PRIVACY POLICY

Data Controller

Polymer Genomics is the data controller for personal data processed through this platform. For data protection inquiries, contact: hello@polymerbio.org

What We Collect

Polymer Genomics collects minimal data necessary to operate the service:

• Server logs: IP address, request path, timestamp, and HTTP status code. These are retained for operational monitoring and abuse prevention.
• API keys: If you use an API key for authenticated access, the key and associated usage metadata are stored.

What We Do Not Collect

We do not store individual-level genomic data. This platform serves only publicly available reference annotations. No user-uploaded genomic data is processed or retained.

Cookies

We do not use tracking or advertising cookies. The Vercel hosting platform may set strictly necessary cookies for load balancing and security. No third-party analytics are deployed. No data is shared with third parties for marketing or advertising purposes.

GDPR (European Users)

Our lawful bases for processing personal data are: (a) server logs — legitimate interest in maintaining service security and availability; (b) API key management — contract performance; (c) abuse prevention — legitimate interest. Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Request erasure of your data
• Object to processing of your data
• Request data portability

To exercise these rights, contact us at the address below.

CCPA (California Users)

Under the California Consumer Privacy Act, California residents have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information. To submit a request, contact us at the address below.

Cross-Border Data Transfer

Our servers are located in the United States (Virginia). If you access the service from the EU/EEA/UK, your data is transferred to the US. We process only minimal technical data (IP addresses in server logs) under the legitimate interest basis. No individual-level genomic or personal data is collected or transferred.

Children

This service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child under 16, please contact us and we will promptly delete it.

Data Retention

Server logs are retained for up to 90 days for operational purposes and then automatically deleted. Error logs are retained for 30 days. Database query logs are not retained beyond server logs. Computed analysis sessions (MCP) are retained until user requests deletion or 30 days of inactivity. API key records are retained for the duration of the key’s active use and deleted upon request.

Contact

For privacy-related requests or questions, contact: hello@polymerbio.org