Privacy Policy — INSTAR Lab

What this website collects on its own

The pages themselves set no cookies and need no account. The only item the site stores by itself is your consent receipt, described below. When you have not yet made a choice, the page asks our network provider (Cloudflare, which sits in front of the site) for the country your request came from, using one small request to this site that is not stored or linked to you, so that it can show the version of the privacy dialog that fits your region; if that fails, your browser’s time zone and language decide, and any doubt is treated as the stricter case. The search box runs in your browser against an index stored on this site, so your query appears in the address bar but is not sent to us as a form. The footer lists an email address for research updates rather than a signup form, so there is no mailing-list database.

Information you choose to send

If you email info@instarlab.org or call 929-229-2917, we receive what you send and use it only to respond. Do not email classified, export-controlled, proprietary, health, or other sensitive personal information. We keep correspondence as long as needed to answer you and meet record-keeping duties, and delete it on request unless law or an active agreement requires otherwise.

Forms, our Salesforce CRM, and campaign data

Forms appear on the site only while the form service is available. When you send the contact form, the STTR partner brief, the Fellowship interest form or the research-updates form, a form service operated for INSTAR Lab passes your submission to INSTAR Lab’s customer relationship management system (CRM), which is Salesforce, run for us by Salesforce, Inc. We create or update a lead or contact record and add it to a campaign so the right person can follow up. Never put passwords, payment card numbers, health information or government identifiers in a form.

• What we store from every submission: your name and email address; any organization, topic and message you enter; the form and button you used; the page address (without its query string); the time; and the campaign labels (utm_source, utm_medium, utm_campaign, utm_term, utm_content) in the link you followed, which describe the link and not you.
• What we store only if you allowed the “Advertising and campaign measurement” category: the ad click identifier in the link (gclid, gbraid or wbraid), the first and most recent campaign visit and landing page, and the referring site’s host. We use these to see which campaigns bring enquiries and to report results to the advertising platform. Without that choice none of them are stored.
• Your consent record: the consent ID and the categories you had allowed when you sent the form, and whether you ticked the separate research-updates box. That box is never ticked for you and is not needed for a reply. The newsletter form requires it because subscribing is the choice.
• Why: to respond to you, to run the program you ask about (a research partnership, a Fellowship, a funding question), to understand which outreach works, and, only if you ticked the box, to send research briefs and institutional updates.
• Who receives it: Salesforce, Inc. (CRM hosting) and the Microsoft Azure service that runs our form service. If Salesforce is briefly unreachable, your submission waits in an encrypted queue for at most seven days and is then removed. We do not sell it.
• How long: we keep CRM records only as long as they are needed for the purposes above, review records with no activity from time to time, and delete or anonymize those we no longer need. A fixed schedule has not been adopted and we will state it here when it is.
• Before a form appears, the page may ask the form service whether it is available. Like any request, this reveals your network address and browser type to that service. No form data is sent until you submit.
• Bot check: when you press Send, the form service may ask Cloudflare Turnstile to confirm you are not an automated script. That loads a Cloudflare script and sends it your network address, browser details and how you interact with the check; Cloudflare uses it only for this purpose. It is security, not advertising or analytics, so it is not behind the cookie choices. It does not run until you send a form.
• Your choices and rights: ask what we hold, correct or delete it, stop research updates, or have the click identifiers removed by emailing info@instarlab.org with the subject “Privacy request”. If a form fails, the email link beside it always works.

Cookies, tools, partners, and your choices

Status: optional tools are available and OFF until you choose. INSTAR Lab uses tracking and campaign-management tools (analytics, advertising measurement, and, in future, other categories listed below) delivered through one Google Tag Manager container. When you first visit, we ask for your choice in a privacy dialog. Most visitors are asked to choose before continuing: Accept all, or Customize to pick categories (the first Customize choice keeps at least one optional category on). Visitors in the European Economic Area, the United Kingdom and Switzerland, visitors whose region we cannot determine, and visitors whose browser sends a Global Privacy Control signal get the same dialog without any block on reading the site, with Necessary only offered as prominently as Accept all. Until you choose, no optional tool runs, Google Tag Manager is not requested, and no analytics or advertising cookie is set. At any time, anyone can open Privacy choices in the footer and switch every optional category off. Reading this site never depends on your choice in those regions, and you can always withdraw it.

Categories of tools and partners

Every tool is controlled by the purpose it serves, not by who makes it. Your choice for a category applies to every tool in it, now and when we add tools to that category. The full list of partners, data, recipients and retention is in the Cookies and partners directory.

• Strictly necessary: Keeps the site working and remembers your privacy choice. Always on.
• Analytics and performance: Counts visits and shows which pages and features help, so we can improve the site.
• Advertising and campaign measurement: Tells us which campaigns and ads lead to action, and lets advertising platforms count conversions.
• Personalization and audiences: Lets us build audiences and show more relevant messages on this site and on partner platforms.
• Partner and agency tools: Lets partners and agencies we work with run their tools on this site.
• Open the Cookies and partners directory

Why we use these tools, and who receives the data

Where you allow them, we use these tools to measure and improve this website, to plan, run and measure advertising and outreach campaigns, to measure results across platforms, to build audiences, and to work with partners and agencies that help us. Data is shared with service providers and advertising partners acting for us, only in the category you allowed. Today the partners configured are Google LLC (Google Tag Manager, Google Analytics 4 and Google Ads conversion measurement) and Microsoft Corporation (Microsoft Clarity, session analytics), plus GitHub and Cloudflare for hosting and delivery; no personalization, audience-building, or other partner tool is in use, and the directory says so. We do not sell personal information for money. Under some state laws, sharing information with an advertising partner for advertising measurement can count as “sharing”; switching off Advertising and campaign measurement, using Privacy choices, or sending a Global Privacy Control signal opts you out.

If you allow optional categories: what is collected

The page address and title, the page or ad you came from, approximate location derived from your network address (Google Analytics does not log or store IP addresses), your browser, device type, and screen size, and these actions: how far you scroll, which buttons and links you click, how fast pages load for you, following a Fellowship application link, clicking an email link for a partner or general question, and reading the federal funding guide for 30 seconds and halfway down. With Analytics and performance on, Microsoft Clarity also records masked sessions and heatmaps of where visitors click and scroll; it is set to mask all text and anything you type, so what you type is never recorded. With Advertising and campaign measurement on, we also keep, for up to 90 days on your device, the campaign tags (utm_) and ad click identifiers (such as gclid or msclkid) in the address of the page you arrived on, so that a form you choose to send us can carry the campaign that brought you. We do not collect your name, email address, or anything you type, because the site has no forms. Google signals and ad personalization signals are switched off in the Google tags we run today, and Personalization and audiences stays off unless you turn it on and a tool using it is added to the directory.

Cookies and storage, in full

These are the only items this site or its tags can set today. Items from Google and Microsoft exist only after you allow the matching category.

• instar-consent-v2, instar-consent-log-v2 (Site storage (localStorage); set by instarlab.org; category Strictly necessary): Your consent receipt: the choice you made, its date, a random consent ID, the policy version, your region class and whether a Global Privacy Control signal was present. It never leaves your browser unless you send it to us with a privacy request. Lasts: Until you clear it or 12 months pass, whichever is first; replaced when the policy version changes. Set: When you make a choice.
• _ga, _ga_<container id> (Cookie; set by Google Analytics 4 (through Google Tag Manager), on instarlab.org; category Analytics and performance): Distinguishes visits so page views and engagement can be counted. Lasts: Up to 2 years (Google default); event data is kept up to 14 months. Set: Only with Analytics and performance on.
• _gcl_au, _gcl_aw (Cookie; set by Google Ads conversion tag (through Google Tag Manager), on instarlab.org; category Advertising and campaign measurement): Links a click on an INSTAR Lab ad to a later action on this site so that conversions can be counted. Lasts: Up to 90 days. Set: Only with Advertising and campaign measurement on.
• _clck, _clsk, CLID, ANONCHK, MR, MUID, SM (Cookie; set by Microsoft Clarity (through Google Tag Manager) and Microsoft, on instarlab.org and clarity.ms; set by Microsoft Corporation; category Analytics and performance): Recognizes a visit and its session so masked heatmaps and recordings can be assembled. MUID is a Microsoft browser identifier that Clarity sets; INSTAR Lab does not link it to Microsoft Advertising. Lasts: From the session to about 13 months. Set: Only with Analytics and performance on.
• instar-attribution-v1 (Site storage (localStorage); set by instarlab.org; category Advertising and campaign measurement): Remembers the campaign tags (UTM) and ad click identifiers from the address you arrived on, so a form you choose to send can carry the campaign that brought you. Lasts: Up to 90 days on this device; cleared when you withdraw advertising consent. Set: Only with Advertising and campaign measurement on.
• Core Web Vitals, scroll depth, button and form events (No storage; events sent to Google Analytics 4; set by instarlab.org page script; category Analytics and performance): Page speed (Core Web Vitals), scroll depth, button and link clicks and whether a form was started or sent, never any typed value. Lasts: Not stored in your browser. Set: Only with Analytics and performance on.

Your consent receipt, withdrawal, and retention

Each choice creates a consent receipt stored only in your browser: a random consent ID, the policy version, which categories you allowed, the date and time, whether your region was treated as strict, and whether a Global Privacy Control signal was present. We do not receive it unless you send it with a privacy request. You are asked again after 12 months and whenever the policy version changes. Open Privacy choices in the footer to change or withdraw your choice, download your receipt, or make a privacy request; withdrawing a category turns that category’s tools off and removes the related Google and Microsoft Clarity cookies set by this site, and the saved campaign tags. Google Analytics event data is retained for up to 14 months, then deleted automatically. Google Ads conversion data follows Google’s standard Ads retention, which we do not extend. Microsoft keeps Clarity session recordings for up to 30 days and aggregated Clarity data for up to 13 months. Google Tag Manager itself sets no cookie. Our legal basis in the EEA, UK and Switzerland is your consent, which you may withdraw at any time without affecting earlier lawful processing.

How we decide which dialog you see

We use your browser’s time zone, language setting and Global Privacy Control signal, plus the country your request came from, which our network provider (Cloudflare) reports in one small request to this site (the file /geo-hint.txt, not stored and not sent to any other company). Nothing is sent to Google, Microsoft or any other tool before you choose. A European country, time zone or language region, a Global Privacy Control signal, or a missing time zone (when the country is also unknown) gives you the non-blocking dialog with Necessary only. This is a best effort: a VPN, travel, or a device set to another time zone can cause the other dialog, and we err toward the stricter one when unsure.

Google and Microsoft, and how to opt out

When you allow the matching categories, Google LLC acts as our service provider and advertising partner. How Google uses data from sites that use its services is described at policies.google.com/technologies/partner-sites. You can also manage Google advertising settings at adssettings.google.com, and install the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout. Microsoft Corporation acts as our service provider for Microsoft Clarity; how it handles data is described in the Microsoft Privacy Statement at privacy.microsoft.com and the Clarity terms at clarity.microsoft.com/terms.

Links that leave this site

Fellowship applications are made on usfellows.org, which collects the application and applies its own privacy policy; INSTAR Lab does not collect or hold a copy. The footer address opens Google Maps. Hosting and network providers (currently GitHub Pages, and Cloudflare as the network layer in front of it) process technical request data such as network addresses to deliver and protect the site, under their own policies; we do not receive or analyze those logs.

Your rights and how to make a privacy request

You may ask what we hold about you, ask us to correct or delete it, withdraw consent, opt out of sharing, or appeal a decision, by emailing info@instarlab.org with the subject “Privacy request” (Privacy choices opens a prefilled message that includes your consent ID). We respond within the time the law allows and never penalize anyone for making a request. We do not knowingly collect information from children under 13. If we change how this site collects information, we will update this page and the directory first and change the date above.

• Email a privacy request
• Cookies and partners directory