What we collect, and what we never do with it.

This policy says what SYSWERX LLC collects through this website and through its software, why, and what happens to it. In short: this website counts visits with its own counter and no trackers; a demo request goes to our inbox and nowhere else; and a customer's data belongs to the customer, lives in the United States, and is never sold, shared with other customers or used to train a model.

Who we are

SYSWERX LLC ("SYSWERX", "we"), a South Carolina limited liability company, makes research security software for universities and research institutions. Questions about this policy go to [email protected].

This website

• Visit counting. This site counts visits with its own counter. It records the page, the referring site, the organization and approximate location of the visitor's network, the device and browser type, time on page and scroll depth, and a random identifier kept in your browser to count unique visitors. No IP addresses are kept. There are no third party trackers, advertising pixels or analytics services.
• Your choice. The counter does nothing when your browser sends Global Privacy Control or Do Not Track. Clearing your browser's site data removes the identifier.
• Cookies. The public pages set no cookies. One cookie is set after a customer signs in, and only to keep that person signed in.
• Security logs. Cloudflare sits in front of the site to block attacks and sees the connecting address, as any network provider does. Our server keeps short lived request logs for security and troubleshooting.

Demo requests and email

When you request a demo, you give us your name, your institution, a work email and, if you like, a note. That goes by email to our support inbox so we can reply. We use it to answer you and to set up a demo, we keep it in that mailbox, and we do not add you to a mailing list, sell it or share it. Email us at the address above to have it deleted.

Customers and their users

• Accounts. For each person on a customer's team we keep a work email, a name where given, a role and the team they belong to. Accounts are issued by invitation.
• Signing in. Sign in uses a link sent to the person's work email, which works once. A session ends after 60 minutes idle.
• Notifications. The software sends email about the team's own work: a case assigned, a request due, a travel debrief overdue. Each person controls what they receive.
• Billing. Invoices and payments run through Stripe, which receives the institution's billing details and never any researcher data.

Researcher data handled for customers

A customer uses SYSWERX to screen and review researchers. In that work the customer decides whom to review and why; SYSWERX processes the data on the customer's instructions to provide the service.

• What is processed. Names and public identifiers, the public record behind them (publications, funding, patents, affiliations), the findings the software draws from that record, the team's own notes, requests and decisions, and documents a user chooses to keep, such as a CV or a disclosure form.
• Where it lives. In the United States: the application on Render in Oregon, the database and documents on Supabase on AWS in the U.S. West region.
• Who sees it. The customer's own team, by role. SYSWERX staff reach customer data only to support the customer or to keep the service running, and never share it with another customer.
• What we never do. Sell it, share it with other customers, use it to train any model, or use nationality, ethnicity, national origin or name as a scoring factor.
• How long. While the customer's account is active. Deleting a team deletes its records and documents. At the end of an agreement, on written request, we return the data and then delete it; copies in routine backups are deleted on their normal schedule.

If you are a researcher who believes an institution reviewed you with SYSWERX and you have questions about that review, the institution is the right place to ask: it decides whom it reviews and holds the record. We will help an institution answer such a request.

Service providers

Provider	What it does	What it receives
Render	Runs the application	Everything the application handles, in Oregon
Supabase (on AWS)	Database, sign in, document storage	Customer records and kept documents, in the U.S. West region
Cloudflare	Network security in front of the site	Connection details of every request
Resend	Sends email	Addresses and the messages sent
Stripe	Billing	Institutional billing details only

The public record services the software reads receive the lookup itself, a name or an identifier, and nothing from a customer's records.

Your choices and rights

Write to [email protected] to ask what we hold about you, to correct it, or to have it deleted. We answer within 30 days. Where a law such as a state privacy act gives you further rights, we honor them.

Children

This website and the software are for institutions and their staff. They are not directed at anyone under 18, and we do not knowingly collect information from children.

Changes

When this policy changes, the date at the top changes with it. A change that affects customers' data is also sent to the customer's Lead by email.