Privacy Policy
This is a short, plain-English account of what data this site processes, why, and how to control it. No legal filler, no tracking you weren't told about.
Last updated: 10 August 2026
Who's responsible for this data
This site, systemsoup.dev, is run by Safwan Siddiq, trading as System Soup, a solo automation & AI studio based in Kuala Lumpur, Malaysia. For data protection purposes, Safwan Siddiq is the controller of any personal data processed through this site.
Questions, requests, or complaints about this policy go to safwan@systemsoup.dev.
What this site does — and doesn't — collect
This is a static marketing site. There are no user accounts, no logins, no payment processing, and no forms hosted on this domain. If you want to reach out, you either email directly or use the "book a call" link, which takes you to a scheduling page hosted by Google.
That leaves exactly three ways personal data reaches us: (a) analytics on how the site is used, (b) whatever you choose to put in an email you send to us, and (c) the details you submit on Google's booking page when you schedule a call (covered in 04 / booking, below). Nothing else is collected, stored, or passed on. No newsletter, no CRM, no ad retargeting, no third-party trackers beyond analytics and the booking page itself.
Google Analytics 4
When you consent, this site uses Google Analytics 4 (GA4) to understand how it's being used — which pages get read, roughly where traffic is coming from, and what's broken. GA4 sets two cookies:
Data collected includes: the pages you view, the site or search engine that referred you, an approximate location derived from your IP address (city/country level — GA4 does not retain your full IP), and general device and browser type.
Google processes this data as a processor acting on our instructions, under its own data processing terms. That processing may involve data being transferred to and handled on servers outside your country, including in the United States. Google's own privacy policy governs that handling.
Booking a call
The "book a call" links on this site — in the start-a-project section and the footer —
open a Google Calendar appointment-scheduling page at calendar.app.google in
a new tab. That page is hosted by Google, not on this site. Booking a time typically means
giving Google your name, your email address, the time you pick, and anything you write in
the notes field.
That data is submitted straight to Google and processed by Google as part of Google Calendar's scheduling feature, under Google's own terms and privacy policy. It's a separate flow from the GA4 analytics processing described above — no cookie is set, and the cookie-consent basis described in 05 / legal basis, below, doesn't apply to it.
The legal basis for this processing isn't consent — it's that it's necessary to take steps you've asked for. Clicking the link and filling in Google's form is you requesting a specific thing (a call) at your own initiative; your name, email, and chosen time are what it takes to arrange it.
We use those details only to prepare for and hold the call. They aren't added to a mailing list or a CRM — as elsewhere in this policy, neither exists. Google retains booking data under its own retention practices for Calendar, which this policy doesn't control; on our side, anything noted from a booking — such as context from the notes field — is kept only as long as it's useful to remember and is deleted once it isn't.
Consent, for analytics
Analytics cookies are not set until you actively consent. On your first visit, a cookie banner asks permission before any GA4 script loads or any cookie is written. If you decline, or close the banner without choosing, no analytics cookies are set and nothing is sent to Google.
Consent is the sole legal basis relied on for analytics. It isn't the basis for everything on the site — booking a call relies on a different basis, described in 04 / booking, above — but it's the only basis this section covers, and the only one that needs a cookie banner.
Withdrawing consent
You can withdraw consent at any time. Reopen the cookie settings from the link in the site footer to change your choice — this turns analytics off (or back on) without leaving the page.
As a fallback, or if you'd rather not use our controls at all, you can clear
_ga and _ga_ELRYYCBHQC from your browser's cookie storage, or
block them at the browser level. Either stops analytics from tracking further visits.
How long data is kept
GA4 is configured to retain event-level data for a fixed period before it's automatically deleted from Google's systems, in line with Google's standard retention settings for this type of property. That window is a setting inside the GA4 property itself and can be shortened or extended there — it isn't hard-coded by this policy. Aggregated, non-identifying reporting data may be retained longer, as is standard for GA4.
Your rights
Depending on where you're located, you may have the right to:
- Access the personal data held about you
- Correct inaccurate data
- Request erasure of your data
- Object to processing
- Withdraw consent at any time (see above)
To exercise any of these, email safwan@systemsoup.dev. This is a one-person studio, so requests are read and handled personally — typically within a few weeks.
Hosting and server logs
This site is hosted on Netlify. Like any web host, Netlify's infrastructure processes standard server request logs — including IP address — as a technical necessity for serving pages, defending against abuse, and keeping the site online. This isn't a separate tracking layer; it's the baseline logging every website generates, handled under Netlify's own security and privacy practices.
Frameworks this policy is written against
This policy is written with two frameworks in mind: the EU/UK General Data Protection Regulation (GDPR), relevant to visitors in the EU/UK, and Malaysia's Personal Data Protection Act 2010 (PDPA), which applies to processing carried out from Malaysia. Neither is claimed to govern every visitor in full — the practices described here are applied consistently regardless of where you're visiting from.
Changes to this policy
If this policy changes in a material way — for example, a new processing activity is added — the "last updated" date at the top of this page will change, and for significant changes a note describing what changed will be posted here. There's no mailing list to notify, since none exists.