Privacy Policy

The legal data controller

The website at hans.study is owned and operated by Hans Study, an independent consulting practice based in Ontario, Canada, which has previously operated under the trade names TSG and TSG Labs (together, "Hans Study", "we", "us", or "our"). For purposes of Canadian privacy law (PIPEDA) and applicable provincial legislation, the data controller for personal information collected through this Site is Hans Study personally. "TSG" and "Hans Study" are trade names, not separate legal entities.

This policy describes what personal information is collected through this Site, how it is used, and how it is retained.

What this site collects

• Contact form submissions at /contact/: name, email address, organization (optional), and the message you choose to send. Submissions are validated by Cloudflare Turnstile (a CAPTCHA alternative) before being delivered.
• Audit and notify submissions: the tools at /tools/switch-config-audit/, /tools/studycrypto/, and /tools/workstation-config/ may collect your name and email if you choose to receive a copy of an audit report or to be notified about a beta release.
• Configuration text submitted to the audit tool: the configuration you paste or upload is processed at request time on Cloudflare Pages Functions to produce findings. The configuration text is not retained beyond the request.
• Tool usage events: when you generate output from a utility under /tools/* (a switch configuration, a hardening script, a subnet calculation, a cable BOM, or a Genetec audit report), this Site records that a generation happened, which tool produced it, and a summary of the options selected (for example the platform and model, the chosen baseline, the number of doors, or the resulting audit score). These records also include the requesting IP address and user agent, and are stored in a Cloudflare D1 database controlled by Hans Study. The content you enter is not uploaded: pasted configuration text, the addresses you type into the subnet calculator, and your Genetec audit answers and field notes stay in your browser. Usage events carry no name or email address unless you separately submit one through a form.
• Standard server logs: Cloudflare records the requesting IP address, user agent, and the requested resource for security and abuse prevention. These logs are retained per Cloudflare's standard policy.
• Analytics: two third-party tools run by default to help understand how the site is used. Both run off the main thread via Cloudflare Partytown (Web Worker), so they do not slow page rendering. Both can be disabled via the "Manage cookies" link in the footer. A browser Do Not Track signal disables both regardless of cookie preference.
  • Google Analytics 4, page-view and engagement metrics, conversion events for form submissions and utility usage. Measurement ID: G-FM3L2P4P8S. Sets a first-party _ga cookie (2-year expiry). The IP address visible to Google is the IP your request reaches Google's edge with.
  • Microsoft Clarity, behavioural analytics including aggregated heatmaps and session recordings. Project ID: wzayy8equi. Text input in forms is masked by default. Provided by Microsoft Corporation.
  • Cloudflare Web Analytics, server-side aggregate pageview, referrer, country, and Core Web Vitals data. Runs at the network edge with no client-side JavaScript and no cookies. Cannot be opted out of via this Site's cookie preferences because it sets no cookies; opting out requires blocking the Cloudflare beacon URL at the browser level.

How submissions are handled

Form submissions are delivered by email through Resend (resend.com), an email delivery service. The destination address is monitored by Hans Study only. Submissions are not added to a marketing list. There is no newsletter and no automated follow-up.

Audit results delivered by email contain a summary of the findings and the email address you provided. The original configuration text is not included in the email.

Lawful basis

The lawful basis for processing personal information collected on this Site is your consent (express, in the case of forms you choose to submit) and our legitimate interest in operating, securing, and improving the Site.

Cookies and how to manage them

This Site uses an opt-out consent model. By default, Google Analytics 4 and Microsoft Clarity load and may set the following cookies: _ga, _ga_FM3L2P4P8S (Google Analytics, first-party, two-year expiry), and _clck, _clsk, SM, MUID (Microsoft Clarity, mixed first and third-party). Cloudflare Turnstile (the bot-check on contact forms) may also set short-lived cookies during form submission.

To opt out, use the Manage cookies link in the footer. The opt-out is stored in browser local storage and persists per browser. Opting out hard-disables the analytics scripts on every subsequent page load.

If your browser sends a Do Not Track signal, the analytics providers above are not loaded and no analytics cookies are set, regardless of your local cookie preference.

Cloudflare Web Analytics is server-side and sets no cookies.

Conversion events tracked in Google Analytics 4

The following events are sent to Google Analytics 4 when the corresponding user action occurs, only if you have not opted out:

• form_submit_contact, when the homepage contact form is successfully submitted.
• form_submit_mentorship, when the mentorship form is successfully submitted.
• tool_used, on interactions with utilities under /tools/*, with the tool slug as a parameter.
• file_download, on clicks of links pointing at downloadable files (configurations, scripts, exports).
• outbound_link_click, on clicks of links pointing to other websites, including citations.
• mailto_click, on clicks of mailto: links.

None of these events include personal identifiers beyond the standard Google Analytics client ID.

Sub-processors and service providers

• Cloudflare (hosting, CDN, DDoS protection, Pages Functions, Turnstile, Web Analytics)
• Resend (transactional email delivery for contact and audit responses)
• Google (Google Analytics 4)
• Microsoft (Clarity behavioural analytics)

Each of those services has its own privacy policy. Collectively, they may process the information described above on behalf of Hans Study in order to make this Site function.

What this site does not do

• No selling, sharing, or trading of personal information.
• No advertising networks, no retargeting pixels, no third-party trackers beyond Google Tag Manager.
• No background scripts that read browser history, clipboard content, or device fingerprints.

Retention

Form submissions delivered by email are retained in the inbox of Hans Study for as long as is necessary to respond to the inquiry and maintain a record of the engagement. Form submissions and tool usage events are also stored in a Cloudflare D1 database controlled by Hans Study, retained for as long as they remain useful for supporting an inquiry and understanding which tools and options get used, and deleted on request. Audit configuration text is processed in memory only and is not retained beyond the request. Analytics data follows Google's standard retention policy. Server log data follows Cloudflare's standard retention policy.

Your rights

If you have submitted information through this Site and would like a copy of what is held, or for it to be corrected or deleted, send a request to contact@hans.study. Requests are processed within a reasonable timeframe, typically within seven days. The contact of record for privacy matters is Hans Study, Ontario, Canada.

Cross-border data transfer

The service providers listed above may process information in the United States or other countries outside Canada. By submitting information through this Site, you acknowledge that the information may be processed in those jurisdictions and may be subject to lawful access by their authorities.

Changes

This Privacy Policy may be updated. The "Last updated" date at the top of this page reflects the most recent revision.

Contact

Questions about this Privacy Policy can be sent to contact@hans.study.