Privacy Policy

Last updated: January 2025

Introduction

NYU Stern's Volatility Laboratory (V-Lab) is committed to protecting your privacy. This policy explains how we collect, use, and protect information when you use vlab.stern.nyu.edu.

V-Lab is operated by New York University's Stern School of Business, Volatility and Risk Institute, located at 44 West Fourth Street, New York, NY 10012, USA.

Information We Collect

1. Basic Analytics (No Consent Required)

V-Lab uses Cloudflare Web Analytics to collect anonymous, aggregate website usage statistics for all visitors. This system:

• Does not use cookies or store data on your device

• Does not collect personal information

• Does not track you across websites

• Processes data anonymously via Cloudflare's global network

• Complies with GDPR, ePrivacy Directive, and CCPA

Legal Basis: Legitimate interest (GDPR Article 6(1)(f)) - necessary for website improvement and operational monitoring.

Data Collected (Anonymous):

• Page views (aggregate counts)

• Referral sources

• Country (derived from IP address, not stored)

• Device type and browser (aggregate)

• Core Web Vitals (performance metrics)

Data Retention: 6 months (automatically deleted)

Your Rights: You can object to this processing by enabling Do Not Track (DNT) in your browser or using an ad blocker.

2. Enhanced Analytics (Consent Required)

For users who consent via our cookie banner, we also use Google Analytics 4 to collect detailed usage data including:

• User journeys and navigation paths

• Session duration and engagement metrics

• Feature adoption and usage patterns

• Approximate demographics (age range, gender) - if available

• Technology details (screen resolution, browser version)

Legal Basis: Consent (GDPR Article 6(1)(a))

Data Retention: 14 months

Your Rights: You can withdraw consent at any time by visiting our [object Object] page.

3. Error Monitoring (Consent Required)

For users who consent, we use Sentry to collect error reports and diagnostic information to identify and fix technical issues. This includes:

• JavaScript errors and stack traces

• Browser and device information

• Page URLs where errors occurred

• Performance metrics

Legal Basis: Consent (GDPR Article 6(1)(a))

Server-side error monitoring operates under legitimate interest for operational purposes.

4. Chat Support (Consent Required)

If you consent and use our WotNot chatbot, we collect:

• Chat messages and conversation history

• Contact information you provide

• Session context

Legal Basis: Consent (GDPR Article 6(1)(a))

Cookies and Similar Technologies

V-Lab uses localStorage (not cookies) to store your privacy preferences. This is considered "strictly necessary" under GDPR and does not require consent.

Stored locally:

• vlab_consent_v1: Your consent choices (strictly necessary, no consent required)

If you consent to analytics and chat, additional cookies may be set by Google Analytics 4 and WotNot. You control these via our consent banner.

Third-Party Services

V-Lab uses the following third-party services:

• Cloudflare Web Analytics (USA) - Basic analytics (no consent required)

• Google Analytics 4 (Google LLC, USA) - Enhanced analytics (consent required)

• Sentry (Sentry.io, USA) - Error monitoring (consent required for client-side)

• WotNot (India) - Chat support (consent required)

Data transfers to the USA are covered by Standard Contractual Clauses and adequacy decisions where applicable.

Data Security

We implement appropriate technical and organizational measures to protect your data:

• HTTPS encryption for all connections

• Regular security updates and patches

• Access controls and authentication

• Monitoring and logging of security events

Your Rights Under GDPR

If you are in the European Economic Area (EEA), you have the following rights:

• Right to Access: Request a copy of your personal data

• Right to Rectification: Correct inaccurate data

• Right to Erasure: Request deletion of your data

• Right to Restrict Processing: Limit how we use your data

• Right to Data Portability: Receive your data in a portable format

• Right to Object: Object to processing based on legitimate interests

• Right to Withdraw Consent: Withdraw consent at any time via our [object Object]

To exercise these rights, contact us at the email below.

Children's Privacy

V-Lab does not knowingly collect personal information from children under 13 years old. If you believe we have collected such information, please contact us immediately.

Changes to This Policy

We may update this privacy policy from time to time. Significant changes will be communicated via a notice on our website. Continued use of V-Lab after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or wish to exercise your rights, please contact:

© 2025 New York University. All rights reserved.