team, or the institution it works for, decides what the study asks, who on the team can see the answers, and how long they are kept. We hold and process participant data on the team's behalf and on its instructions, to run the study, and for no purpose of our own. The terms of use set out what we commit to research teams about it.

So if you took part in a study and want your answers explained, corrected or deleted, the research team is the place to start. If you cannot reach them, write to us, and we will help you find them and pass your request on.

We do not sell or share anyone's personal information, in any sense of the word, and we do not use it for advertising. If your browser sends a Global Privacy Control signal, we treat it as a request not to, which is already what we do.

If you read this website

Like every website, it is served by computers that record each request: the page asked for, the time, your IP address and your browser. Those records are kept by our hosting provider, Google Cloud, to keep the site running and secure, and are deleted after thirty days. If you write to us, we keep your message and your email address so that we can answer you.

If you use Sigmer

• Your account: your name, your email address, a profile picture if your sign-in provider supplies one, and your password, which our sign-in provider, Google, stores only in a scrambled form that is not reversible. If you work in a workspace kept in another region, your name and email address are copied into that region, so that your colleagues there can see who did what, and so is the public half of your account key if you use Sealed studies.
• Which workspaces you belong to or are invited to, and which region each is kept in, recorded by identifier only, so that Sigmer knows where to find your work when you sign in. This record holds no names, addresses or content.
• Your workspace: its name, its members and their roles, and the email addresses of the people you invite.
• Your work: the projects, plans, ethics documents, studies, analyses, manuscripts, references and comments you and your colleagues write in Sigmer.
• Connections you set up: the access tokens of other services you connect to Sigmer, which we store encrypted, and the Sigmer API keys you create, of which we keep only a scrambled form.
• Academic pricing, if you ask for it: the institutional address you name, to which we send a confirmation link. Once it is confirmed, we keep the institution's domain, the part of the address after the @, and the date, not the address.
• Billing: your plan, its status and your invoices. For a workspace kept in the United States, card payments are handled by Stripe, which receives your email address, your billing address and the workspace's identifier, and holds your card details. A workspace that pays by invoice also gives Stripe its billing email address and purchase order number. We never see your full card number. A workspace kept in Canada does not pay through Sigmer, and no card details are collected for it.
• The audit log: a record of what was done in each workspace and by whom, with that person's name and email address at the time, including each time a study's stored responses were read. It records that something was done, never the content of anyone's answers. A workspace's audit log is kept in the workspace's region. Your account's own log, kept in the United States, records when you signed in and out and when you closed your account.
• What you write to us, when you contact us.

We use no analytics, advertising or crash-reporting service, in Sigmer or on this website.

If you take part in a study

What a study collects is decided by its research team. Depending on the study, that can include:

• your answers, including any recording or file the study asks for;
• a record of the consent you gave: a fingerprint of the exact consent text you were shown, and which optional agreements you ticked;
• a participant code, or the ID a recruitment service gave you, where the study uses one;
• your name and contact details, if the study asks for them, which are kept apart from your answers;
• signals the research team can use to judge whether answers were given with care, such as whether text was pasted into an answer, whether you switched to another window during a timed task, and how long you took;
• for a study in parts over days or weeks, your time zone, when each part opened, started and ended, and the facts from your answers that the study uses to decide what comes next;
• if you allow a study to send you browser notifications, the address your browser gives for sending them;
• when each part of your answers was started and sent;
• if the study invites you back by email, whether each invitation arrived, bounced or was marked as spam, and whether you asked to stop.

Your IP address is used, in a scrambled form, to limit how many requests can come from one place; that record lasts a few minutes and is then deleted automatically, usually within a day. It is not stored with your answers. The request records described above apply to study pages too.

A study whose answers go straight to the research team's own storage is still served from Sigmer, so those records apply to it as well. If a delivery there is delayed or fails, your browser tells us so, without your answers, so that the research team can see it; that note is deleted when the delivery succeeds, or after thirty days. A study that delivers to the Open Science Framework sends its answers through Sigmer on the way, and we keep a count of them for thirty days.

We use personal information:

• to provide Sigmer: to run your account, your workspace and your studies, and to deliver participants' answers to their research team;
• to take payment, issue invoices, and confirm eligibility for academic pricing;
• to send the emails Sigmer needs to send, which section 12 lists;
• to keep Sigmer and the data in it secure, to keep the audit log, and to prevent and investigate abuse;
• to answer you when you write to us;
• to meet our legal, tax and accounting obligations.

We do not use personal information for advertising, we do not sell it, and we do not use it to train artificial intelligence models.

We rely on your consent where the law requires it, and otherwise on the need to provide the service you asked for, our legitimate interest in running and protecting it, and our legal obligations. Participant data is collected under the consent, or other authority, that the research team obtained, and we process it only for that team.

Each study has a protection level, chosen by its research team, and each sentence below names the studies it applies to.

Everything sent between your browser and Sigmer is encrypted in transit. Account information is stored with Google Cloud, which encrypts it at rest, and only the people who run Sigmer can reach it. The security page sets out each protection level in full, and lists what Sigmer does not offer yet.

Sigmer emails a participant only when their study asks it to, for example to send a participant code so that they can come back to the study. Those emails are sent for the research team. The page for participants explains more.

We share personal information with the companies that help us run Sigmer, only as far as they need it, and under contracts that require them to protect it and use it only for the work we give them. These are the companies that receive personal information from Sigmer today:

Google, Amazon, Stripe and Resend are United States companies. Keeping a workspace in Canada decides where its data is stored and processed, not which country's law can reach the companies that hold it.

Stripe also uses payment information for its own purposes, to prevent fraud and to meet the rules that apply to payment companies, and for those purposes its own privacy policy applies.

When you use Sigmer as a researcher, your browser also fetches parts of the application from content networks run by Google and jsDelivr, and, when a feature that runs a model on your own device needs one, from Hugging Face. Those services see your IP address, as any website you visit does, and receive none of your work.

We will update this list at least thirty days before a new provider starts receiving personal information, and tell workspace owners when we do.

We also share information where the law requires it, such as under a court order; where we need to establish or defend a legal claim; or to prevent harm to someone. If we receive a demand for a study's participant data, we will tell its research team, unless the law forbids us to. If Sigmer is ever sold or merged with another business, information may pass to the new owner, bound by this policy, and we will tell you before it does.

Each workspace is kept in one region, chosen when it is made: the United States or Canada. A workspace stays in the region it was made in.

For a workspace kept in Canada, its projects, studies, team, audit log, participants' answers, panels and schedules, and the keys that protect them, are stored and processed in Canada, in Montreal, and any email to its participants is sent from Canada. For a workspace kept in the United States, all of that is in the United States.

Your personal workspace is kept in the home region you choose when you sign up.

Whatever region your workspace is in, some things are kept in the United States: your account and your sign-in; the record of which workspaces you belong to, by identifier only; payment records; and the emails we send to researchers.

Where information is in the United States, it is subject to the law of the United States, and the courts, law enforcement and national security authorities there may be able to obtain it. The companies we use in Canada are United States companies too, so keeping a workspace in Canada decides where its data is stored, not which country's law can reach those companies. We say this plainly because Canadian privacy law expects us to.

Wherever information goes, we remain responsible for it, and we require the providers we send it to to protect it to a comparable standard. A study can instead deliver its answers straight to storage the research team holds, sealed or not. An S3-compatible bucket stays in the region the team created it in; a Firebase project that Sigmer sets up for the team keeps its database in the United States.

• Participants' answers are kept for as long as the research team decides. A study can declare a retention period, after which its answers are erased automatically; otherwise they are kept until the team erases them or deletes the study.
• Your account information is kept while your account is open. When you close your account, your sign-in is deleted, and in every region you worked in your memberships end, your invitations are withdrawn and your name and email address are removed from your profile. If a region is out of reach at that moment, your account stays open until it can be reached, and you can try again.
• A workspace's work is kept until the workspace deletes it, or until we delete it after ending our agreement, as the terms of use describe.
• Audit log entries are kept after the account or workspace they mention has been deleted, because they are the record of what happened to participant data. They hold the name and email address of the person who acted, and never anyone's answers. We have not yet set a period after which they are deleted; when we do, it will be stated here.
• Invoices and payment records are kept for at least six years, because tax law requires it; at present we do not delete them after that.
• Records of requests to this website and to study pages are deleted after thirty days, and short-lived working records, such as a note that a delivery happened, are deleted automatically, most of them within thirty days.

Each region's databases keep their own copies for recovery, in that region, for about a week, so information deleted from the live service can remain in a copy for up to that long.

If an email to a participant bounces, or they mark it as spam, our email provider adds the address to its own list of addresses not to write to again, and keeps it there until we ask for it to be removed. Erasing a participant's data in Sigmer does not remove the address from that list; ask us, and we will.

This website sets no cookies and stores nothing on your device.

Sigmer's application for researchers sets no cookies of its own. It keeps you signed in, to each region your workspaces are in, and keeps in your browser's storage on your device: your unsaved drafts, for up to thirty days; your preferences and the region you last opened; your account's keys and the keys to any Sealed study or project you can open; and, while you are signed in, the panel members you are allowed to see, which are removed when you sign out. It may use Google's reCAPTCHA to check that requests come from Sigmer's own application, and Google may set its own cookies when it does.

When you pay, you do so on a checkout page that Stripe runs, and Stripe sets its own cookies there to prevent fraud.

In a Sealed study, answers waiting on your device are sealed before they are stored there; in a Confidential study they are kept there as written until they are delivered. A study page also keeps what it needs to let you resume, for up to twelve hours, and, if you install a study on your phone, which study you joined, for up to six months.

Clearing your browser's storage removes all of this. For a participant, that means answers not yet delivered are lost; for a researcher, it means keeping a copy of your Sealed study keys somewhere else first.

We send researchers the emails Sigmer needs to work: invitations, email confirmation and password resets, the academic confirmation link, notices about access, tasks, reviews and studies, a workspace or project being deleted, notices about your plan's limits, and alerts you have set up. These are service messages.

A study can also ask Sigmer to email its participants, for example to send a participant code. Every email that invites a participant back to a study has a link to stop, and using it ends that person's part in the study's schedule, just as if the research team had ended it. For those emails, our email provider tells us whether each one arrived, bounced or was marked as spam: marking one as spam also ends that person's part in the schedule, and an address that does not exist is not written to again. A participant code email has no such link, because it is how the participant gets back into the study.

We do not send marketing email. If we ever do, we will ask first, and every marketing email will let you unsubscribe.

Sigmer's assistant is switched off. Apart from the two uses below, Sigmer sends no one's work and no participant data to an artificial intelligence model.

• Notes and papers you add to a project are indexed by a Google Cloud model in your workspace's region, so that they can be searched.
• Transcribing a recording, where a study collects one, runs a model on the researcher's own device, so the recording is not sent anywhere to be transcribed.

Before the assistant is switched on, we will update this policy and name the providers it uses. In a workspace kept in Canada, it will start switched off, and the workspace's admins decide whether to turn it on, after being told that its requests go to a provider outside Canada. We do not train models on anyone's information.

Wherever you live, you can ask us to:

• tell you what personal information we hold about you, why, and who we have shared it with;
• give you a copy of it, in a commonly used electronic format;
• correct it if it is wrong;
• delete it, where we are not required to keep it;
• restrict how we use it, or object to a use, where the law where you are gives you that right;
• withdraw a consent you gave us. We will tell you what that changes, for example that we can no longer provide part of Sigmer to you.

Write to hello@sigmer.io. We will confirm we have your request, ask for what we need to be sure it is you, and reply within thirty days. If we need up to thirty days more, we will tell you why within the first thirty, and remind you that you can complain to the Office of the Privacy Commissioner of Canada about the delay. We do not charge for this.

If your request is about participant data, the research team decides what happens to it, so we will pass your request to them and tell you we have.

Decisions made automatically

Sigmer makes no decision of its own about anyone by automated means. A research team can set a study up to route participants automatically, for example to end a study early for someone who does not meet its criteria, or to choose which part comes next. Ask the research team about any such decision, and they can explain it.

If we say no

If we refuse a request, we will tell you why in writing. You can ask us to look at it again, and we will reconsider and write back with our decision and our reasons.

Complaining to a regulator

If you are not satisfied, you can complain to a privacy regulator. In Canada that is the Office of the Privacy Commissioner of Canada, or the regulator of your province where it has its own: in Quebec, the Commission d'accès à l'information. In the European Union or the United Kingdom, it is the data protection authority where you live or work.

Sigmer's application for researchers is for adults. We do not knowingly hold an account for anyone under eighteen.

Some studies are about children, or ask children to take part. Whether one may is for the research team and its ethics board to decide, along with how a parent or guardian gives consent. Where the law sets an age below which a parent must consent, such as fourteen in Quebec, the research team must obtain that consent before the child takes part.

If you believe a child's information is in Sigmer when it should not be, write to us and we will work with the research team to delete it.

No service is perfectly secure, and we will not pretend otherwise. If a breach of our security creates a real risk of significant harm to someone, we will report it to the Office of the Privacy Commissioner of Canada and to any other regulator the law requires, and tell the people affected, and any organisation that can reduce the harm, as soon as we can. If it affects participant data, we will also tell the research team without undue delay, so that it can meet its own obligations. We keep a record of every breach of our security, whether or not it had to be reported.

If you think you have found a security problem in Sigmer, please tell us at hello@sigmer.io before telling anyone else, and we will work with you on it.

A study goes wherever its research team sends it, so participants can be anywhere. If the law where you are gives you rights over your information, as the law of the European Union and of the United Kingdom does, we will help you use them. For participant data, the research team decides, so we will pass your request to them and help them answer it.

Where the law of the European Union or the United Kingdom applies to information sent to us, we rely on the recognition both give to Canada's private-sector privacy law. Google, which stores the information in the United States, or in Canada for a workspace kept there, relies on the EU-US Data Privacy Framework and on standard contractual clauses approved by the European Commission.

If you are a researcher outside Canada, the rules of your own country and institution may ask more of you, or of us, than this policy says. Tell us what they require, and we will tell you plainly whether Sigmer can meet it.

We will update this policy as Sigmer and the law change. The date at the top says when it last took effect, and we keep every earlier version and will send you any of them on request.

If a change materially affects you, we will tell you before it takes effect, by email to the address on your account or by a notice in Sigmer. Any other change takes effect when we post it.

Sigmer, Charlottetown, Prince Edward Island, Canada. Write to hello@sigmer.io for a privacy question, a request about your information, or a complaint, and mark it for the privacy officer.

Our terms of use are the agreement between Sigmer and the people who use it.