Privacy Policy

This policy explains what personal data PeptideProof collects, why, who receives it and what rights you have. It applies to https://peptiproof.app and the related API and widgets.

1. Who is responsible

The controller of your personal data is [legal entity name], [registered address]. Privacy contact: [privacy email].

2. What we collect

• Account data — email address, optional name, a salted hash of your password (never the password itself), and, if you sign in with a provider, the identifiers it returns. Also when you accepted the Terms and which version.
• Your uploads and what we derive from them — the files (PDF, JPEG, PNG, WebP) or URL you submit, the text extracted from them, structured evidence (laboratory, report number, batch, results, dates), verification results, and cryptographic fingerprints used to detect re-used documents. Documents can contain personal data (for example names or contact details on a report); please upload only what you need to.
• Usage and plan data — your plan, monthly usage counts, purchased credits and their ledger, saved reports, watchlist items, alerts, and, for API users, key metadata (never the raw key after creation) and request counts.
• Billing data — a Stripe customer identifier and subscription status. Card details are entered on Stripe’s pages; we never receive them.
• Messages and submissions — emails you send us, and details in corrections or vendor-claim submissions (including the email address you provide and your stated relationship to the entity).
• Technical data — IP address and browser user-agent, used transiently for security, rate limiting and to derive an anonymous daily visitor hash; server and error logs; page views and a small set of product events (for example “signup”, “analysis started”, “search performed” with only the number of results — not what you searched for).
• Photos you submit for vial scanning, if that feature is enabled for you, and the label text read from them.

We do not knowingly collect special-category data. We do not collect advertising identifiers and do not use advertising cookies.

3. Why we use it, and on what basis

4. How AI is used on your documents

To read a document, we send its extracted text to our AI provider (Anthropic) to pull out structured fields. For photos, scans, and PDFs with no selectable text, we send the page images so the text can be read from them. We also send a short summary of the computed evidence to draft a plain-language explanation. We send each document to one provider only. We do not use your uploads to train models. The AI extracts and explains; verification states are decided by deterministic rules, and no decision with legal or similarly significant effect on you is made by automated means. There is no setting to switch AI processing off, because reading the document is the Service; if that is unacceptable for a document, do not upload it. Under Anthropic’s published terms for its commercial API, inputs and outputs are not used to train its models by default and are deleted from its systems within 30 days, except content flagged for policy violations (which can be kept longer) and where the law requires otherwise; its current terms are in its privacy centre at privacy.claude.com.

5. Who receives your data

• Service providers (processors) that host, process, bill and email on our behalf — listed with their purpose and location on the subprocessors page. They may use the data only on our instructions.
• The public, but only what you choose to publish: a published report shows the derived evidence and verification result, never your identity.
• Authorities and advisers where required by law, to enforce our terms or to protect rights and safety, and a successor if the business is sold (with notice).

We do not sell your personal data or share it for cross-context behavioural advertising.

6. International transfers

Some providers process data outside the UK/EEA (notably in the United States). Where they do, we rely on an adequacy decision (for example the EU–US Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses with supplementary measures.

7. How long we keep it

• Private uploads and their derived data — until you delete them or your account.
• Account deletion — unpublished documents are deleted from storage and the database. A document behind a report you published is kept, detached from your account, so that the public record stays accurate; your account record is anonymised (email replaced, name and credentials removed) and kept only as a minimal audit stub.
• Billing records — for 8 years, as Hungarian accounting requirements demand where they apply to us.
• Product events and logs — product events for 13 months, server logs for 30 days.
• Backups — deleted data can persist in provider backups for up to 30 days after deletion before being overwritten.

8. Your rights

Depending on where you live you have the right to access your data, have it corrected or erased, restrict or object to processing, receive it in a portable format, and withdraw consent. You can export your data (Account → Your data) and delete your account (Account → Danger zone) yourself; for anything else email [privacy email]. We respond within one month. You may also complain to your data-protection authority — in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), naih.hu — or the authority where you live. California residents: we do not “sell” or “share” personal information as those terms are defined in the CCPA, and we do not discriminate for exercising your rights.

9. Security

Uploads are stored privately and served only through short-lived signed links; passwords are stored as salted hashes; access to each report is checked on the server; uploads are validated and size-limited; and requests are rate limited. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

10. Cookies and local storage

We use only the cookies needed to keep you signed in and protect forms. We store no analytics or advertising identifiers on your device. Details are on the cookies page.

11. Children

The Service is for people aged 18 and over. We do not knowingly collect data from children; if you think we have, contact us and we will delete it.

12. Changes and contact

We will post updates here and, for material changes, notify you in advance. Questions: [privacy email].