Privacy Policy.

1. Controller and Contact Details

The controller of your personal data is SustematiQ Sp. z o.o., with its registered office at ul. Św. Judy Tadeusza 8F, Unit 1, 55-095 Domaszczyn, Poland, entered in the National Court Register (KRS) under number 0001253359, NIP 8961670119, REGON 545235400. You can contact us at info@sustematiq.com.

We have not appointed a Data Protection Officer. Privacy-related questions can be sent to info@sustematiq.com.

2. Data We Process by Context

We collect and process personal data in the following contexts:

• Server Logs (every visit): When your browser asks our server for a page or a file, the web server writes one line to a log: your full IP address, the date and time, the address requested, the answer code and size, and what your browser sends about itself (for example the user agent and the referring page). It does not record cookie values. Why: to deliver the page and to keep the server safe from abuse. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a working and secure service. Where: our server at OVHcloud in Poland (European Union). How long: a log file is closed when it reaches 100 MB; we keep at most 10 closed files, and we delete each one 90 days after it was closed. On a site with few visits a file can take months to fill, so one line can stay for longer than 90 days in total.
• Contact Form: Name, email address, organization name, type of inquiry, and message details.
• Alpha Access Requests (Mate and FoQus): When you ask for access to the Mate alpha (on trymate.eu or on this site) or to the FoQus alpha, we receive your name, email address, an optional note, the language of the form, your consent choice and its time, and a hashed IP address and hashed user-agent. We store the request in our database and send a notification about it to our team mailbox. If our database is not reachable at that moment, the notification email is the only copy. If we accept your request, we create an account for you at our sign-in provider WorkOS with your email address and name, give that account access to the alpha, and send you one email to say so. We do not send you marketing.
• Bot Check on Forms (Cloudflare Turnstile): When you open a page with one of our forms, the form loads a check from Cloudflare that tells people from automated spam. Cloudflare receives your IP address, details about your browser and its connection, and the address of our page. We receive only the result of the check.
• FoQus Sign-in (WorkOS hosted): When you choose sign-in, your browser sends the email address and credential you enter on WorkOS’s hosted page, any information your chosen social or enterprise identity provider passes to WorkOS, and your IP address and user-agent as the page loads. The request goes directly from your browser to WorkOS; we do not proxy or forward those inputs. WorkOS returns to us transiently its opaque user identifier, email address, email-verification status, first name, last name, and, where provided, an organization identifier. The only identity values we persist in the authentication mapping are our own subject ID and WorkOS’s opaque provider subject ID. The database also records creation timestamps and, after erasure is carried out, an erasure timestamp. We do not persist the returned email address, names, email-verification status, organization identifier, or refresh token.
• FoQus Guest Mode: Ephemeral session state. No personal data is transmitted to SustematiQ server-side.
• FoQus Local Profile Mode: Progress, preferences, statistics, badges, and reflections stored locally on your device.
• FoQus Online Profile (form): Submitted profile details (name, email address, optional profile note, source, consent choices, profile status, public ID, hashed IP address, hashed user agent, and timestamps).
• Optional Local-Only Reflections: Feedback or reflections written after sessions are stored in the browser only.
• Website Analytics (self-hosted, cookieless): Page address, referring website, browser, operating system, device type, screen size, language, and approximate location (country, region and city). Umami does not store your IP address, no identifier is written to your device, and the records hold no name or email address. Your browser sends the statistics to stats.sustematiq.com; like every request to our server, this leaves one line with your full IP address in that server's log (see Server Logs above).
• “You Gave AI WHAT?!” Game — web (yougaveaiwhat.com): When you finish a game, or leave a game after you answered at least one game question (profile questions alone do not count), your browser sends us the game result (a game you leave before you answer a game question is not sent, and closing the tab during a game discards it): your answers to the game questions (for example the type of computer and phone you use, your role at work, which apps you picked and which AI helpers you liked), any text you type into an “other” field, the game language, whether you finished the game, the start and end time and the duration, a random ID of that game, the game type and station setting, the notice version you acknowledged, the record version, the revision number of the record, your answers again as readable question-and-answer rows, and two internal flags (whether your profile answers are a Mac with an Apple chip, and a fixed label for the page the game links to). We do not store your name, email address, phone number, IP address, user-agent string, or any identifier of your browser or device with the result. Text you type into an “other” field could still identify you. Your IP address is seen in transit when the result reaches our server and appears in our server logs (see “Server Logs” above and section 10); it is not stored alongside the game result. While a result is waiting to be sent, it stays in your browser’s local storage; the browser deletes it the next time the game page runs after 7 days or after 10 failed send attempts, whichever comes first. The browser keeps at most 50 unsent results: when a new one is added past 50, the oldest is deleted. A result that our server rejects as invalid is also deleted. Please do not type personal data into “other” fields.
• “You Gave AI WHAT?!” Game — iPad kiosk at events: When the game runs on the iPad tablets at SustematiQ events, it operates offline. Your game answers are saved on the tablet in the device’s local storage and a backup store (both within the app’s iOS sandbox). They remain there until the event staff exports the collected data after the event. There is no automatic deletion: staff wipe records by exporting the data and then deleting the app’s storage (via iOS Settings or by reinstalling the app). No data is sent over the internet from the kiosk during the game. Each saved record holds your answers, the tablet ID, the language, the date, time and duration, whether test mode was on, a record ID, the record version, the revision number of the record, your answers again as readable question-and-answer rows, the station and game type, whether you finished the game, the notice version, and two internal result flags. Exported records are transferred to SustematiQ’s secure storage and retained for 24 months. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in understanding how people share data with AI tools, to design Mate). You may object to this processing — see section 11.
• Consent Records: The consent choices you tick on a form, stored with the submission they belong to, together with its timestamp.

3. Lawful Bases of Processing

We process personal data based on the following legal grounds under Article 6(1) of the General Data Protection Regulation (GDPR):

• Contact Form: Article 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract) and Article 6(1)(f) GDPR (our legitimate interest in responding to business and project enquiries).
• Alpha Access Requests: Article 6(1)(b) GDPR (steps you ask us to take before we give you access to the alpha) and, for the hashed IP address and user-agent, Article 6(1)(f) GDPR (our legitimate interest in preventing abuse). The account we create when we accept your request: Article 6(1)(b) GDPR.
• Bot Check on Forms: Article 6(1)(f) GDPR (our legitimate interest in protecting our forms against spam and abuse).
• FoQus Online Profile: Article 6(1)(b) GDPR (performance of a contract – providing the requested Online Profile service), Article 6(1)(f) GDPR (our legitimate interest in service security, abuse prevention, and rate limiting), and Article 6(1)(a) GDPR (consent, if you opt-in to optional updates).
• FoQus Sign-in: Article 6(1)(f) GDPR (our legitimate interest in providing a secure sign-in service, recognizing the same signed-in person on later requests, preventing one WorkOS identity from being mapped to two local subjects, and maintaining sign-out). This processing is necessary for the sign-in you ask us to start: without the local identity mapping and session, we cannot associate the completed hosted authentication with a local account. We limit its impact by using hosted authentication, not retaining the credential you enter there, persisting only our own subject ID and WorkOS’s opaque provider subject ID as identity values, and keeping the returned email address, names, verification status, organization identifier, and refresh token out of our database. You may object to this processing as described in section 11; if you object, we may not be able to provide a signed-in session. Nothing obliges you to sign in: signing in is entirely optional, no law or contract requires it of you, and the only consequence of not doing so is that you cannot enter the FoQus closed alpha — nothing else on this site depends on it.
• Website Analytics: Article 6(1)(f) GDPR (our legitimate interest in understanding how our own website is used and improving it). Our analytics writes nothing to your device — no cookie, no browser-storage entry, and nothing that survives you closing the tab — so we ask for no ePrivacy consent and show no cookie banner. It does read what your browser reports as a page loads, including your language and the size of your window, which we keep only as aggregate counts. You may object to this processing at any time — see section 11.
• “You Gave AI WHAT?!” Game (web and iPad kiosk): Article 6(1)(f) GDPR (our legitimate interest in understanding how people share data with AI tools and in using these aggregate insights to design Mate). Web game results contain no contact data and no identifier of you, your browser or your device. We still treat them as personal data, because free text, exact times and the IP address in our access logs could be combined to identify someone. The same basis applies to the iPad kiosk at events; we treat those records as personal data because the combination of answers and event context could identify an individual. You may object to either processing — see section 11.
• Consent Records: Article 6(1)(c) GDPR (compliance with a legal obligation to demonstrate valid consent) and Article 6(1)(f) GDPR (legitimate interest in documentation).
• Server Logs and Hashed IP/User Agent: Article 6(1)(f) GDPR (our legitimate interest in delivering the website, keeping our website and applications secure, preventing abuse, and troubleshooting). This covers the full IP address in the server log and the hashed IP address and user agent stored with a form submission.
• Local-Only FoQus Data: We do not receive or process this data server-side; local browser storage is utilized for requested application functions.

4. FoQus Data Modes

5. Analytics and Cookies

This website uses no advertising, tracking or analytics cookies, and shows no cookie banner. It sets two cookies in total, all of them strictly necessary, all host-only, and none readable by scripts in your browser. Each one delivers something you explicitly asked for, which is why none requires consent under ePrivacy rules.

sustematiq_login_state — set the moment you click sign in, before you have authenticated. It carries a one-time anti-forgery value and the page to return you to. It lasts ten minutes and is deleted when the sign-in round trip finishes, including when sign-in is refused.

sustematiq_session — set only after a successful sign-in. It holds our subject ID, the WorkOS session token, the WorkOS session ID and the session expiry. It is encrypted with AES-256-GCM, so your browser cannot read its contents, and it is httpOnly, secure, sameSite=lax and host-only. It expires with the WorkOS session and is cleared when you sign out. It maintains the session you requested; it is not used for analytics, advertising or cross-site profiling.

For everything else we run Umami, open-source analytics software that we host ourselves on our own server in Poland. It is cookieless: it writes nothing to your device — not a cookie, not a browser-storage entry — and nothing about it outlives the tab you are reading this in. It does read what your browser reports as a page loads, which is where the measurements in the next paragraph come from.

Umami records aggregate measurements only — page addresses, referring site, browser, operating system, device type, screen size, language, and approximate location (country, region and city). It does not store your IP address, does not assign you an advertising or cross-site identifier, and does not build a profile of you. Your browser sends the statistics to stats.sustematiq.com; like every request to our server, this leaves one line with your full IP address in that server's log, which we keep as section 2 (Server Logs) describes. No analytics data is shared with any third party or transferred outside the European Economic Area. Records are kept for 24 months.

The FoQus application’s local progress, statistics, session records, and reflections stay on your device and are not sent to us. The two cookies above, and every browser-storage item the app writes, are listed in full in our Cookie Policy.

6. No AI/Model Training

We do not use personal data that we receive through this website, FoQus or Mate to train AI models. This includes form submissions, alpha access requests and sign-in data.

7. Hashed IP Addresses and User Agents

Hashed IP addresses and hashed user-agent strings are treated as pseudonymous personal data, not anonymous data. They are used for security, abuse prevention, rate limiting, and integrity of the profile service where applicable. They are not utilized to trace individuals outside necessary security contexts.

8. Recipients and Processors of Data

Your personal data may be processed or accessed by the following recipients, including processors acting on behalf of SustematiQ:

• WorkOS, Inc. (United States): Our processor for hosted FoQus sign-in. WorkOS processes the email address and credential you enter on its hosted sign-in page, information passed by a chosen social or enterprise identity provider, and the IP address and user-agent that reach its page from your browser. It returns the opaque provider subject ID, email address, email-verification status, first name, last name, and, where provided, an organization identifier to our callback transiently. Our local authentication mapping retains only our own subject ID and WorkOS’s opaque provider subject ID as identity values. WorkOS’s published subprocessor list identifies its listed subprocessors in the United States; see the WorkOS subprocessor list. Beyond the sign-in work it does on our instruction, WorkOS’s Data Processing Addendum permits it to process the data described here for three purposes of its own: building or improving the quality of its own services, detecting security incidents, and protecting against fraudulent or illegal activity. We do not direct that processing and we cannot switch it off; we tell you about it because it is part of what happens to your data, not only what we ask for. WorkOS also holds the account we create when we accept an alpha access request.
• OVHcloud (server in Poland, European Union): hosts the server that runs this website, its database and our analytics.
• Google (Google Workspace): delivers and stores our email, including the notifications about your form submissions and the emails we send you.
• Cloudflare, Inc.: runs the bot check on our forms. Cloudflare acts as our processor for the check, and as a separate controller when it uses the check’s signals to improve its bot detection; see the Cloudflare Turnstile privacy notice.
• No analytics provider: our website analytics software runs on our own infrastructure, so no third party receives our website analytics.
• Technical support and administration services.
• Internal SustematiQ project team members.

9. International Data Transfers

Our website analytics involves no international transfer: the software and its database run on our own server in Poland (European Union), and no analytics data reaches a third party.

Cloudflare and Google are based in the United States and can process data there. Where they are certified under the EU-U.S. Data Privacy Framework, the transfer relies on the European Commission’s adequacy decision for that Framework; otherwise, on the EU Standard Contractual Clauses in their data processing terms. You can ask us for a copy of the safeguards using the contact details in section 1.

The WorkOS-hosted FoQus sign-in does involve a transfer of personal data to the United States. WorkOS’s transfer documentation identifies the United States as the country where the data is stored or accessed, and its published subprocessor list identifies its listed subprocessors in the United States.

We rely on the EU Standard Contractual Clauses in WorkOS’s Data Processing Addendum, specifically Module Two for controller-to-processor transfers. The Addendum is incorporated into the WorkOS Terms of Service, and it provides that executing the agreement executes the Standard Contractual Clauses. You can read the clauses we rely on in Exhibit C of the WorkOS Data Processing Addendum, which WorkOS publishes; you can also ask us for a copy of them using the contact details in section 1.

We do not rely on a United States adequacy decision, and we do not rely on the EU-U.S. Data Privacy Framework. When we checked the Framework’s participant list on 28 August 2026, WorkOS, Inc. was not certified under it; we re-check at each review, and because our safeguard is the Standard Contractual Clauses rather than the Framework, this would not change the basis of the transfer. We have carried out and documented a transfer impact assessment for this transfer, we review it at least annually, and we make it available to the supervisory authority on request. You can ask us for a summary of it using the contact details in section 1.

10. Data Retention

We retain personal data only for as long as necessary to fulfill the respective purpose or as required by law:

11. Your Rights under GDPR/RODO

You possess the following rights regarding your personal data:

• Access: The right to obtain details on the processing of your data and a copy of the data.
• Rectification: The right to correct inaccurate or incomplete data.
• Erasure (Right to be Forgotten): The right to request data erasure under appropriate conditions.
• Restriction: The right to limit data processing.
• Portability: The right to receive your data in a structured, commonly used format.
• Objection: The right to object to processing based on legitimate interests.
• Withdrawal of Consent: The right to withdraw consent at any time without affecting prior processing legality.
• Complaint: The right to lodge a complaint with a supervisory authority.

We respond to valid data subject requests within one month. Requests can be submitted via email to info@sustematiq.com. Our data requests page explains how to send a request and what we need from you.

Game results from yougaveaiwhat.com and from the iPad kiosk at events carry no name or contact identifier, so we cannot find your result by name or email address (Article 11 GDPR). If you want us to find and delete a web game result, tell us the day you played and, if you typed one, the text you entered in an “other” field; we will search for it. If you played at a SustematiQ event on the iPad kiosk, tell us the event date and any text you typed into an “other” field.

12. Right to Complain to UODO

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) if you believe our data processing violates the GDPR/RODO. Address: ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland. Telephone: 22 531 03 00. Email: kancelaria@uodo.gov.pl.

13. Protection of Minors

FoQus is not directed to children under 16. Users under 16 should not use FoQus sign-in and should not create an Online FoQus Profile. If we learn that we have collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete it.

The Mate alpha is for adults only: you must be 18 or older to request access. If we learn that a request comes from a person under 18, we delete it.