What we collect
When you create an account we collect your name and email address, whether the address has been confirmed, your sign-in sessions and your email preferences. Your password is never stored; we keep only a salted scrypt hash of it. If you create API keys, we keep their names, a short hint of each and when each was last used, and the keys themselves only as hashes. When we email you a one-time code to confirm your address or reset your password, we keep only a keyed hash of the code, for 15 minutes of use.
When you use the service we keep what you give us and what the service makes for you: the questions you type, the plans and prices made from them, the structure files you upload or fetch, the molecules you add, your conversations with the plan and results assistants, the ratings you give their replies together with the question and reply each is about and any comment you add, and everything a run produces, including trajectories, analyses, movies, interaction maps, reports and the files you can download. We also keep a record of every hold, charge, refund and grant of credits on your account, and a monthly record of your use of the assistants.
If you buy credits, we keep a record of each payment: the amount, any tax, the credits it bought, when it was made, whether it was refunded or disputed, the identifiers our reseller or payment processor gave the payment and you as its customer, and the link to its receipt. Your card details are entered on the checkout page of the company that takes the payment and never reach us; that company also asks for the billing details it needs to charge any sales tax or VAT.
Like most websites, our hosting provider's logs record your IP address and the pages and addresses you request. We also count requests from one network for a few hours to limit repeated sign-up, sign-in and code requests. We do not use analytics or advertising scripts and do not track you across other sites. Our pages load fonts and code libraries from third-party content delivery networks, which see your IP address as any site you load files from does.
Signing in with Google
If you choose Continue with Google, we ask Google only for the openid, email and profile scopes. Google then tells us your name, your email address, that Google has verified it, and Google's identifier for your account. We never see your Google password, and we have no access to your Gmail, Drive, contacts or any other Google data.
We use this information only to create your ConformerLab account or sign you in to it, to link it to an account that already uses that address, and to address the emails you ask for. It is stored in our account database with the rest of your account. We do not sell it, use it for advertising, use it to train or improve AI models, or share it with anyone except the provider that hosts our database. ConformerLab's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can remove ConformerLab's access at any time from your Google account's third-party connections page. To have the Google identifier removed from your ConformerLab account as well, write to us (below).
How we use it
We use your information to provide the service you ask for: to read your question, plan and price the study, run it, analyse the results and prepare the report. We use it to keep your account secure, which includes signing you in, confirming your email address, resetting a forgotten password and limiting repeated attempts, and to tell you about your runs, for example when one finishes or fails and before its files are deleted, by email when you have that turned on and always in the app.
We also use it to account for credits, to take payment for credits you buy, to refund them when that is due and to keep the records that tax law requires. Our team reads the ratings you give the assistants' replies, and what they were about, to make the assistants better. We use your information only for these purposes. We do not sell it and do not use it for marketing.
Sharing your information
ConformerLab reserves the right to share limited information with carefully selected service providers and business partners where this is required to provide, operate and support a seamless service. These include providers of cloud hosting, databases and file storage, of the computing capacity on which studies run, of the artificial-intelligence models that read questions, draft plans and write the assistants' replies, of email delivery, and of sign-in and payment services. Each receives only the information needed for its part of the service, acts on our instructions or under its own obligations of confidentiality and data protection, and may not use your information for any other purpose.
Credits are sold through our authorised reseller, identified in our terms of service, which acts as the merchant of record. We send it your email address and the purchase, meaning the credits, their price and our own reference for the payment. It collects your payment and billing details on its checkout page under its own privacy policy, and tells us whether the payment went through or was refunded, its identifiers for the order and for you as its customer, and a link to its receipt.
Some features look up public scientific databases and services on your behalf, for example when you name a protein, give a sequence or name a molecule. Our server makes these requests, not your browser, and they carry only what the lookup needs, never your name, email address or IP address. A sequence you want kept confidential should not be looked up. When you give a link to a library of molecules, or choose a built-in library, our server downloads the file from its source, and the request asks only for that file. Where a feature would send a structure file you provide to an outside scientific service, the app asks you first, and nothing is sent unless you agree.
We may also disclose information where the law requires it, to respond to lawful requests, to protect the rights, property or safety of ConformerLab, our users or others, or as part of a merger, acquisition or sale of the business, in which case this policy continues to apply to it. We do not sell personal information.
To learn more about the categories of recipients, or for a list of our current service providers, contact us at info@conformerlab.com.
Where it is kept
Our servers, database and file storage are hosted by cloud providers in the United States, and studies run on rented computing capacity that may be located in other regions. If you are outside the United States, your information is transferred to and processed in the United States and those other locations.
How long it is kept
A run's files are kept for 30 days after the run finishes, plus any months of storage you buy and seven days' grace, after which the large files are deleted; the run's record, its summary and its report stay with your account. Plans and uploaded structures that are never approved are kept for 30 days. One-time codes can be used for 15 minutes and are removed within a day after that, and the counts used to limit sign-up, sign-in and code requests are kept for about two hours. The app keeps your newest 100 notices.
Your account, credit history and run records are kept for as long as you have the account and are deleted when you ask us to delete it, except what we must keep by law. Payment records are kept for as long as tax and accounting law requires, even after the account is deleted. We keep a copy of the database each week, for five weeks, in our cloud storage; when you delete your account, it leaves these copies as they age out. Request logs are kept for as long as our hosting provider keeps them.
Security
Every connection to ConformerLab is encrypted (HTTPS). Passwords, API keys and one-time codes are kept only as hashes, and files are encrypted at rest by our storage provider. The machines that run a study receive credentials limited to that run's files, and your plans, runs, files and credits answer only to your account. If a breach affects your information, we will tell you by email.
Your choices and rights
You can download a run's files, results and credit history from the app at any time, and you can turn off the emails about your runs in the app's notifications panel. To see, correct, export or delete the information we hold about you, or to object to how we use it, write to us from the address you sign in with; we answer within 30 days. You can also download your data and delete your account yourself on the account page in the app. Deleting it erases your profile, studies, runs, files, notices and conversations at once, and keeps payment records only as the law requires, without your email address.
If you are in the European Union or the United Kingdom, you also have the rights the GDPR and the UK GDPR give you, including the right to complain to your data protection authority. ConformerLab is intended for researchers and is not directed at children under 16.
Contact and changes
Write to info@conformerlab.com with any question about this policy or about how your information is handled. When this policy changes, the new version is published here with its date.