# Privacy Policy

Last updated: October 29, 2026

## 1. Who We Are

Matic Broz s.p., trading as ProteinIQ ("**ProteinIQ**," "**we**," "**our**," or "**us**"), operates the ProteinIQ platform and related services (the "**Service**"). Our mailing address is Veselova ulica 14, 3000 Celje, Slovenia.

ProteinIQ is the controller of the personal data described in this Privacy Policy, such as account, billing, usage, and support data. Where a customer uploads personal data inside its own scientific content, ProteinIQ processes that data on the customer's behalf under our [Data Processing Agreement (DPA)](https://proteiniq.io/legal/dpa), and the customer is the controller.

For privacy questions or requests, contact [privacy@proteiniq.io](mailto:privacy@proteiniq.io). We have not appointed a data protection officer because we are not required to.

## 2. Information We Collect

### 2.1 Account Information

- Name, email address, and profile image, including details from Google or GitHub if you sign in with one of them
- Workspace, team membership, role, and account preferences
- Plan, seat, and credit information

### 2.2 Billing Information

Payments are handled by Stripe. We receive the billing name, email, country or address, tax details you provide, and payment status and history. We do not receive or store full card numbers.

### 2.3 Scientific Content

- Sequences, structures, molecules, and other files you upload
- Job settings, results, workflow definitions, and project metadata
- File names, notes, and tags you add

Scientific content usually does not identify anyone. If it does, for example human genetic data linked to an individual, please remove identifiers before uploading. See Section 4.4.

### 2.4 AI Assistant and Studio Conversations

When you use the AI Assistant or Studio, we store your messages, the assistant's replies, any files or job results you attach, and technical details such as the model used and token counts.

### 2.5 Support, Feedback, and Program Submissions

- Support tickets and emails you send us
- Feedback, LinkedIn sharing submissions, and Scholars Program applications, including the details requested by the relevant program terms

### 2.6 Technical and Usage Information

- IP address, browser and device type, and approximate location derived from the IP address
- Pages viewed, features used, jobs submitted, and credit consumption
- Error logs, performance metrics, and security logs
- When a tool rejects an input or a submission fails: a description of the input that does not contain it, such as its format, line count, the line and column of the first problem, and a layout sketch in which letters and digits are replaced by placeholders
- To prevent abuse of free credits and duplicate accounts: a random device identifier stored in a cookie; the IP address (for IPv6 only the network part), browser and operating system version, and connection fingerprint (TLS) your browser sends with each request, including when you sign up; checks of whether your email address belongs to a disposable email service or reaches the same inbox as an existing account; and whether the same input file was submitted from several accounts; and manual review outcomes, reasons, dates, and the evidence used to review possible account connections

### 2.7 Cookies and Similar Technologies

- **Essential cookies**, provided by Clerk, keep you signed in and protect your account.
- **An account security cookie** (`piq_device`) holds a random identifier that helps us review possible connections between free accounts and check eligibility for welcome credits. A shared browser does not establish that the accounts belong to one person. It expires after 12 months without use.
- **Functional storage**, such as cookies and local storage, remembers your active workspace, interface preferences, dismissed announcements, and cached job history.
- **Analytics**: Vercel Analytics and Speed Insights measure page views and performance without cookies and without identifying you.

We do not use advertising cookies or cross-site tracking.

### 2.8 Free-Credit Eligibility

Free promotional credits are limited to one account per person. We automatically withhold a new account's welcome credits when another account has already received them, both accounts use the same browser cookie and recorded signup network, and their signup dates are within seven days. A shared network or similar device alone does not trigger this rule. This can also affect separate people sharing a lab computer.

This rule does not cancel an account, remove existing credits, prevent purchases, or restrict the use of paid credits. Accounts that do not receive welcome credits also do not receive the Free plan's monthly top-up unless a review approves their welcome credits. We show an explanation and a link to [support](https://proteiniq.io/app/support), where you can explain a shared computer or other circumstances and ask a person to review the decision. Approved accounts receive the welcome grant and become eligible for future monthly top-ups. You can also object to this processing at [privacy@proteiniq.io](mailto:privacy@proteiniq.io).

## 3. How We Use Information and Our Legal Bases

| Purpose | Legal basis (GDPR Article 6) |
| --- | --- |
| Create and run your account, workspaces, and seats | Performance of our contract with you |
| Run your jobs, store results, and provide the AI Assistant and Studio | Performance of our contract with you |
| Process payments, issue invoices, and keep accounting records | Contract and legal obligation (tax and accounting law) |
| Provide support and administer feedback, reward, and Scholars programs | Contract, or our legitimate interest in running those programs |
| Send service messages, such as job notifications, billing notices, and changes to our terms | Contract and legitimate interest |
| Send product tips and updates | Your consent, which you can withdraw in Settings or with the unsubscribe link in any such email |
| Keep the Service secure, apply rate limits, and prevent fraud and abuse | Legitimate interest |
| Understand usage and improve the Service, using aggregated or de-identified data where possible | Legitimate interest |
| Comply with the law and establish, exercise, or defend legal claims | Legal obligation and legitimate interest |

Where we rely on legitimate interest, you can object at any time (Section 8). We do not sell personal data, and we do not use it for advertising.

## 4. How Your Data Is Processed

### 4.1 Browser-Based Tools

Some tools run entirely in your browser. Their inputs do not leave your device unless you choose to save results to your account.

### 4.2 Hosted Tools and Storage

Hosted tools run as isolated compute jobs on Modal. Inputs and results are stored in our database (Prisma Postgres) and object storage (Cloudflare R2), encrypted in transit and at rest.

Some structure prediction tools send the protein sequences you submit to the public ColabFold MSA server, operated by researchers at Seoul National University in South Korea, to build sequence alignments as part of the tool's standard method. Only the sequences are sent, not your account details.

### 4.3 AI Features

AI Assistant and Studio requests go through OpenRouter, which we instruct to use only model providers that do not store your prompts or use them for training. We do not use your content to train machine learning models.

### 4.4 Sensitive Data

Please do not upload special categories of personal data, such as health or genetic data that identifies a person, unless you have a lawful basis to do so and have removed identifiers where possible. If you are a customer uploading such data, you are the controller and our [DPA](https://proteiniq.io/legal/dpa) applies.

## 5. Who We Share Data With

We share personal data only with service providers that help us run the Service, under contracts that require them to protect it and use it only for us:

| Provider | Purpose | Location |
| --- | --- | --- |
| Vercel, Inc. | Application hosting, analytics, and performance monitoring | United States |
| Prisma Data, Inc. | Database hosting | United States |
| Cloudflare, Inc. | File storage (R2) and content delivery | United States |
| Modal Labs, Inc. | Running hosted tool jobs | United States |
| Clerk, Inc. | Sign-in and account management | United States |
| Stripe | Payments, invoices, and tax calculation | Ireland and United States |
| Resend, Inc. | Sending email | United States |
| Upstash, Inc. | Rate limiting | United States |
| OpenRouter, Inc., and the AI model providers it routes to | Generating AI Assistant and Studio replies | United States and other countries |
| Sanity, Inc. | Website content management (no customer data) | United States |

We may also disclose information when the law requires it, to protect the rights, property, or safety of ProteinIQ, our users, or others, or to a successor if the business is transferred, for example to a company we set up to operate the Service. We will tell you before your data becomes subject to a different privacy policy.

## 6. International Transfers

Many of our providers are in the United States or process data there. When personal data leaves the European Economic Area, we rely on the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses, together with safeguards such as encryption. You can ask us for more information about these safeguards at [privacy@proteiniq.io](mailto:privacy@proteiniq.io).

## 7. How Long We Keep Data

- **Account data** is kept while your account is active and deleted within 30 days after you delete your account.
- **Scientific content and AI conversations** are kept until you delete them or your account or workspace.
- **Backups** are kept for up to 30 days, then permanently deleted.
- **Billing and invoice records** are kept for as long as tax and accounting law requires, currently up to 10 years.
- **Support and program correspondence** is kept for as long as needed to handle it and any follow-up.
- **Security and server logs** are kept for a limited period and then deleted.
- **Email delivery records** (the emails we sent you and whether they were delivered) are deleted after 12 months.
- **Layout sketches of rejected inputs** are deleted after 90 days.
- **Account connection records** (IP networks, browser summaries, and TLS connection characteristics) are kept for 90 days after they were last seen and deleted when you delete your account. Browser identifiers are removed after 12 months without use. After account deletion, its browser identifiers are kept for up to 12 months to help review repeat sign-up credit claims, then deleted.
- **Manual account review notes** are kept for up to 12 months and deleted when either participating account is deleted. You can access your review outcome, reason, and dates in your account data export. Review labels alone do not change credits or account access.
- **IP and browser details in credit transactions** are removed after 12 months, or when the account is deleted.
- **Workspace audit log entries** (who changed members, API keys, billing, projects, and sharing in a workspace) stay with the workspace for its administrators. The IP address on an entry is removed after 12 months. When you delete your account, your name and email address are replaced with "Deleted user" in the entries that mention you and the IP address is removed from entries you made.
- **Usage and credit records** are stripped of your name, email address, IP address, and browser details when an account is deleted, and kept for billing history, abuse prevention, and statistics. Once the email hash and device identifiers described here expire, they can no longer be linked to you.

After account deletion, we keep a non-reversible hash of your email address for 3 years so the same address cannot be used to create a new account, for example to reclaim sign-up credits. We may keep specific data longer when the law requires it or while a dispute is ongoing.

## 8. Your Rights

Under the GDPR, you have the right to:

- Access your personal data and receive a copy
- Correct inaccurate data
- Have your data deleted
- Restrict processing
- Receive your data in a portable format
- Object to processing based on legitimate interest, including product emails
- Withdraw consent at any time, without affecting earlier processing

You can download a copy of your data and delete your account in **Settings > Account**, and turn off product emails in **Settings > General** or with the unsubscribe link in any such email. For other requests, email [privacy@proteiniq.io](mailto:privacy@proteiniq.io). We will reply within one month. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

You can also complain to a data protection authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, [www.ip-rs.si](https://www.ip-rs.si/). You may also contact the authority in the EU country where you live or work.

## 9. Security

We use HTTPS for all connections, encrypt stored data, restrict access to the people and systems that need it, and monitor for abuse and security issues. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify you and the authorities as the law requires.

## 10. Children

The Service is not intended for anyone under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

## 11. Changes to This Policy

We may update this Privacy Policy. We will post the new version here with a new "Last updated" date and tell you about material changes by email or in the Service before they take effect.

## 12. Contact

**Email:** [privacy@proteiniq.io](mailto:privacy@proteiniq.io) **Operator:** Matic Broz s.p., trading as ProteinIQ **Address:** Veselova ulica 14, 3000 Celje, Slovenia