Privacy Statement

Primordiant, Inc. (“Primordiant”, “we”, “us”) is the controller of the personal data described here. This statement covers the Primordiant website, the account console, the desktop app and command-line tools, the API, and messages you send us. It does not cover the practices of your own institution or of third-party sites we link to.

The Service is in beta. As it develops we may collect new kinds of data; when that happens we update this statement and tell you.

Account details. Your name, email address, organization, and profile picture if your sign-in provider supplies one. When you sign in with Google or Microsoft we receive your email, name, and the provider's stable account identifier. We never see your password: email-link sign-in has none, and Google and Microsoft keep theirs.

Plan and settings. The plan you chose, its billing interval, whether on-demand usage is enabled, whether “Share data” is on, and your theme preference. Billing is not yet switched on; when it is, payment details will be handled by a payment processor and we will not store card numbers ourselves.

Experimental content. The protocols you write, the skills you install, the observations, measurements, and results the desktop app records while running experiments, and the prompts you give the system.

Usage events. The desktop app reports what ran and when: protocol runs, robot hours, skills used, and the instrument or robot involved, so that we can show you your own history and usage against your plan.

API keys. Keys you create are stored hashed; we keep the prefix, the name you gave the key, and when it was last used.

Messages. Anything you send through the contact form or by email, along with the topic you selected.

Waitlist answers. If you join the Primordiant waitlist: your name, email, organization, role, field, how your lab runs experiments today, how you heard about us, and anything you tell us you hope to do with Primordiant. We use them to decide whom to invite and to write to you about access.

Technical data. Server logs with IP address, browser type, requested pages, and timestamps, kept for security and to diagnose problems.

We use this data to:

• sign you in, keep your session, and connect the desktop app and API keys to your account;
• run your experiments, store their records, and show them back to you and your team;
• measure usage against your plan and, once billing exists, invoice you;
• answer your messages and send service emails such as sign-in links and notices about changes;
• keep the Service secure, prevent abuse, and debug failures;
• understand how the beta is used so that we can improve it, using aggregated or de-identified data.

Training. We do not use your experimental content or prompts to train models unless you turn on “Share data” in Settings, or we have a written agreement with your organization. You can turn the setting off again at any time; content shared before then may already be part of a training run, but we stop using it for new ones.

We do not sell personal data, and we do not use it for advertising. The website carries no advertising or social-media tracking pixels.

Where data-protection law such as the GDPR or UK GDPR applies, we rely on: performance of our contract with you (running the Service and your account); our legitimate interests in securing, operating, and improving the Service, balanced against your rights; your consent where you have given it, for example by turning on “Share data”; and compliance with legal obligations.

We share personal data only with the providers we need to run the Service, and only what each one needs:

• Hosting and database providers that run the website, console, and the database where your account and experimental records live;
• Email delivery providers that send sign-in links, notices, and replies to your messages;
• Sign-in providers (Google and Microsoft) when you choose to sign in with them, under their own privacy terms;
• Payment processors, once billing is switched on, for card handling and invoicing;
• Your team. On a Teams or Enterprise plan, workspace administrators can see who ran what, on which instrument, and when.

We may also disclose data when the law requires it, to protect the safety of people or the integrity of the Service, or as part of a merger, acquisition, or sale of assets, in which case this statement continues to apply to the transferred data.

We use a single session cookie to keep you signed in, plus short-lived cookies during a sign-in flow to protect against forgery. Your light or dark theme choice is stored in your browser's local storage. None of these track you across other sites, and there are no third-party analytics or advertising cookies.

You can clear cookies in your browser at any time; doing so signs you out.

Account details and experimental records are kept while your account is open. Sessions expire after 30 days without use. Server logs are kept for a short period, normally no longer than 90 days. Contact messages are kept as long as needed to deal with your request and for a reasonable period afterwards.

When you close your account we delete or anonymize your data within a reasonable period, except where we must keep it by law, for example invoicing records, or where it sits in routine backups that expire on their own schedule.

Data is encrypted in transit, API keys are stored as hashes, and access to production systems is limited to team members who need it. No system is perfectly secure, and the Service is in beta; if you learn of a security problem, please tell us at info@primordiant.com so that we can fix it.

We are based in the United States and our providers operate there and elsewhere. If you use the Service from outside the US, your data will be transferred to and processed in the US. Where required, we rely on recognized transfer mechanisms such as standard contractual clauses with our providers.

You can see and change your name, organization, and privacy settings in the console. Depending on where you live you may also have the right to access, correct, export, or delete your personal data, to restrict or object to how we use it, and to withdraw consent. To exercise any of these, email us; we will respond within the time the law requires and will not treat you differently for asking.

If you are in the EEA, the UK, or Switzerland you may also complain to your local data-protection authority.

The Service is for professional and academic research and is not directed at children. We do not knowingly collect data from anyone under 18; if you believe we have, tell us and we will delete it.

We will update this statement as the Service and the law change. Material changes are posted here with a new date, and account holders are emailed before they take effect.

Privacy questions and requests go to info@primordiant.com or through the contact page. Our Terms of Service cover the rest of the relationship.