Privacy Policy

1. Who we are

Antibody.CiteZero is provided by AB-UK Ltd. ("we", "us"), a company registered in the United Kingdom. We are the data controller for the personal data described here. For any privacy question or request, contact amit@citezero.org.

2. Scope

This policy covers the web application at https://ab.citezero.org and the accounts and lab workspaces within it. Most of what you enter is scientific data (antibodies, protocols, results), which is generally not personal data — but some is: your account details, the record of which lab member did what, and anything personal you type into free-text fields. Please do not enter personal data about identifiable individuals (for example patients or named handlers) into notes or other free-text fields.

3. What data we collect

• Account & membership: email address and password (handled by our authentication provider, Supabase Auth), display name, lab name, your role (admin or member), and your lab's join code.
• Lab / research data you enter: antibodies (name, RRID, vendor, catalogue number, clone, conjugate, lot); experiments and their conditions (application, dilutions/amounts, fixation, retrieval, permeabilisation, blocking, washes, incubations, controls, and outcomes including negative and failed results); storage locations; free-text lab notes; reagents; and any private links or references you add (kept private to your lab).
• Files you upload (optional AI import): the inventory, protocol or your lab's own paper you choose to import, and the data extracted from it (see section 6).
• Technical data: standard server and security logs, and authentication tokens stored by your browser to keep you signed in.

We do not intentionally collect special-category data.

4. How and why we use it (legal bases)

• To provide the service — performance of our contract with you.
• To keep each lab's data private using row-level security so one lab cannot read another's — our legitimate interests in data isolation and security.
• To run the optional AI file-import — only with your explicit consent (section 6).
• To build an anonymised, aggregated knowledge pool we may licence — only with your explicit, granular consent (section 5).
• To secure the service and prevent abuse — our legitimate interests.

You may withdraw any consent at any time (section 10); withdrawal does not affect processing already carried out, subject to the forward-only note in section 5.

5. The anonymised knowledge pool

We keep the app free for academic labs and fund it by licensing an anonymised, aggregated pool of antibody-performance data, under rules built into the system:

• only with your explicit, granular consent (community pool, commercial licence and AI training are chosen separately);
• only de-identified and aggregated — never one lab's raw records; cross-lab figures appear only above a minimum number of contributing labs;
• commercial, CRO and company accounts are excluded from the pool entirely and are never licensed;
• your private references and links are never pooled or licensed;
• revocation is forward-only: you can withdraw at any time and we stop including your data going forward, but copies already included in a completed licensed export cannot be recalled.

6. AI file-import (optional)

If you import files instead of typing data, their contents are sent to Anthropic for one-time extraction, inside your authenticated session and only after you tick the consent box.

• Your files and extracted text are not used to train AI models.
• Anthropic deletes the content within 30 days, retained only to screen for abuse.
• We never share your uploads or extracted data with other labs.
• Only permitted document types are accepted (spreadsheets, protocol documents, and your lab's own papers); photos and scans are not. Extraction produces a proposal you review before anything is saved.
• You can always decline and enter data manually, in which case nothing leaves your session for AI processing.

7. Who we share it with

We do not sell your personal data, and we never share one lab's identifiable records with another lab. We use these providers under data-processing terms: Supabase (database, authentication and hosting of your data), Cloudflare (serving the application), and Anthropic (only if you opt in to AI import). The public API key shipped in the app is public by design and grants no access beyond what row-level security permits.

These providers may process data outside the UK/EEA (including in the United States); where required we rely on the UK International Data Transfer Agreement / Addendum and/or EU Standard Contractual Clauses.

8. Planned features (not yet live)

We are transparent about features under development that would introduce new data flows. None of these are active yet; each will be opt-in where it involves your data, and we will update this policy and obtain any required consent before launching it:

• cross-institutional / institutional sharing (optional, institute-scoped visibility of selected records);
• belonging to more than one lab and switching between them;
• a mediated contact relay to reach another user without exposing email addresses;
• hosting shared images (we currently store links only, not image files);
• registry look-ups that send non-lab-identifying bibliographic metadata (not your protocols or results) to external services such as the Antibody Registry, on an opt-in basis;
• extracting antibody data from published papers into a separate literature layer;
• aggregated cross-lab performance statistics and literature references, gated on a minimum number of labs;
• optional AI summarisation of your free-text notes, under the same no-training / limited-retention terms as section 6.

9. How long we keep it

Account and lab data are kept while your account and lab are active, and until you ask us to delete them. AI-import file contents are deleted at the processor as described in section 6. Aggregated, de-identified pool data is retained per the consents you gave (forward-only, section 5). Backups and security logs are deleted on a rolling basis.

10. Your rights

Under UK and EU data-protection law you can access your data, have it corrected or erased, restrict or object to processing, request portability, and withdraw consent at any time. Lab admins can edit or remove lab records in the app; for account deletion or a formal request, contact amit@citezero.org. We aim to respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority.

11. Security

Access is controlled by per-lab row-level security, so members of one lab cannot read another lab's records; authentication and storage are handled by Supabase. No system is perfectly secure, but we work to protect your data and will notify you and the regulator of a personal-data breach where required.

12. Cookies and local storage

We use only what is necessary to keep you signed in (authentication tokens stored by your browser). We do not use advertising or analytics cookies.

13. Children

The service is for professional research use and is not directed at children under 16.

14. Changes

We will post changes here and update the effective date; material changes affecting your rights — and any launch of a planned feature that processes your data — will be notified in the app or by email.

15. Contact

AB-UK Ltd. — amit@citezero.org.