Skip to main content

Privacy Policy

Last Updated: 17 October 2026

TL;DR: We protect your research data, don't sell it, don't use it to train public AI models, and give you full control to access or delete it anytime.

Welcome to smarts.bio ("smarts.bio," "we," "us," or "our").

Your privacy matters to us. This Privacy Policy explains what information we collect, how we use it, and your rights when using our platform and related services (the "Service").

By using smarts.bio, you agree to this Privacy Policy. If you don't agree, please don't use the Service.

1. Information We Collect

We collect information in several ways:

1.1 Information you provide directly

  • Account details: name, email, institutional affiliation, login credentials
  • Research files or data: biological datasets, genomic sequences, bioinformatics files, analysis parameters, and results
  • Messages, feedback, or support requests
  • Agent conversations: we store chat history so you can revisit past conversations and to improve agent performance using aggregated, anonymized data
  • You can delete individual conversations or your full chat history at any time from within the product

1.2 Information collected automatically

  • Technical data: IP address, browser, OS, device identifiers
  • Usage data: pages visited, actions, timestamps, feature usage, query patterns
  • Cookies and analytics (Google Analytics, Mixpanel)

1.3 Non-personal data

  • Anonymized and aggregated data to enhance analytics and system performance
  • Processed using data masking, aggregation, and removal of identifiers

2. How We Use Information

We use your information to:

  • Operate and maintain the Service
  • Process and analyze uploaded files to provide bioinformatics insights
  • Store and display past agent conversations for your convenience
  • Improve AI agent accuracy using aggregated, anonymized usage patterns
  • Enhance functionality, performance, and user experience
  • Communicate updates, announcements, and support messages
  • Ensure security, prevent abuse, and comply with legal obligations
  • Detect patterns of organizational use requiring institutional agreements
  • Enforce compliance with institutional account requirements
  • Name the organizations our users are affiliated with, publicly, on our website and in marketing materials

Important: We do not use uploaded research data or personally identifiable chat content to train public or third-party AI models. Any agent improvements are based solely on aggregated, anonymized patterns.

3. How We Share Information

We don't sell or rent your personal or research data. Sharing occurs only in the following cases:

  • Subprocessors – the complete list of providers that may process your data on our behalf:
    • Amazon Web Services – cloud infrastructure: hosting, file storage, compute, AI model inference, and text extraction from scanned documents you upload (United States)
    • MongoDB Atlas – database hosting: account data, metadata and conversations (United States)
    • Paddle.com Market Limited – payment processing as Merchant of Record (see Paddle Privacy Policy)
    • Mixpanel – product analytics: usage events and a user identifier (United States)
    • Google Analytics – marketing-site analytics only, never the application (United States)
    • Resend – transactional email: your email address and name (United States)
    • Tavily – web search performed on your behalf: the search terms your query generates (United States)
    • Public scientific databases – NCBI, UniProt, EBI, Ensembl and similar public research services. These are queried on your behalf to answer your question. They receive only what the query itself requires: typically a gene name, accession or search term, and for a sequence similarity search (such as BLAST) the sequence being searched, which may come from a file in your workspace. They do not receive your name, email or account identity: we identify ourselves to these services, not you. Your files are never uploaded to them wholesale, and we never send a sequence to an external database as part of a background or automated process you did not ask for

    About AI processing: all model inference runs on a managed AWS service in the United States. We select which model handles each step of your request; this is not something you choose. The models we currently use are developed by Amazon, Anthropic and OpenAI, but they run inside that AWS service, so your prompts are never sent to those companies' own APIs, and under AWS's terms your inputs are not retained or used to train models. We do not use your research data or conversations to train any model.

    We will update this list before adding a new subprocessor. If you have a Data Processing Agreement with us, we will notify you of changes as that agreement requires.

  • Legal requirements – compliance with laws, court orders, or to protect our rights
  • Business transfers – mergers, acquisitions, or asset sales under equivalent protection terms
  • Public reference to your organization – we may name the university, research institute, hospital or company you are affiliated with on our website or in marketing materials. We never publish your name, email address, job title, research data, or anything you have run on the platform, and we never state or imply that your organization endorses, partners with, or has purchased the Service. To opt out, email privacy@smarts.bio
  • With your consent – when you explicitly authorize sharing

Payment Data: When you make a purchase, Paddle collects and processes your payment information (credit card, billing address, etc.) as the Merchant of Record. We do not store your complete payment card details on our servers. Paddle's handling of your payment data is governed by their Privacy Policy.

We never share your research data with other users unless you explicitly choose to collaborate or share specific projects.

4. International Transfers & Compliance

Data Location: Your data is stored and processed in the United States. Regional data residency, such as EU-only or UK-only storage, is not part of our standard service. If your institution requires data to stay in a particular region, contact sales@smarts.bio and we will discuss what is possible as part of an enterprise agreement.

International Users: By accessing the Service outside the U.S., you consent to data transfer and processing in the U.S.

Privacy Frameworks: We are built around GDPR, UK GDPR, CCPA/CPRA and PIPEDA principles: a defined legal basis for processing, data export, deletion rights, a named data protection contact, and the subprocessor list in section 3 above. No company can self-certify GDPR compliance, so we describe what we do rather than claim a certification. A Data Processing Agreement is available on request.

  • Legal basis for EU/UK users: performance of contract, consent, legal obligations, or legitimate interests.

5. Data Retention & Deletion

  • Active accounts: Retain account info, research files, and chat history while active
  • Account deletion: When you close your account we erase your stored research files, revoke your API keys and sign-in credentials, and remove your personal information, organization and workspace memberships, and account records.
    • Closing your account revokes your API keys immediately and signs out every connected tool, including the command line interface, the editor extensions and the MCP server
    • Conversations you delete in the product are removed from our live database outright, not hidden or archived
    • Files you delete in the product stop being accessible immediately and are permanently erased within 30 days. Files are erased immediately when you close your account
    • Chat history, documents, process records and support tickets are retained after account closure, held against an account record that no longer contains your name, email address or other identifying details. This keeps the shared record of a workspace or organization intact for the people you worked alongside. If you want these records erased as well, contact us and we will do it
    • Deleted data is removed from our live systems on the timescales above. Database backup snapshots are kept on a fixed schedule for up to 12 months, so deleted data persists in those snapshots until they expire. We do not restore backups in order to recover deleted personal data
    • Operational logs are retained for 30 days, and security audit records for longer where we are required to keep them
    • Billing and invoice records are retained as long as tax and accounting law requires, which is an exception to erasure under GDPR Article 17(3)(b)
    • Aggregated or anonymized data that cannot identify you may be retained indefinitely
  • Data portability: You can request your data in machine-readable formats (JSON/CSV or original files)
  • Inactive accounts: Accounts inactive >2 years may be deleted after notice

6. Cookies & Analytics

6.1 Cookie Consent

We use a unified cookie consent system across all smarts.bio services (website, web application, and bio-viewers). Your consent preferences are shared across domains using a secure cookie (cookie-consent) with domain .smarts.bio, which means your choice on any platform applies to all others. Your preferences are remembered for 365 days.

  • On the marketing website (smarts.bio): A cookie consent banner appears when you first visit, allowing you to choose which types of cookies to accept.
  • In the web application (chat.smarts.bio): If you haven't previously consented on the website, you'll be asked for analytics consent after your first successful login. This post-login approach allows you to first authenticate (essential cookies only) before deciding whether to help improve the platform with usage analytics.
  • In the bio-viewers (view.smarts.bio): The same cookie consent system applies. If you haven't previously consented on the website or app, a banner will appear on your first visit allowing you to manage your cookie preferences.
  • Shared preferences: Your consent given on any platform applies to all three. You only need to consent once across all smarts.bio services.

6.2 Types of Cookies We Use

  • Essential cookies: Required for the website and web application to function properly. These include:
    • Website (smarts.bio): Login sessions, security features, and core functionality
    • Web Application (chat.smarts.bio): Authentication cookies (auth_token and auth_user) that store your login session and profile information. These cookies expire after 7 days and are configured with secure settings in production (HTTPS-only, SameSite protection)
    • Bio-viewers (view.smarts.bio): Authentication cookies (auth_token) for viewing files from authenticated workspaces. File viewing can be done without authentication for publicly shared files. These cookies are shared from the web application and follow the same security settings

    These cookies cannot be disabled as they are necessary for the services to work.

  • Analytics cookies: Mixpanel helps us understand how users interact with our website, web application, and bio-viewers, recording page views, feature usage and traffic sources. When you are signed in these events are associated with your account rather than being anonymous, so we can understand how the product is used over time. These cookies are only activated if you explicitly consent to them. If you reject analytics cookies, no tracking scripts will load in your browser. See section 6.4 for the one server-side exception. Google Analytics is used only on the marketing website (smarts.bio), not in the web application or bio-viewers.
  • Marketing cookies: May be used in the future for advertising and personalized content. Currently not in use. You can opt-out of these cookies through the cookie consent banner.
  • Preference cookies: Store your cookie consent choices and other user settings to improve your experience.

6.3 How to Manage Your Cookie Preferences

You have full control over your cookie preferences:

  • Marketing website (smarts.bio): When you first visit, you can choose to "Accept All", "Reject Non-Essential", or "Customize" your preferences. The "Customize" option lets you enable or disable specific cookie categories (analytics, marketing).
  • Web application (chat.smarts.bio):
    • First visit: An informational notice explains that essential authentication cookies are used
    • After first login: If you haven't already consented on the website, you'll be asked whether you want to help improve the platform with usage analytics. As described in section 6.2, these events are associated with your account while you are signed in. You can choose "Help Improve" (opt-in to Mixpanel) or "No Thanks" (essential cookies only)
    • Changing preferences: You can modify your analytics preferences at any time through your account settings (future feature) or by clearing the cookie-consent cookie and revisiting any platform
  • Bio-viewers (view.smarts.bio): The same cookie consent banner used on the marketing website appears on your first visit if you haven't already consented on another platform. You can choose to "Accept All", "Reject Non-Essential", or "Customize" your preferences.
  • Unified preferences: Your consent choice on any platform applies to all three. Accepting analytics on the website enables Mixpanel across all smarts.bio services, and vice versa
  • Browser settings: You can also control cookies through your browser settings, though this may affect website and application functionality

6.4 What Happens When You Reject Cookies

If you reject analytics or marketing cookies on any platform:

  • No Mixpanel or Google Analytics tracking scripts will be loaded in your browser, and no analytics cookies will be set
  • No browsing or interaction data will be collected from your browser
  • All platforms (website, web application, and bio-viewers) will continue to function normally
  • Only essential cookies necessary for authentication and core functionality will be active
  • Your rejection preference applies across all smarts.bio domains

One exception, stated plainly: some product events are recorded by our servers rather than your browser, for example when a long-running analysis starts or finishes. These are not affected by the cookie banner today, and they include an identifier for your account. We are changing this so that a rejection applies to server-side events as well. Until it ships, if you would like these excluded for your account, email privacy@smarts.bio and we will do it. These events never contain your files, your research data, or the content of your queries.

Essential authentication cookies (auth_token, auth_user) are required for the web application to function and cannot be rejected. If you choose to block these cookies through browser settings, you will not be able to log in or use the application.

6.5 Third-Party Cookie Policies

For more information about how our analytics providers handle data:

6.6 Do Not Track (DNT)

We do not currently detect the browser "Do Not Track" signal. There is no agreed standard for how services should respond to it, and we would rather tell you that than imply a protection we do not provide. Use the cookie banner to control analytics; rejecting analytics there stops tracking scripts from loading, which is the control that actually takes effect.

7. Data Security

Encryption: TLS 1.3 in transit on all public endpoints; AES-256 encryption at rest for stored files

Access control: Role-based access control enforced server-side, with organization and workspace isolation applied to every request. API keys are generated with a cryptographically secure random source, stored only as hashes, shown once, scoped, and revocable

Isolation: Each analysis runs in its own single-use, isolated container that is destroyed when the run ends. The container image is selected server-side and cannot be chosen by user input

Network: Databases are not publicly reachable. Deployments authenticate to our cloud provider using short-lived federated credentials rather than long-lived keys

Backups: Our databases are backed up continuously, with point-in-time recovery across a seven-day window and scheduled snapshots retained on the timescale set out in section 5

Not yet in place: We do not currently offer multi-factor authentication or single sign-on, and we do not hold SOC 2 or ISO 27001 certification. Both are on our roadmap. We would rather tell you this than imply otherwise

Limitations: No system is 100% secure; you are responsible for login credential confidentiality

Breach notification: We notify affected users via email within 72 hours of discovering a data breach

8. Your Rights

Depending on location, you may:

  • Access or receive a copy of your data
  • Correct or update information
  • Request deletion of account, files, or conversations
  • Object to or restrict processing
  • Withdraw consent for optional processing (analytics, marketing)
  • Opt out of having your organization named publicly (section 3)

Exercising your rights: Email privacy@smarts.bio with your name, email, request, and verification info. We respond within 30 days (extensions possible for complex requests).

Complaints: EU/UK users can contact local data protection authorities; U.S. users can contact their state attorney general.

9. Children's Privacy

  • You must be 18 or older to create an account directly
  • Users aged 13 to 17 may use the Service only through an institutional account, where the institution supervises their use and is responsible for obtaining any parental or guardian consent their jurisdiction requires. This matches our Terms of Use
  • We do not knowingly collect personal information from children under 13 under any circumstances

If you believe a child under 13, or a minor using the Service outside an institutional account, has provided us with personal information, contact us at privacy@smarts.bio and we'll delete it promptly.

10. Enterprise & Institutional Customers

  • Data Processing Agreement (DPA): Available on request for institutions that need processor terms in place
  • Institutional control: Administrators may enforce data retention, access, or deletion policies
  • Not suitable for regulated clinical use: smarts.bio is a research platform. It is not CLIA-certified or FDA-approved, and it is not validated for clinical diagnosis, patient care, or regulated GxP workflows. We do not offer a Business Associate Agreement, so the platform should not be used with protected health information. This matches the restriction already set out in our Terms of Use

Contact enterprise@smarts.bio for details.

11. Changes to This Policy

  • Material changes: notice on website 30 days in advance; email if rights are significantly reduced
  • Continued use after changes indicates acceptance
  • Version history available on request
  • The "Last Updated" date at the top reflects the latest version

12. Contact Us

Privacy inquiries: privacy@smarts.bio

Data protection contact: nir@smarts.bio

Security issues: security@smarts.bio

For urgent security matters, please use security@smarts.bio.