Data processing agreement
Last updated 26 September 2026
This page is the agreement. It takes effect when you start a trial, it covers the personal data described in the privacy notice, and it names every sub-processor below.
1. Who is who
Siyun Cao
OX2 6PS
For the personal data of the person who starts a trial — their name, email address, organisation and network address — we are the controller. For the procedure text a trial pastes in, which is the trial's own material and may contain personal data we neither ask for nor need, we act as processor on that organisation's instructions, and those instructions are the trial itself: read the text, find the chemicals in it, show the results.
2. What we do with it, and nothing else
We process it to run the trial, keep it within its limits, and follow up with the person who started it. We do not use it to train anything, sell it, share it for advertising, or combine it with data from anywhere else. If we are ever required by law to disclose it, we will tell you unless the law forbids that.
3. Sub-processors
| Who | Where | What they receive | Why |
|---|---|---|---|
| Anthropic, PBC | United States | The procedure text a trial pastes | Reading the chemicals out of it. Their commercial terms forbid training on it; they state API inputs and outputs are deleted within 30 days. |
| Railway Corp. | United States | The application and its database, so all of the above | Hosting. |
| Firecrawl | United States | Supplier page addresses and a chemical's name | Fetching a supplier's own public page when no marketplace lists the chemical. No trial's details or pasted text. |
| MolPort, ChemSpace, Mcule | Latvia, Ukraine and the United States, Hungary | A chemical's name, structure and amount | Finding real offers. No trial's details or pasted text. |
That is the whole list. We will tell the address a trial was started from before adding to it or replacing any of them, and you may object.
4. Transfers out of the UK and the EEA
Every processor above is outside the UK and the EEA. Each transfer is made under the European Commission's Standard Contractual Clauses as incorporated by that company's own data processing terms, with the UK Addendum where UK law applies.
5. Security
What the code actually does is written out on the security page, in enough detail to hold us to it, including where there is no audit. In summary: one password for the owner's view, a random token per trial stored only as a hash, every row scoped to one trial and every database call required to say whose, transport encryption everywhere, and no third-party script, font or analytics on any page.
6. How long, and giving it back
A trial and everything in it are deleted 30 days after it starts, automatically. It can be deleted at any time before that, by the person holding it or on request. Afterwards a keyed hash of the email address remains for 12 months, so the same address cannot start a second trial; it cannot be read back as an address. There is nothing to export: everything a trial produces is on its own screen and downloadable from it as CSV.
7. Breaches
We will notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, and the affected people directly where it is likely to be a high risk to them, saying what happened and what was affected.
8. Audits
There is no SOC 2 report and no ISO 27001 certificate. Instead, ask us anything on the security page and we will answer specifically, and you may inspect this service's behaviour yourself at any time. If your process requires a certificate, tell us early and we will say honestly where we are rather than let it come up at signature.
9. Contact
Every question, request and notice under this agreement: siyun_cao@outlook.com. We answer within 30 days.