This is a positive step forward, but some questions are still not answered fully and transparently. I don’t understand why Startpage/System1 won’t directly answer the following questions (I’ve added notes on important parts still NOT addressed):
The % of Startpage and Surfboard Holding B.V. (the Startpage holding company) System1 acquired in December 2018. [Still not addressed. This is important for understanding who actually has power over decisions long-term (a CEO may be short term) and whether the company is directly subject to U.S. laws via legislation like The CLOUD Act.]
The current % ownership by System1 at the time of the audit (and any other major owners). [Still not addressed. What % is owned by System1, Privacy One Group and any significant shareholder today? Important for transparency and verifying trust in communications by the company.]
Information about Privacy One Group Ltd. Where is it registered and in what city, state and country does it operate? (We have not been able to verify registration information.) [We now have Delaware verification, but where does it actually operate? Was it just for investment? If so, then how is it a separate operating unit? Has System1 been involved in day-to-day company business, and has it touched any part of the Startpage data process?]
A diagram of data flows, including flows to outside organizations, like System1, Privacy One etc. [EDIT: We have received a new diagram that is helpful in understanding the data flows. It appears (see fine print) that some data is processed by System1, but “fuzzed” or “anonymized.”]
EDIT: I now see some fine print next to the diagram showing that some “fuzzed” data is sent by Startpage to System1 for processing, then presumably returned. Looks like maybe selecting EU only search engines might be a solution to avoiding System1. Not sure.
Startpage/System1 states the following in its newly posted information:
System1 is a sizeable consumer internet and applications company, owning sites like HowStuffWorks, Activebeat, MapQuest, among others, and does purchase advertising for its websites. System1’s businesses generally do not involve building or maintaining user profiles and little user information is processed or stored within System1.
This paragraph reveals that at least some user information is processed or stored with System1, raising more questions.
Here are some excerpts from that “privacy” policy that discusses how System1 may not collect user personal personal info, but somehow can get that information and associate it with a user:
Information We Collect Through Automatic Data Collection Technologies
As you use our services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:
- Details of your use of our services, including traffic data, location data, logs, and other communication data and the resources that you use on our services.
- Information about your computer and internet connection, including your IP address, operating system, and browser type.
We also may use these technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking).
The information we collect automatically is statistical data and does not include personal information, but we may maintain it or associate it with personal information we collect in other ways or receive from third parties. It helps us to improve our services and to deliver a better and more personalized service. [emphasis added]
So System1 does not collect personal information but “may associate it with personal information [they] collect in other ways or receive from third parties”? I’d like to know more about that and if that has any implications for Startpage users.
We should still want to know why it has taken so long and multiple requests to get many of these answers.