Privacy Policy

1. Introduction

WeaveSeq Engineering (“WeaveSeq,” “we,” “us,” or “our”) is committed to protecting the privacy of individuals who visit our website, use our platform, or engage with our services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at weaveseq.com (the “Site”) or interact with our computational protein engineering services (collectively, the “Services”).

By accessing or using the Site and Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Site and Services.

2. Information We Collect

2.1 Information You Provide Directly

When you engage with WeaveSeq — by submitting an intake form on our Site, creating an account, or communicating with us directly — we may collect the following categories of personal information:

• Contact and identity information: your name, email address, and organization or institutional affiliation.
• Project and scientific information: descriptions of target molecules, application areas, scientific objectives, and any other details you voluntarily share through intake forms on our home page or at /start.
• Structural data files (optional): PDB or CIF protein structure files you may upload to facilitate binder design. These files are transmitted over encrypted connections and stored in S3-compatible object storage.
• Authentication credentials: if you create an account, we store your email address and a bcrypt-hashed password. Alternatively, you may authenticate via Microsoft Entra ID OAuth, which provides us with your name and email address from your identity provider.
• Correspondence: any information you provide when you contact us at business@weaveseq.com.

2.2 Information Collected Automatically

When you visit the Site, we automatically collect certain information about your device and usage through standard internet logging and analytics tools:

• Analytics data: We use Google Analytics 4 (GA4) to understand how visitors interact with the Site. GA4 collects information such as pages visited, time spent on each page, referring URLs, browser type, device type, and approximate geographic location (country or city level). GA4 does not collect your IP address in full — IP addresses are truncated before storage. GA4 is configured with a unique measurement identifier assigned by Google and stored as a server-side configuration variable.
• Server logs: Our hosting provider, Vercel, maintains server access logs that include request timestamps, HTTP status codes, and anonymized request metadata. These logs are used for operational monitoring and security purposes.
• Rate-limiting metadata: We use Upstash Redis to enforce rate limits on our intake forms and API endpoints. This may temporarily store your IP address or a hashed derivative in memory for the duration of the rate-limit window. This data is not persisted beyond its operational purpose.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: to evaluate your project intake, communicate with you about potential engagements, and deliver the computational protein engineering services you have requested.
• Authentication and account management: to verify your identity when you sign in, maintain your account, and protect against unauthorized access.
• Communication: to respond to your inquiries, send transactional emails related to your engagement (via Resend), and provide updates about our Services.
• Site improvement: to analyze usage patterns through GA4 and improve the Site’s content, navigation, and performance.
• Security and compliance: to detect, prevent, and respond to fraud, abuse, security incidents, or violations of our Terms of Service.
• Legal obligations: to comply with applicable laws, regulations, and lawful requests from governmental authorities.

We do not sell, rent, or trade your personal information to third parties for advertising or marketing purposes. We do not serve third-party advertising on the Site.

4. Third-Party Services and Data Processors

We engage the following third-party service providers to operate the Site and deliver our Services. Each provider acts as a data processor on our behalf and is contractually bound to handle your data in accordance with applicable data protection laws.

5. Cookies and Tracking Technologies

The Site uses first-party cookies necessary for authentication (session cookies managed by Auth.js v5) and for security (cross-site request forgery prevention tokens). These cookies are strictly necessary for the Site to function and are not used for tracking or profiling.

Google Analytics 4 sets first-party analytics cookies (“_ga”, “_ga_*”) to distinguish unique users and measure session engagement. These cookies do not store personally identifiable information directly. You may opt out of GA4 tracking by configuring your browser to reject analytics cookies or by using Google’s opt-out browser add-on at tools.google.com/dlpage/gaoptout.

The Site does not use third-party advertising cookies, remarketing pixels, or social-media tracking beacons.

6. Data Storage and Security

Personal data is stored in a PostgreSQL database managed through Prisma ORM. All data in transit between your browser and our servers is encrypted using TLS 1.3. Data at rest is encrypted using AES-256 encryption at the storage layer.

We implement technical and organizational measures to protect your information, including:

• Passwords are hashed using bcrypt with per-user salts before storage.
• Multi-factor authentication is available through Microsoft Entra ID OAuth integration.
• Rate limiting via Upstash Redis protects against brute-force and credential-stuffing attacks.
• Access to production data is restricted to authorized personnel and follows the principle of least privilege.
• Infrastructure is hosted on Vercel, which maintains SOC 2 Type II and ISO 27001 certifications.

No method of electronic storage or transmission is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

Specifically:

• Intake submissions: retained while your engagement with WeaveSeq is active. Upon conclusion of an engagement or after a sustained period of inactivity, intake data is archived to secure long-term storage and may be deleted at your request.
• Account data: retained while your account remains active. You may request deletion of your account at any time.
• Analytics data: GA4 retains data for 14 months by default. Aggregated and anonymized analytics data may be retained indefinitely.
• Server logs: Vercel retains access logs for a limited period as documented in their data processing agreement.

8. Your Data Protection Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

8.1 GDPR (European Economic Area, United Kingdom, and Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: request that we correct any inaccurate or incomplete data.
• Erasure: request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations.
• Restriction: request that we limit the processing of your data in certain circumstances.
• Portability: request a copy of your data in a structured, machine-readable format and have it transmitted to another controller.
• Objection: object to processing of your data based on legitimate interests.

8.2 CCPA (California)

If you are a California resident, you have the right to:

• Know: request disclosure of the categories and specific pieces of personal information we have collected about you.
• Delete: request deletion of personal information we have collected from you.
• Opt-out of sale: We do not sell personal information as defined under the CCPA, and we confirm this here explicitly.
• Non-discrimination: you will not receive discriminatory treatment for exercising your CCPA rights.

To exercise any of these rights, please contact us at business@weaveseq.com. We will respond to verifiable requests within the timeframe required by applicable law — typically 30 days under GDPR and 45 days under CCPA. We may need to verify your identity before fulfilling your request.

9. International Data Transfers

WeaveSeq is based in the United States, and our service providers operate infrastructure in the United States and globally (Vercel’s edge network, Upstash Redis regions, S3-compatible storage regions). If you are located outside the United States, your personal data may be transferred to, stored in, and processed in the United States or other jurisdictions where our processors maintain facilities.

When we transfer personal data across borders, we rely on appropriate safeguards, including standard contractual clauses and the data protection frameworks maintained by our infrastructure providers. Vercel, Resend, and Upstash each offer Data Processing Agreements (DPAs) that incorporate the EU Standard Contractual Clauses.

10. Children’s Privacy

The Site and Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal obligations. When we make material changes, we will revise the “Last updated” date at the top of this page and, where appropriate, provide additional notice (such as an email to active account holders or a notice on the Site). Your continued use of the Site after changes become effective constitutes your acknowledgment of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or need to report a privacy concern, please contact us at: