Privacy policy
This policy explains what personal data observ.si handles, why, and the choices you have. It applies to this website and to enquiries we receive through it. It does not replace the engagement contract that governs an authorized test.
Who we are
Observ is the authorized external security testing brand of Cipher Projects. Cipher Projects is the data controller for the processing described here.
- Cipher Projects, 61 Ainsworth Street, Mawson, Canberra ACT 2607, Australia.
- Service email: [email protected].
- Company email: [email protected].
What we handle and why
Analytics
We use Google Analytics 4 to understand whether the page explains the offer well enough to earn a booking. When it runs, it records the page you viewed, an approximate location derived from your IP address, your device and browser, and the site that referred you. We do not use it for advertising, and we do not build advertising profiles.
Analytics storage is treated differently by region:
- In the EEA, the UK, and Switzerland, analytics storage is denied by default and no analytics cookies are set. The site does not run analytics in those regions today.
- Elsewhere, analytics runs and Google Analytics may set the
_gaand_ga_*cookies.
Advertising storage, advertising user data, and advertising personalization are denied everywhere, with advertising data redaction enabled.
Server logs
Our hosting provider records standard request logs, including IP address, user agent, requested path, and time. We use these only to keep the site available and secure, and to diagnose faults.
Email you send us
If you email us, we receive your address and whatever you write, including the host, window, and authorization details you choose to include. We use it to answer you and to prepare an engagement.
An authorized test
When we run a test, we handle the host, port, authorization records, findings, and evidence you approve. That data is governed by the signed scope and the engagement contract, which set out what we collect, how it is stored, and when it is destroyed.
Fonts and third-party requests
The typefaces on this site are served from observ.si itself. They are not loaded from a font CDN, so viewing a page does not send your IP address to Google or any other font provider. This is a deliberate choice to keep the only third-party request on the site tied to analytics, which is consent-gated by region.
Cookies
The site sets no cookies of its own. The only cookies that may be set are the Google Analytics cookies listed above, and only where analytics runs.
_ga: distinguishes visitors. Retention default 14 months._ga_*: keeps a session state. Retention default 14 months.
You can block or delete cookies in your browser. You can also install the Google Analytics opt-out browser add-on. Blocking analytics does not affect how this site works.
Legal bases
- Analytics outside the EEA, UK, and Switzerland: our legitimate interest in understanding how the site performs, and your consent where a region requires it.
- Server logs: our legitimate interest in security and availability, and legal obligations to keep some records.
- Email and engagements: taking steps you asked for before a contract, and performing that contract.
Who processes data for us
We share personal data only with providers that run the service on our behalf, and only as needed:
- Google (Google Analytics), for website measurement.
- Cloudflare Pages, for hosting and request logs.
- Our email provider, for the [email protected] mailbox.
- Stripe, for payment processing, once payments are taken on this site.
We do not sell personal data, and we do not share it for advertising.
International transfers
Some providers process data outside your country, including in the United States. Where required, we rely on the provider's standard contractual clauses or an equivalent safeguard.
Retention
Analytics data is kept for the 14-month default above. Server logs are kept only as long as needed for security and operations, then deleted. Email and engagement records are kept for the engagement and for as long as tax and legal rules require.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our use of your personal data, and to receive a portable copy. To exercise a right, email [email protected].
- If you are in the EEA, the UK, or Switzerland, you may complain to your local supervisory authority.
- If you are in Australia, you may contact the Office of the Australian Information Commissioner.
Children
This site is for businesses. It is not directed at children, and we do not knowingly collect their personal data.
Changes
If this policy changes, we will update the effective date at the top of the page. Material changes will be described on this page.
Contact
Questions about privacy can go to [email protected] or to Cipher Projects at [email protected].