Privacy Policy.

01The short version

• We collect what an account needs to exist and nothing beyond it.
• There is no analytics, no advertising and no third-party tracker on this site. No pixel, no session recorder, no fingerprinting.
• The only cookie we set is the one that keeps you signed in.
• We do not sell personal data, ever.

02What we hold

• Account data: your name, your email address, a hash of your password (never the password itself), whether your address is verified, and your role.
• Session data: the sessions open on your account, with the approximate time and the browser they were opened from, so you can see and revoke them.
• Sign-in codes: a one-time code is stored hashed and deleted once used or expired, within ten minutes.
• What you submit to the products: the molecules, files and parameters you send to a workspace, and the results returned.
• Server logs: ordinary operational records of requests, kept briefly for security and debugging.

03Why we hold it

To give you an account and keep it secure, to run the products you asked for, to send the service emails an account requires (verifying an address, resetting a password, delivering a sign-in code), and to protect the service against abuse. Under the GDPR the legal bases are performance of a contract with you and our legitimate interest in keeping the service safe.

We do not send marketing email. If that ever changes it will be opt-in, and the consent will be separate from this policy.

04Cookies and local storage

One cookie, and it is strictly necessary: the session cookie that keeps you signed in across sagace.org and its subdomains. It carries no advertising identifier and follows you nowhere else. Signing out removes it.

The sign-in screen also writes a single key to your browser’s session storage, recording that the arrival animation has played so it does not repeat. It holds no personal data and is erased when you close the tab.

05Who processes it

Sagace runs on Microsoft Azure, which hosts the application, the database and, through Azure Communication Services, the service emails we send you. Microsoft acts as a processor on our instructions and does not use your data for its own purposes.

We share personal data with no one else: no advertisers, no data brokers, no analytics vendor. We would disclose data if the law required it, and we would tell you unless we were forbidden to.

06How long we keep it

Account data lives as long as your account does. Close it and we delete the account and its content within 30 days, except where we are required to keep something longer. Sessions expire on their own. Sign-in codes are gone within ten minutes. Logs are kept briefly and then rotated away.

07Your rights

If you are in the European Economic Area or the United Kingdom you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to a use based on legitimate interest. You can also ask for it in a portable form.

Write to hello@sagace.org and we will answer within one month. If you think we have handled your data badly, you may complain to your national data protection authority. In France, that is the CNIL.

08Security

Passwords are hashed, never stored or logged in the clear. Traffic is served over HTTPS only. Session cookies carry the __Secure- prefix and are inaccessible to page scripts. Administrative access is limited to the people who need it. No system is perfect; if we ever suffer a breach that puts your rights at risk, we will notify you and the relevant authority as the law requires.

09Children

The service is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will remove it.

10Changes and contact

The date at the top of this page is the date of the current version. If a change materially affects you, we will tell account holders by email before it takes effect.

The data controller is Sagace. Reach us at hello@sagace.org. The terms governing use of the service are in the Terms of Service.