1. Who We Are and What This Policy Covers
IOVANTA, Inc. (“IOVANTA,” “we”) publishes the Syztemax scientific framework, the Primitives to Large Bodies manuscript series, the MCSA engine, and associated materials (together, the “Materials”) under the Syztemax Open Research Reciprocal License (“SX-ORRL”).
This Policy explains how we process personal data when you visit iovanta.io, read or download the Materials, submit correspondence, or use an authenticated service. It is designed around the requirements of Regulation (EU) 2016/679 (“GDPR”) and applicable electronic-communications privacy rules.
2. Our Data Philosophy
We do not monetize, sell, rent, profile, or otherwise exploit your personal data. We do not use personal data for advertising and do not share it with advertisers, data brokers, or analytics vendors.
Public reading does not require registration. We process a minimal set of personal data for protected downloads so we can present the governing SX-ORRL, record the exact version acknowledged, administer access, and maintain an auditable starting point for license propagation.
The access gate exists to make license acknowledgment verifiable, not to surveil readers.
3. What We Collect, Why, and on What Basis
3.1 Protected-download acknowledgment
We process a name or pseudonymous research handle, email address, optional organization or affiliation, acceptance timestamp, license version, hash of the acknowledged license text, privacy-policy version, and download events. These records are used to take steps at your request to enter the license relationship and for IOVANTA's legitimate interest in administering and demonstrating license acceptance.
3.2 Technical operations
The service necessarily processes network address, user agent, requested URI, response status, and timestamps to deliver and secure the site, prevent abuse, enforce reasonable rate limits, and diagnose failures. Full network addresses in operational logs are scheduled for truncation or deletion after seven days; truncated operational logs are scheduled for deletion after 90 days.
We do not collect cross-site browsing history, device fingerprints, precise location, or special-category data. Do not submit special-category or confidential personal data through our forms.
3.3 Open reading and automated access
The public Materials are available to human readers and responsible automated retrieval systems without registration. For unregistered visitors we process only the technical information required to serve and secure the request. Automated access remains subject to the SX-ORRL, robots.txt, ai.txt, and reasonable rate limits.
3.4 Correspondence
When you submit the contact form, we process your name, email address, telephone number, and message to receive, manage, and answer the correspondence. Do not use the form to transmit secrets, credentials, restricted research, or sensitive personal information.
5. What We Never Do
- No sale, rental, or licensing of personal data.
- No third-party advertising, tracking pixels, or cross-site behavioral analytics.
- No profiling or automated decision-making that produces legal or similarly significant effects.
- No combination of license-gate data with external marketing data.
- No marketing use without a separate, freely given, revocable opt-in. We do not currently seek that opt-in.
6. Recipients and Processors
Personal data is accessible only to authorized IOVANTA personnel with an operational need to know and to service providers engaged under appropriate data-protection terms where required.
Pre-publication item: the identity, function, and processing location of each production infrastructure or delivery provider must be inserted here before the public service begins collecting personal data. IOVANTA will disclose information to public authorities only where legally compelled and will assess demands for lawfulness and proportionality.
7. International Transfers
IOVANTA, Inc. is established in the United States. Where applicable personal data is transferred from the EU/EEA, United Kingdom, or Switzerland to the United States, the production service must document and apply a valid transfer safeguard before collection begins.
Pre-publication item: the selected safeguard—such as an applicable adequacy framework or Standard Contractual Clauses with supplementary measures—must be identified here after it is actually implemented. Information about the applicable safeguard will be available from privacy@iovanta.io.
8. Retention
- License-acceptance evidence: for the life of the license relationship plus six years, subject to final legal review.
- Full operational logs containing untruncated network addresses: seven days; truncated logs: 90 days.
- Correspondence: 24 months after resolution, unless a longer period is required for an active matter.
- Backup copies: expiration on a rolling 35-day cycle.
Retention periods will be shortened where the purpose can be achieved with less data and extended only where required by law, security investigation, or the establishment, exercise, or defense of legal claims.
9. Security
Production records will be encrypted in transit and protected at rest. Access will be role-restricted and logged. License acceptance records identify the exact version and cryptographic hash of the text acknowledged. The service follows data minimization by design and does not expose PostgreSQL directly to the public network.
No system can guarantee absolute security. If an incident creates a risk requiring notification, IOVANTA will follow applicable legal and regulatory procedures.
10. Your Rights
Depending on applicable law, you may request access, correction, erasure, restriction, or portability of personal data and may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting processing already performed.
Contact privacy@iovanta.io. GDPR requests are answered without undue delay and ordinarily within one month. We may retain minimal license-acceptance evidence where necessary for the establishment, exercise, or defense of legal claims.
You may lodge a complaint with the supervisory authority in your habitual residence, place of work, or place of the alleged infringement. United Kingdom users may contact the Information Commissioner's Office.
11. Children
The protected-download gate is not directed to children under 16, or the lower age permitted by applicable Member State law, never below 13. We do not knowingly register minors. A parent or guardian who believes a minor has registered may contact privacy@iovanta.io.
12. Changes to This Policy
Material changes will be announced on the site and, where appropriate, to registered users before they take effect. Prior versions will remain archived with their version identifiers and publication hashes.
13. No Intellectual-Property Grant
This Privacy Policy does not grant rights in the Framework or Materials. Rights and obligations governing the Materials are established exclusively by the applicable SX-ORRL version.