Privacy Policy.

01The short version

• We collect what an account needs to exist and to be kept safe, and nothing beyond it.
• There is no analytics, no advertising and no third-party tracker on this site. No pixel, no session recorder, no fingerprinting, and the fonts are served from our own servers, so loading a page tells nobody else you visited.
• The only cookies we set are the ones that sign you in and keep you signed in.
• Everything the service holds is stored in the European Union, in Microsoft’s Paris region.
• We do not sell personal data, ever.

02What we hold

• Account data: your name, your email address, a profile picture if you add one, a hash of your password (never the password itself), whether your address is verified, and your role.
• Session data: the sessions open on your account, with when each was opened and the IP address and browser it was opened from, so you can see and revoke them.
• Sign-in codes: a one-time code is stored hashed and deleted once used or expired, within ten minutes.
• Two-step verification: if you turn it on, the secret your authenticator app shares with us and your recovery codes, both stored encrypted.
• Your answers on arrival: how you heard of Sagace, your organisation, your job title and what you mean to use it for, asked once.
• Invitations: when someone invites an address to an organisation or a project, we hold that address with the invitation until it is accepted or expires, seven days later.
• What you submit to the products: the molecules, files and parameters you send to a workspace, and the results returned.
• Messages: what you write to us, through the contact form or by email, with the address you give us to answer.
• If you develop on the platform: your GitHub username once you connect it, the computers you authorise and when, the projects you belong to, and the deployments you push, recorded with your GitHub username.
• Server logs: for each request, the IP address it came from, the address requested, the time and the response. They carry no request headers, cookies or form content.

03Why we hold it

To give you an account and keep it secure, to run the products and the platform you asked for, to send the service emails an account requires (verifying an address, resetting a password, delivering a sign-in code or an invitation), to answer you, and to protect the service against abuse. Under the GDPR the legal bases are performance of a contract with you, and our legitimate interest in keeping the service safe, in answering the people who write to us, and in knowing who uses a research preview, which is what the questions asked on arrival are for.

We do not send marketing email. If that ever changes it will be opt-in, and the consent will be separate from this policy.

04Cookies and local storage

Only cookies that are strictly necessary, and none that follows you anywhere else:

• the session cookie that keeps you signed in across sagace.org and its subdomains. It lasts thirty days, renewed while you use the service, and signing out removes it;
• short-lived cookies that carry a sign-in while it is in progress, such as the step between your password and a second verification;
• if you open a branch preview, a separate session cookie that belongs to that preview alone.

The sign-in screen also writes a single key to your browser’s session storage, recording that the arrival animation has played so it does not repeat. It holds no personal data and is erased when you close the tab.

05Who processes it

Sagace runs on Microsoft Azure, in its France Central region in Paris, which hosts the application, the database and, through Azure Communication Services, the service emails we send you. Microsoft acts as a processor on our instructions and does not use your data for its own purposes.

OVHcloud, in the European Union, receives mail sent to sagace.org addresses and forwards it to the mailbox of the person who answers. For hello@sagace.org, and for most of what the contact form sends, that mailbox is also at OVHcloud. One member of the team reads their mail in Google Workspace, so a message that reaches them is held by Google as well. Google may store it outside the European Union, and such transfers rely on the EU-US Data Privacy Framework and standard contractual clauses.

GitHub is involved only if you develop on the platform. When you connect your GitHub account we read your username, and we add you to or remove you from our GitHub organisation as your role changes; GitHub holds your account under its own terms. GitHub, Inc. is in the United States, and transfers to it rely on the safeguards it provides for them: the EU-US Data Privacy Framework and standard contractual clauses.

Cloudflare answers the DNS lookups for sagace.org. It never carries your traffic, so it sees none of your data.

We share personal data with no one else: no advertisers, no data brokers, no analytics vendor. We would disclose data if the law required it, and we would tell you unless we were forbidden to.

06How long we keep it

Account data, your answers on arrival and what you submit live as long as your account does. Close it and we delete the account and its content within 30 days, except where we are required to keep something longer. A session ends thirty days after you last used it, or when you sign out or revoke it. Sign-in codes are gone within ten minutes, and an invitation nobody accepts within seven days. Messages are kept as long as the conversation needs them. Server logs stay on the machines that write them and are overwritten as they fill, usually within days; there is no central store of them.

Database backups let us restore the service to any moment of the last seven days, so something deleted from the service is gone from the backups seven days later.

07Your rights

If you are in the European Economic Area or the United Kingdom you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to a use based on legitimate interest. You can also ask for it in a portable form. Your account page already lets you see and change your details and sign your sessions out, without asking anyone.

Write to hello@sagace.org and we will answer within one month. If you think we have handled your data badly, you may complain to your national data protection authority. In France, that is the CNIL.

08Security

Passwords are hashed, never stored or logged in the clear. Traffic is served over HTTPS only. Session cookies carry the __Secure- prefix and are inaccessible to page scripts. Two-step verification is required of everyone who develops on or administers the platform, and administrative access is limited to the people who need it. No system is perfect; if we ever suffer a breach that puts your rights at risk, we will notify you and the relevant authority as the law requires.

09Children

The service is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will remove it.

10Changes and contact

The date at the top of this page is the date of the current version. If a change materially affects you, we will tell account holders by email before it takes effect.

The data controller is SAGACE, a société par actions simplifiée at 47 rue Vivienne, 75002 Paris, France, registered in Paris under number 109 761 866 (see the legal notice). Reach us at hello@sagace.org. The terms governing use of the service are in the Terms of Service.