Open Admin Panel

Privacy Policy

How we handle personal data on this website, under the EU General Data Protection Regulation (GDPR / DSGVO).

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4 (7) GDPR is:

Florian Lehmann Kunigundenstr. 23, 80802 Munich, Germany
Email: contact@studyalign.com

2. Scope of this policy

This policy covers the public StudyAlign landing page. It is a static website: it does not set tracking or advertising cookies, does not use analytics, and does not load fonts, scripts or other resources from third-party content-delivery networks. Data collected inside an actual StudyAlign study is handled separately; see section 6.

3. Data processed when you visit this site

When you open a page, your browser necessarily transmits technical data to the server, which the hosting infrastructure records in temporary server access logs. This typically includes:

  • your abbreviated or full IP address,
  • the date and time of the request,
  • the page or file requested and the HTTP status returned,
  • the amount of data transferred,
  • the referring URL, if any, and
  • your browser type, version and operating system (user agent).

Purpose and legal basis: this processing serves to deliver the website reliably, to ensure the stability and security of the infrastructure, and to defend against attacks. The legal basis is our legitimate interest under Art. 6 (1) (f) GDPR in operating a functional and secure website.

Retention: access logs are kept only for as long as needed for these purposes and are then deleted or anonymised. Longer retention occurs only where required to investigate a concrete security incident.

4. Hosting

The website is served by a web server (nginx) running in our own infrastructure behind a reverse proxy. Any processing carried out by a hosting or infrastructure provider on our behalf is governed by a data-processing agreement under Art. 28 GDPR. No usage profiles are created.

5. Contacting us

If you contact us by email, the data you provide (your email address, your message, and any details you include) is processed to handle your enquiry. The legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in responding) and, where your request relates to entering into or performing a contract, Art. 6 (1) (b) GDPR. We keep this correspondence for as long as needed to deal with your request and to meet any statutory retention obligations, after which it is deleted.

6. Data collected inside a StudyAlign study

StudyAlign is software used by researchers to run their own studies. When you take part in a specific study, the controller for that study is the research team or institution running it, not this landing page. Each study defines its own consent, information sheet and privacy terms, which are shown to you before you take part and which take precedence for that study.

As a fallback, so you know what is typically involved even before you reach a specific consent form, a StudyAlign deployment may store the following categories of data when a study is run:

  • Study parameters: the study, condition and participant identifiers passed in the participation link (these are usually pseudonymous codes rather than your name).
  • Interaction logs: native browser events such as mouse movements and clicks, keyboard input, touch and scroll events, together with timestamps, plus any custom events the prototype records.
  • Questionnaire responses: the answers you give in linked surveys (for example on a hosted LimeSurvey or Qualtrics instance), which are stored by that survey provider and associated with your participant code.
  • Technical metadata: information such as browser type, language, screen or viewport size and coarse device characteristics, used to interpret the interaction data.

How it is stored and transmitted: this data is transmitted over an encrypted HTTPS connection and stored in the backend database of the deployment operated by the research team running the study. It is used to analyse the interaction being studied. Depending on the study design, data may be pseudonymised or anonymised for analysis and publication.

Legal basis: for research participation this is normally your explicit consent under Art. 6 (1) (a) GDPR (and Art. 9 (2) (a) GDPR where special-category data is involved), which you can withdraw at any time with effect for the future, or another basis stated in that study's own information. For details of a particular study, including its controller, retention period and how to exercise your rights, please refer to that study's consent and information materials or contact the research team that invited you.

7. No cookies or tracking

This landing page does not use cookies that require consent. It sets no analytics, profiling or advertising identifiers, and does not embed third-party tracking. Individual studies run with StudyAlign may use strictly necessary technical storage; if so, this is described in the respective study's own terms.

8. Your rights

Under the GDPR you have, in respect of your personal data, the right to:

  • access your data (Art. 15),
  • rectification of inaccurate data (Art. 16),
  • erasure (Art. 17),
  • restriction of processing (Art. 18),
  • data portability (Art. 20), and
  • object to processing based on legitimate interests (Art. 21).

Where processing is based on consent, you may withdraw that consent at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal. To exercise any of these rights concerning this website, contact us at contact@studyalign.com. For rights concerning a specific study, contact the research team running it.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for public bodies in Bavaria is the Bavarian Data Protection Commissioner (Der Bayerische Landesbeauftragte für den Datenschutz, BayLfD), Wagmüllerstraße 18, 80538 Munich, Germany.

10. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR on this website.

11. Changes to this policy

We may update this policy to reflect changes to the website or to legal requirements. The current version always applies, as published on this page.

This policy is provided in good faith for a university research project and reflects the current, analytics-free setup of this landing page. Please have it reviewed and confirmed by the University of Bayreuth's Data Protection Officer, and align it with each deployment's actual processing, before going live.