Privacy
Last updated 2 October 2026.
Who is responsible
ScAIentist®, inovativne digitalne rešitve s pozitivnim družbenim vplivom, d.o.o., Slovenska cesta 56, 1000 Ljubljana, Slovenia (info@scaientist.com), is the controller for this website and for your account with Rounds.
When Rounds runs on a website we maintain for somebody else, the operator of that website decides why its data is processed, and we process it on their behalf, as their processor.
This website
This website sets no cookies and runs no advertising scripts, and nothing that counts or measures visits runs unless you allow it. Its fonts are served from this site, so opening it sends nothing to a third party. Two choices are kept in your browser's local storage, on your device only, and are never sent to us: light or dark mode, if you pick one (rounds-theme), and your answer about counting visits (rounds-consent), kept for 12 months before we ask again. Both are strictly necessary to remember what you chose.
Like every website, it is delivered by a server that sees your IP address, your browser's user agent, the time and the page you asked for. Our host, Vercel, keeps these request logs for a short time to run and secure the service. We do not combine them with anything else. The legal basis is our legitimate interest in running a secure website (Article 6(1)(f) GDPR).
If you allow it, we count visits with Vercel Web Analytics and measure how fast pages load with Vercel Speed Insights. Neither sets cookies or stores anything on your device. For each page view, Vercel records the time, the page's address, the page you came from, your approximate location (country, region and town), your browser, operating system and device type, and, for page speed, the loading times, the page element they concern and your network speed. Instead of a cookie, it tells visitors apart by a hash calculated from the request, which it discards after 24 hours, and it does not tie the data to you or to your IP address.
The legal basis is your consent (Article 6(1)(a) GDPR and Article 225 of the Slovenian Electronic Communications Act, ZEKom-2). You can withdraw it at any time under “Privacy settings” at the foot of every page; nothing is sent after that, and withdrawing does not affect what was counted before.
| Name | Where | What for | How long | Consent needed |
|---|---|---|---|---|
rounds-theme | Local storage | Light or dark mode, if you pick one | Until you clear your browser's data | No, strictly necessary |
rounds-consent | Local storage | Your answer in the consent banner, and when you gave it | 12 months, then we ask again | No, strictly necessary |
When you write to us
If you e-mail us, we use your address and what you wrote to answer you and, if you become a customer, to set up your account. The legal basis is taking steps at your request before a contract (Article 6(1)(b) GDPR). We keep the correspondence for as long as the conversation or the contract lasts, and longer only where the law requires us to keep business records.
The Rounds service on a website
The people who edit a website with Rounds unlock it with a password. The unlock is kept in the browser tab's session storage and ends when the tab is closed. Where a signed-in application vouches for its own users, there is no Rounds password: the application sends Rounds a short-lived, signed confirmation of who the person is (its own identifier for them, their name and their role). That sign-in is kept only in the panel's memory and ends when the page is closed, and each request records the identifier, name and role for 24 months. Rounds sets no cookies.
A request contains what the person wrote, the page it was written on, and enough about the element they pointed at to find it again. On a public website that is the element's text and markup. On a signed-in application, Rounds never acts with the signed-in user's rights: its panel runs in a separate frame, it receives only the element's visible text, a selector and the page's path without its query, and it replaces e-mail addresses and long numbers with placeholders before anything is stored.
Each change is recorded with the IP address it came from, the browser, and the country, region and town derived from the address, so that the website's owner can later tell who changed what and when. Each record keeps these for 24 months from the day it was made; after that the address, browser, town and region are removed, and what changed and when remains. If the arrangement for a website ends, the personal part is removed within 30 days.
To keep a website's code up to date, Rounds reads, through the GitHub App its operator installed, the files that say which outside software and services it uses: package lists, lockfiles, configuration and source code. It writes nothing, keeps no copy of these files, and keeps what it found (file names, line numbers, package names and versions) only in memory, for up to six hours. To ask what has changed, it sends the names and version numbers of those packages, and nothing else from the code, to the npm registry, GitHub and Stripe.
Who else processes data
We use these providers, each under a data processing agreement. Where one is outside the EU, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.
- Vercel Inc. (USA): hosting of this website and of the Rounds service, which runs in Frankfurt (EU), and, if you allow it, counting visits and measuring page speed on this website.
- Our own PostgreSQL database, which ScAIentist® runs in the EU, with no outside provider: storage of requests, rounds and the change log.
- GitHub Inc. (USA): the code repositories where changes are delivered as pull requests.
- Resend (USA): e-mail notifications to the developer maintaining a website.
- Stripe Payments Europe Ltd. (Ireland): payments and invoices.
- Inceptron (Sweden) and Scaleway SAS (France), and Mistral AI (France) when neither is available: the AI models that read a request and the relevant part of a website's code to draft a change.
Your rights
You can ask us for a copy of your data, and to correct it, erase it, restrict it or hand it over in a portable form, and you can object to processing based on our legitimate interest. Write to info@scaientist.com. If your data was processed for a website we maintain for somebody else, we will pass your request to that website's operator and help them answer it.
You can also complain to the supervisory authority: the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ipinfo@ip-rs.si, https://www.ip-rs.si.
We make no decisions about people by automated means that have legal or similarly significant effects on them. Rounds is a service for businesses and is not directed at children.