Privacy Policy

1. What We Collect

Account data. Email address, full name, and hashed password when you register. We never store plaintext passwords.

Molecular structures. SMILES strings you submit for screening. These are processed on our secured servers (CPU inference) and stored in an access-controlled database, never shared with third parties, and deleted on request. You retain full ownership of your molecular data.

Usage data. API request timestamps, endpoint paths, and error codes for rate limiting and operational monitoring. We do not track individual keystrokes, mouse movements, or session replays.

Payment data. If you subscribe, billing is handled by Stripe. We never see or store your credit card number. Stripe sends us only your billing email, subscription status, and last-four digits of the payment method.

2. What We Do Not Collect

We do not collect cookies for advertising, social media tracking pixels, or third-party analytics scripts. The only third-party script on ToxScreen pages is Alpine.js (loaded from CDN) and Stripe.js (on the billing page). We do not use Google Analytics, Facebook Pixel, or any ad-tech.

3. How We Use Data

• Account data: to authenticate you, send service emails (welcome, report-ready, billing receipts), and manage your subscription.
• Molecular structures: to compute toxicity predictions and generate reports. Structures are retained until you request deletion.
• Usage data: to enforce rate limits, diagnose errors, and improve service reliability.

4. Data Sharing

We do not sell your data. We do not share your molecular structures with third parties. Your email is shared with Stripe for billing purposes only. We may disclose information if required by law or to enforce our Terms of Service.

5. Data Security

All traffic is TLS-encrypted. Molecular structures are stored in an access-controlled database, never shared with third parties, and deleted on request. Passwords are hashed with bcrypt and card details are handled by Stripe (we never see them). API authentication uses session tokens. Inference runs on our secured servers (CPU) with no public ingress to the prediction pipeline. We follow security best practices but cannot guarantee absolute security against all threats.

6. Data Retention

Molecular structures are retained until you request deletion. Account data is retained until you request deletion. You may delete your account and all associated data by emailing info@toxscreen.ai.

7. Your Rights

You may access, correct, or delete your personal data at any time. To exercise these rights, email info@toxscreen.ai. We will respond within 30 days.

8. Changes

We will notify you of material privacy policy changes via email or a banner on the Service.