1. Overview
This Privacy Policy describes how Scoville Splice ("we," "us," or "our") collects, uses, and shares personal information when you visit scovillesplice.farm or use the Capsaicin Design Platform. We are committed to protecting your privacy in compliance with the California Consumer Privacy Act (CCPA), the European Union General Data Protection Regulation (GDPR), Canada's PIPEDA, and other applicable privacy laws.
2. Information We Collect
Account and Identity Data
When you create an account: name, email address, institutional affiliation, and authentication credentials. When you sign in via Google OAuth, we receive your Google profile name, email, and profile picture — we do not receive your Google password.
Usage and Platform Data
Construct designs, CRISPR guide configurations, FBA model parameters, and other design inputs you create on the Capsaicin Design Platform. Download history and license purchase records. Session metadata: IP address, browser type, operating system, pages visited, time spent, and referring URL.
Transaction Data
Payment method type and last four digits (stored by Stripe; we never store full card numbers). Billing address, if provided. Transaction history including license purchases and subscription records.
Communications
Messages you send to scovillesplice@gmail.com or via any support channel. Support ticket content and correspondence history.
Cookies and Tracking
See our Cookie Policy for details on cookies and similar technologies we use.
3. How We Use Your Information
We use your personal information to: provide, maintain, and improve the platform and services; process transactions and deliver licensed construct files; send transactional communications (purchase confirmations, subscription receipts, file delivery); send product updates and marketing communications where you have consented; investigate and enforce compliance with our Terms, licenses, and Acceptable Use Policy; comply with legal obligations including export control, biosafety reporting, and law enforcement requests; conduct research and analytics to improve our offerings (using aggregated or de-identified data where possible).
We do not sell your personal information to third parties for their marketing purposes.
4. Legal Basis for Processing (GDPR)
For users in the European Economic Area, we process personal data on the following legal bases: Contract — processing necessary to perform our agreement with you (account creation, license delivery, billing); Legitimate interests — fraud prevention, platform security, aggregated analytics, direct marketing to existing customers; Consent — marketing emails and non-essential cookies (you may withdraw consent at any time); Legal obligation — export control compliance, biosafety incident reporting, tax record-keeping.
5. How We Share Your Information
Service providers: Stripe (payment processing), Vercel (hosting), Clerk (authentication), Neon (database), Google (OAuth, analytics). These vendors are contractually bound to use your data only to provide services to us.
Legal compliance: We may disclose personal information when required by law, subpoena, court order, or to protect the rights, property, or safety of Scoville Splice, our users, or the public.
Business transfers: If Scoville Splice is acquired or merges with another entity, personal information may be transferred as part of that transaction; we will notify you before any such transfer changes how your data is used.
With your consent: We may share data for other purposes with your explicit consent.
6. Data Retention
Account data is retained for as long as your account is active plus seven years for tax and financial records. License purchase records and download logs are retained for ten years for intellectual property compliance purposes. Design files you create on the platform are retained until you delete them or close your account, plus 90 days for backup recovery. Biosafety incident reports are retained for 25 years as required by applicable regulations. You may request deletion of your account and associated data by contacting us at scovillesplice@gmail.com, subject to our retention obligations above.
7. Your Rights
California Residents (CCPA)
You have the right to: know what personal information we collect and how we use it; request deletion of your personal information (subject to exceptions); opt out of the sale of your personal information (we do not sell personal information); and not be discriminated against for exercising your privacy rights. To submit a request, email scovillesplice@gmail.com with the subject "CCPA Request."
EEA Residents (GDPR)
You have the right to: access, correct, or erase your personal data; restrict or object to processing; data portability; lodge a complaint with your national supervisory authority. To exercise these rights, email scovillesplice@gmail.com with the subject "GDPR Request." We respond within 30 days.
8. Security
We implement industry-standard security measures including TLS/HTTPS for all data in transit, encryption at rest for sensitive data, access controls limiting staff access to personal data on a need-to-know basis, and regular security reviews. Despite these measures, no system is perfectly secure. You are responsible for keeping your account credentials confidential.
9. Children's Privacy
The platform is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately at scovillesplice@gmail.com.
10. International Data Transfers
Scoville Splice operates in the United States. If you are located outside the U.S., your data will be transferred to and processed in the U.S. and other countries where our service providers operate. For EEA transfers, we rely on Standard Contractual Clauses approved by the European Commission where required.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting the updated policy with a new "Last updated" date. Your continued use of the platform after the effective date constitutes acceptance.
12. Contact
Privacy inquiries: scovillesplice@gmail.com