Privacy Policy.

1. Controller and Contact Details

The controller of your personal data is SustematiQ Sp. z o.o., with its registered office at ul. Św. Judy Tadeusza 8F, Unit 1, 55-095 Domaszczyn, Poland, entered in the National Court Register (KRS) under number 0001253359, NIP 8961670119, REGON 545235400. You can contact us at info@sustematiq.com.

We have not appointed a Data Protection Officer unless stated otherwise. Privacy-related questions can be sent to info@sustematiq.com.

2. Data We Process by Context

We collect and process personal data in the following contexts:

• Website Browsing: Standard internet logging including security logs, hashed IP addresses, hashed user-agent strings, and timestamps.
• Contact Form: Name, email address, organization name, type of inquiry, and message details.
• Guided Project-Intake (Project Signal Builder): Organizational domain, developmental stage, required deliverables, contact details (name, email, organization), and optional notes.
• FoQus Sign-in (WorkOS hosted): When you choose sign-in, your browser sends the email address and credential you enter on WorkOS’s hosted page, any information your chosen social or enterprise identity provider passes to WorkOS, and your IP address and user-agent as the page loads. The request goes directly from your browser to WorkOS; we do not proxy or forward those inputs. WorkOS returns to us transiently its opaque user identifier, email address, email-verification status, first name, last name, and, where provided, an organization identifier. The only identity values we persist in the authentication mapping are our own subject ID and WorkOS’s opaque provider subject ID. The database also records creation timestamps and, after erasure is carried out, an erasure timestamp. We do not persist the returned email address, names, email-verification status, organization identifier, or refresh token.
• FoQus Guest Mode: Ephemeral session state. No personal data is transmitted to SustematiQ server-side.
• FoQus Local Profile Mode: Progress, preferences, statistics, badges, and reflections stored locally on your device.
• FoQus Online Profile Mode: Submitted profile details (name, email address, optional profile note, source, consent choices, profile status, public ID, hashed IP address, hashed user agent, and timestamps).
• Optional Local-Only Reflections: Feedback or reflections written after sessions are stored in the browser only.
• Website Analytics (self-hosted, cookieless): Page address, referring website, browser, operating system, device type, screen size, language, and approximate country, region or city. No IP address is stored, no identifier is written to your device, and the records cannot be linked back to you as an individual.
• Consent Records: The consent choices you tick on a form, stored with the submission they belong to, together with its timestamp.

3. Lawful Bases of Processing

We process personal data based on the following legal grounds under Article 6(1) of the General Data Protection Regulation (GDPR):

• Contact and Guided Intake: Article 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract) and Article 6(1)(f) GDPR (our legitimate interest in responding to business and project enquiries).
• FoQus Online Profile: Article 6(1)(b) GDPR (performance of a contract – providing the requested Online Profile service), Article 6(1)(f) GDPR (our legitimate interest in service security, abuse prevention, and rate limiting), and Article 6(1)(a) GDPR (consent, if you opt-in to optional updates).
• FoQus Sign-in: Article 6(1)(f) GDPR (our legitimate interest in providing a secure sign-in service, recognizing the same signed-in person on later requests, preventing one WorkOS identity from being mapped to two local subjects, and maintaining sign-out). This processing is necessary for the sign-in you ask us to start: without the local identity mapping and session, we cannot associate the completed hosted authentication with a local account. We limit its impact by using hosted authentication, not retaining the credential you enter there, persisting only our own subject ID and WorkOS’s opaque provider subject ID as identity values, and keeping the returned email address, names, verification status, organization identifier, and refresh token out of our database. You may object to this processing as described in section 11; if you object, we may not be able to provide a signed-in session. Nothing obliges you to sign in: signing in is entirely optional, no law or contract requires it of you, and the only consequence of not doing so is that you cannot enter the FoQus closed alpha — nothing else on this site depends on it.
• Website Analytics: Article 6(1)(f) GDPR (our legitimate interest in understanding how our own website is used and improving it). Our analytics writes nothing to your device — no cookie, no browser-storage entry, and nothing that survives you closing the tab — so we ask for no ePrivacy consent and show no cookie banner. It does read what your browser reports as a page loads, including your language and the size of your window, which we keep only as aggregate counts. You may object to this processing at any time — see section 11.
• Consent Records: Article 6(1)(c) GDPR (compliance with a legal obligation to demonstrate valid consent) and Article 6(1)(f) GDPR (legitimate interest in documentation).
• Security Logs (including hashed IP/User Agent): Article 6(1)(f) GDPR (our legitimate interest in securing our website and applications, preventing abuse, and troubleshooting).
• Local-Only FoQus Data: We do not receive or process this data server-side; local browser storage is utilized for requested application functions.

4. FoQus Data Modes

5. Analytics and Cookies

This website uses no advertising, tracking or analytics cookies, and shows no cookie banner. It sets two cookies in total, all of them strictly necessary, all host-only, and none readable by scripts in your browser. Each one delivers something you explicitly asked for, which is why none requires consent under ePrivacy rules.

sustematiq_login_state — set the moment you click sign in, before you have authenticated. It carries a one-time anti-forgery value and the page to return you to. It lasts ten minutes and is deleted when the sign-in round trip finishes, including when sign-in is refused.

sustematiq_session — set only after a successful sign-in. It holds our subject ID, the WorkOS session token, the WorkOS session ID and the session expiry. It is encrypted with AES-256-GCM, so your browser cannot read its contents, and it is httpOnly, secure, sameSite=lax and host-only. It expires with the WorkOS session and is cleared when you sign out. It maintains the session you requested; it is not used for analytics, advertising or cross-site profiling.

For everything else we run Umami, open-source analytics software that we host ourselves on our own server in Poland. It is cookieless: it writes nothing to your device — not a cookie, not a browser-storage entry — and nothing about it outlives the tab you are reading this in. It does read what your browser reports as a page loads, which is where the measurements in the next paragraph come from.

Umami records aggregate measurements only — page addresses, referring site, browser, operating system, device type, screen size, language, and approximate country, region or city. It does not store your IP address, does not assign you an advertising or cross-site identifier, and does not build a profile of you. No analytics data is shared with any third party or transferred outside the European Economic Area. Records are kept for 24 months.

The FoQus application’s local progress, statistics, session records, and reflections stay on your device and are not sent to us. The two cookies above, and every browser-storage item the app writes, are listed in full in our Cookie Policy.

6. No AI/Model Training

SustematiQ does not use personal data it receives through FoQus — including the transient sign-in profile fields and the local sign-in mapping — to train AI models.

7. Hashed IP Addresses and User Agents

Hashed IP addresses and hashed user-agent strings are treated as pseudonymous personal data, not anonymous data. They are used for security, abuse prevention, rate limiting, and integrity of the profile service where applicable. They are not utilized to trace individuals outside necessary security contexts.

8. Recipients and Processors of Data

Your personal data may be processed or accessed by the following recipients, including processors acting on behalf of SustematiQ:

• WorkOS, Inc. (United States): Our processor for hosted FoQus sign-in. WorkOS processes the email address and credential you enter on its hosted sign-in page, information passed by a chosen social or enterprise identity provider, and the IP address and user-agent that reach its page from your browser. It returns the opaque provider subject ID, email address, email-verification status, first name, last name, and, where provided, an organization identifier to our callback transiently. Our local authentication mapping retains only our own subject ID and WorkOS’s opaque provider subject ID as identity values. WorkOS’s published subprocessor list identifies its listed subprocessors in the United States; see the WorkOS subprocessor list. Beyond the sign-in work it does on our instruction, WorkOS’s Data Processing Addendum permits it to process the data described here for three purposes of its own: building or improving the quality of its own services, detecting security incidents, and protecting against fraudulent or illegal activity. We do not direct that processing and we cannot switch it off; we tell you about it because it is part of what happens to your data, not only what we ask for.
• Hosting and server infrastructure providers.
• Email delivery and SMTP service providers.
• No analytics provider: our website analytics software runs on our own infrastructure, so no third party receives our website analytics.
• Technical support and administration services.
• Internal SustematiQ project team members.

9. International Data Transfers

Our website analytics involves no international transfer: the software and its database run on our own server inside the European Union, and no analytics data reaches a third party.

The WorkOS-hosted FoQus sign-in does involve a transfer of personal data to the United States. WorkOS’s transfer documentation identifies the United States as the country where the data is stored or accessed, and its published subprocessor list identifies its listed subprocessors in the United States.

We rely on the EU Standard Contractual Clauses in WorkOS’s Data Processing Addendum, specifically Module Two for controller-to-processor transfers. The Addendum is incorporated into the WorkOS Terms of Service, and it provides that executing the agreement executes the Standard Contractual Clauses. You can read the clauses we rely on in Exhibit C of the WorkOS Data Processing Addendum, which WorkOS publishes; you can also ask us for a copy of them using the contact details in section 1.

We do not rely on a United States adequacy decision, and we do not rely on the EU-U.S. Data Privacy Framework. When we checked the Framework’s participant list on 28 August 2026, WorkOS, Inc. was not certified under it; we re-check at each review, and because our safeguard is the Standard Contractual Clauses rather than the Framework, this would not change the basis of the transfer. We have carried out and documented a transfer impact assessment for this transfer, we review it at least annually, and we make it available to the supervisory authority on request. You can ask us for a summary of it using the contact details in section 1.

10. Data Retention

We retain personal data only for as long as necessary to fulfill the respective purpose or as required by law:

11. Your Rights under GDPR/RODO

You possess the following rights regarding your personal data:

• Access: The right to obtain details on the processing of your data and a copy of the data.
• Rectification: The right to correct inaccurate or incomplete data.
• Erasure (Right to be Forgotten): The right to request data erasure under appropriate conditions.
• Restriction: The right to limit data processing.
• Portability: The right to receive your data in a structured, commonly used format.
• Objection: The right to object to processing based on legitimate interests.
• Withdrawal of Consent: The right to withdraw consent at any time without affecting prior processing legality.
• Complaint: The right to lodge a complaint with a supervisory authority.

We respond to valid data subject requests within one month. Requests can be submitted via email to info@sustematiq.com.

12. Right to Complain to UODO

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) if you believe our data processing violates the GDPR/RODO. Address: ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland. Telephone: 22 531 03 00. Email: kancelaria@uodo.gov.pl.

13. Protection of Minors

FoQus is not directed to children under 16. Users under 16 should not use FoQus sign-in and should not create an Online FoQus Profile. If we learn that we have collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete it.