Privacy Notice

This notice explains what personal data AlphaSuite collects, why, on what legal basis, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read it carefully.

1. Who We Are (Data Controller)

AlphaSuite is developed and operated by AvennaX (company registration in progress; until incorporation is complete, AlphaSuite is operated by its founding team). References to “we”, “us”, or “our” mean AvennaX / the AlphaSuite founding team. We are the data controller for personal data processed in connection with AlphaSuite.

We are based in the United Kingdom. UK GDPR applies to all processing described in this notice.

Contact: AvennaXLtd@outlook.com

Once we are registered with Companies House, we will update this notice with our registered company number and address. We will also register with the Information Commissioner’s Office (ICO) as required under the Data Protection (Charges and Information) Regulations 2018.

2. Personal Data We Collect and Why

AlphaSuite does not require account creation or login. Most ordinary use of AlphaSuite involves no collection of directly identifiable personal data.

2a. Analytics — understanding how the service is used

When you visit a page on AlphaSuite, we derive a short anonymised fingerprint from your IP address and browser type (user-agent string). This fingerprint is a one-way, non-reversible SHA-256 hash, truncated to 16 characters. We cannot reverse this to identify you. It is used solely to count approximate unique visitors and understand overall usage patterns so we can improve the service.

• Data stored: anonymised visitor fingerprint (truncated hash derived from IP address and browser type); page path visited; timestamp
• Raw IP address: not stored
• Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR) — understanding aggregate usage to operate and improve AlphaSuite. We have assessed that this processing does not override your interests or fundamental rights, given the one-way anonymisation applied and the absence of any profiling or tracking across sessions
• Retention: 12 months from collection, after which analytics records are deleted automatically

2b. Waitlist sign-up — notifying you when new features launch

If you choose to join our waitlist, we collect your email address and, optionally, your name.

• Data stored: email address; name (optional); timestamp of sign-up
• Lawful basis: Consent (Article 6(1)(a) UK GDPR) — you provide this data voluntarily by submitting the sign-up form
• Retention: until we have sent your waitlist notification, or until you request deletion, whichever is earlier
• Withdrawal of consent: you can withdraw your consent and request deletion of your waitlist entry at any time by emailing AvennaXLtd@outlook.com. Withdrawal does not affect the lawfulness of any processing carried out before withdrawal

2c. Contact correspondence

If you contact us by email, we process your email address and the content of your correspondence in order to respond to your enquiry.

• Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR) — responding to correspondence and maintaining business records
• Retention: as reasonably necessary to resolve your enquiry, and for up to 24 months thereafter

3. Data We Do Not Collect

• We do not collect your name, address, phone number, or any identity document information during ordinary use
• We do not use cookies or advertising trackers. See our Cookies & Local Storage page for details
• We do not build user profiles or share your data with advertisers
• We do not sell personal data — ever
• The UniProt or PDB identifiers (protein codes) you submit to AlphaSuite are scientific identifiers, not personal data. They are sent to third-party scientific databases server-side to retrieve annotation results

4. Third-Party Services That May Receive Your Data

All scientific database lookups performed by AlphaSuite (UniProt, InterPro, PDBe, SIFTS, RCSB PDB, AlphaFold DB) are performed server-side. Your browser does not contact these databases directly, and they do not receive your IP address from AlphaSuite.

However, when your browser loads AlphaSuite, it contacts the following third-party services, which may receive your IP address and browser information as part of normal web request processing:

• Google LLC (Google Fonts) — AlphaSuite loads the DM Sans and IBM Plex Mono fonts from Google’s font delivery service. When your browser requests these fonts, Google receives your IP address and browser user-agent. Google processes this data under its Privacy Policy. Google relies on Standard Contractual Clauses (SCCs) to legitimise transfers of personal data from the UK.
• EMBL-EBI (EBI CDN) — AlphaSuite loads the PDBe Mol* 3D viewer library from EBI’s content delivery network. When your browser requests this library, EBI may receive your IP address and browser user-agent. EMBL-EBI is a European intergovernmental organisation and processes data under its terms of use.

We do not share your personal data with any other third parties, and we do not use your data for advertising purposes.

5. International Data Transfers

Your analytics data and waitlist data are stored on servers located in the United Kingdom or the European Economic Area. We do not transfer your personal data outside the UK/EEA.

Google Fonts transmits your IP address to Google LLC, which is based in the United States. Google relies on Standard Contractual Clauses approved under the UK GDPR framework to ensure adequate protection for this transfer. For more information, see Google’s privacy frameworks page.

6. Cookies and Local Storage

AlphaSuite does not use cookies. We use your browser’s local storage to remember one preference: your chosen colour theme (light or dark mode). This is stored under the key alphasuite-theme in your browser’s local storage and is never transmitted to our servers or to any third party. It stays entirely on your device.

For full information, including how to clear this data, see our Cookies & Local Storage page.

7. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction. These include HTTPS encryption in transit, hashed analytics identifiers, password-protected administrative access, and rate limiting on our API. No system can be completely secure; in the unlikely event of a personal data breach that affects your rights and freedoms, we will notify the ICO and affected individuals as required by UK GDPR.

8. Your Rights Under UK GDPR

You have the following rights in relation to personal data we hold about you. Not all rights apply in all circumstances — we will tell you if a particular right does not apply to your request.

• Right of access (Article 15): to request a copy of the personal data we hold about you, together with supplementary information about how it is used
• Right to rectification (Article 16): to ask us to correct inaccurate or incomplete personal data
• Right to erasure / “right to be forgotten” (Article 17): to ask us to delete your personal data in certain circumstances
• Right to restriction of processing (Article 18): to ask us to pause processing of your data in certain circumstances, for example while a dispute is resolved
• Right to data portability (Article 20): to receive personal data you have provided to us (for example, waitlist data) in a structured, machine-readable format
• Right to object (Article 21): to object at any time to processing based on our legitimate interests, including the anonymised analytics described in section 2a. We will stop that processing unless we have compelling legitimate grounds that override your interests
• Right to withdraw consent: where we process your data on the basis of consent (waitlist sign-up), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal

To exercise any of these rights, email us at AvennaXLtd@outlook.com. We will respond within one calendar month. We may need to verify your identity before acting on a request. There is no charge for making a request.

9. Right to Complain to the ICO

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113

We would, however, welcome the opportunity to resolve any concern you have directly before you contact the ICO — please reach out to us first.

10. Children

AlphaSuite is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under the age of 16. If you believe we have inadvertently collected data from a person under 16, please contact us and we will delete it promptly.

11. Changes to This Notice

We may update this privacy notice from time to time to reflect changes in our practices or legal obligations. We will update the “Last updated” date at the top of this page. Where we make material changes, we will take reasonable steps to bring those changes to your attention. Continued use of AlphaSuite after an update constitutes acceptance of the revised notice.

12. Contact

For any privacy-related questions, requests, or complaints, contact us at:

AvennaXLtd@outlook.com
AlphaSuite / AvennaX — United Kingdom