Privacy Policy

• The free calculators need no account and send nothing to a server — the arithmetic runs in your browser.
• We collect an email address when you create an account.
• Study records you save are yours. We do not sell them and do not use their contents to train models.
• We never see your card details. Paddle handles payment data as merchant of record.
• No advertising networks and no third-party tracking scripts. We use Vercel's first-party, cookieless analytics (aggregate page views and visit counts only — no individual profiles, no cross-site tracking).

Account. Your email address, and — if you sign in with Google — the basic profile Google returns. Authentication is handled by Supabase. We never receive your Google password.

Study data. The measurements, method details, results and audit trail you enter into a validation study, stored against your account. Because a study is a quasi-regulated record, its audit trail deliberately records who made each change and when.

Billing. Your subscription status and plan. Card numbers never reach our servers — Paddle collects and stores them, and sends us only the subscription state.

Technical. Standard server logs kept by our host. These record that a request happened and whether it failed. By design, our application code never writes study contents or email addresses into a log line.

• To perform our contract with you — running your account, storing your studies, producing your reports.
• With your consent — product emails, which you can withdraw at any time by unsubscribing.
• For our legitimate interests — keeping the service secure and working, and preventing abuse.
• To meet legal obligations — retaining billing records where tax law requires it.

We keep the list of processors short on purpose. Each holds data only to provide its part of the service:

• Vercel — hosting and request logs.
• Supabase — authentication, session management, and the Postgres database holding accounts, studies and subscription state.
• Kit — product email.
• Paddle — payments, invoicing and sales tax, as merchant of record.

These providers operate internationally, so your data may be processed outside the Philippines and outside your own country.

• Account and study data: for as long as your account is open.
• After you cancel: retained for 90 days so you can come back or export, then permanently deleted.
• On request: we will delete your account and its data at any time, without waiting for that window.
• Product emails: until you unsubscribe.
• Billing records: as long as tax and accounting law requires, which is generally longer than the above.

Deleting a study inside the product is a soft delete — the record is marked deleted and kept, so its audit trail survives. Deleting your account removes the underlying records outright.

You can ask us to give you a copy of your data, correct it, delete it, or restrict what we do with it. You can export any study as JSON or CSV yourself, at any time, without asking.

Email support@assayproof.com and we will respond within 30 days. If you are in the EEA or UK and are unhappy with our response, you may complain to your local data protection authority.

We set a session cookie when you sign in, so that you stay signed in. That is the only cookie the product requires, and there are no advertising or analytics cookies to consent to.

Data is encrypted in transit. Access to a study is checked against its owner on every request, on the server. We aim to hold as little personal data as the product can function with, which is why the calculators need no account at all.

If you believe you have found a vulnerability, please tell us at our contact page before disclosing it publicly.

AssayProof is a professional laboratory tool and is not directed at children. We do not knowingly collect data from anyone under 16.

If we change this policy materially we will give notice by email or in the product. The date at the top always reflects the current version.