Русская версия · This is a translation; the Russian text is the reference version.

Processing of personal data

Information under Art. 13 of the General Data Protection Regulation (GDPR) and Art. 19 of the Federal Act on Data Protection (nFADP, Switzerland)

Data controller

Anna Alasheeva · anya@alasheeva.com

What data is collected and why

• Email address (signing in to the instrument). Used to send a one-time sign-in link. Legal basis: performance of the user’s request (GDPR Art. 6(1)(b)).
• Neuroprofile map (research contribution). An anonymised structure of answers, transmitted only with the user's explicit consent. Legal basis: consent (GDPR Art. 6(1)(a)). Collection opens separately; until then the server does not accept this data.
• Email address (waiting list). If you left your address in the “tell me when it opens” form on the invitation page, the following is stored: the address, the date of the request, the language of the email and — if you came via a link or QR code from the conference talk — a note of that source. Legal basis: consent (GDPR Art. 6(1)(a)). The address is used for exactly one email — the one saying that collection has opened — and is deleted immediately after it is sent. You can withdraw consent at any time by writing to the controller’s address; the address will be removed from the list.
• Rate-limiting records. Hashed identifiers (HMAC) that cannot be reversed to the original address or IP. Retention: 24 hours.

Recipient of the data

Data is processed on the servers of Infomaniak Network SA (Geneva, Switzerland) under a data processing agreement (DPA). Switzerland is recognised by the European Commission as a jurisdiction with an adequate level of data protection.

Data is not passed to third parties and is not used for advertising, profiling or automated decision-making.

Retention periods

• Sign-in email: kept as long as the account exists. The user can delete the account at any time (Settings → “Delete my account on the server”).
• Research data (with consent): until the results of waves 1–2 are published, but no later than 31.12.2028 (see the consent form).
• Waiting-list address: until the email announcing that collection has opened is sent, then deleted. If collection does not open, the address is deleted no later than 31.12.2026.
• Unfinished sign-ins: 24 hours.
• Rate-limiting records: 24 hours, hashed.
• Web server logs: standard Infomaniak access logs (IP, user agent, URL, date). Retention is set by Infomaniak’s policy.
• Database backups: made by Infomaniak and containing the accounts table (email addresses). A backup made before an account was deleted is kept until it expires under Infomaniak’s backup rotation.

Your rights

• Access to your data.
• Account deletion — Settings → “Delete my account on the server”. The email and sessions are deleted immediately.
• Withdrawal of a research contribution — Settings → “Withdraw contribution”. All transmitted structures are deleted from the server.
• Withdrawal of consent at any time, with no consequences for further use of the instrument.
• Complaint to the data protection supervisory authority where you live.

Automated decisions

The instrument makes no automated decisions that have legal effects or significantly affect the user.

Participants from the Russian Federation

Data is processed outside the Russian Federation (Switzerland). The transfer is based on your explicit consent (Part 1, Art. 12 of Federal Law 152-FZ). Details: see the information note in the consent form.

Last updated: 06.10.2026 (Russian original); translated 05.10.2026, revised 06.10.2026