Privacy Policy

1. Scope and Who We Are

This Privacy Policy explains how Pipette.bio ("Pipette," "we," "our," or "us"), operated by Variome Analytics, collects and uses personal data when you visit pipette.bio, create an account, use the Pipette.bio analysis platform, or contact us. Together, these websites and services are the "Service."

In short, we collect the information needed to operate your account, perform the analyses you request, support billing, respond to you, and protect the Service. We do not sell your personal data or research data. We do not use your queries, uploaded files, or results to train our own or third-party AI models.

2. Information We Collect

2.1 Account and Profile Information

When you create or manage an account, we collect information such as your username, name, email address, account tier, and optional organization or profile details. Account credentials are stored using password hashing rather than as readable passwords.

2.2 Research Content

When you use Pipette for an analysis, we process content that may include:

• Questions, instructions, and conversation history;
• Files and datasets you upload or connect to the Service;
• Analysis settings, parameters, generated code, and workflow records; and
• Intermediate files, figures, reports, results, and provenance records.

You retain ownership of your research content. Pipette processes it only to provide the Service, comply with your instructions, and meet the limited operational and legal purposes described here.

2.3 Usage, Billing, and Technical Information

We collect information needed to operate and secure the Service, such as:

• Task status, session identifiers, credit usage, processing duration, and related operational records;
• Purchase events, credit balances, and transaction or invoice identifiers;
• IP address, browser and device information, timestamps, logs, and error information; and
• Website interactions collected through cookies or similar technologies, subject to your choices.

Payment card details are handled by our payment processor and are not received by Pipette servers.

2.4 Communications and Contact Forms

If you contact us, request support, join a waitlist, or submit a website form, we collect the information you provide. This can include your name, work email, organization, team size, inquiry type, message, and related correspondence. Do not submit patient identifiers, protected health information, account credentials, or confidential research data through public website forms.

3. How and Why We Use Information

We use information to:

• Authenticate users and operate, maintain, and deliver the Service;
• Plan and run requested analyses and return results;
• Preserve project history, provenance, and user-requested workspace continuity;
• Meter usage, process purchases, maintain billing records, and enforce plan limits;
• Respond to questions, support requests, security reviews, and DPA requests;
• Prevent abuse, investigate incidents, and protect users and the Service;
• Understand performance and improve reliability and user experience; and
• Comply with applicable law and enforce our agreements.

Where applicable law requires a legal basis, we process information as needed to provide the Service under our agreement with you, to meet legal obligations, for legitimate interests such as security and service improvement, or with your consent for optional cookies and marketing measurement.

4. AI Processing and Model Training

Pipette uses AI service providers to interpret requests and assist with analysis. Query text, conversation context, and limited portions or summaries of files that the agent needs to inspect may be sent to those providers for inference so that Pipette can perform the analysis you requested.

• We do not use your queries, uploaded files, or results to train Pipette's AI models.
• We do not permit third-party AI providers to use that content to train their models.
• We may use aggregated, non-identifying operational measurements to improve reliability and performance.

5. When We Share Information

We do not sell your personal data or research data. We disclose only the information reasonably necessary in these circumstances:

• Service providers: Providers that support AI inference, hosting and processing, payments, analytics and error reporting, security, and website form handling.
• Your organization: If you use a team-owned workspace, authorized workspace members and administrators may access content and account information according to their roles.
• Legal and safety: When required by valid legal process or reasonably necessary to protect Pipette, our users, or the public.
• Business changes: In connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice where required.

Optional analytics or marketing-measurement tools may receive website interaction, browser, device, and network information after you grant the relevant consent. They do not receive your Pipette research files, analysis queries, or results through the website tracking configuration.

6. Retention and Deletion

• Account information: Retained while your account is active and as needed for account administration.
• Project content: Files, reports, outputs, and project history may remain available so you can continue and reproduce prior work until you delete them or the applicable service lifecycle ends.
• Billing and legal records: Retained as required for accounting, tax, dispute, and legal obligations.
• Security and diagnostic records: Retained for a limited period appropriate to fraud prevention, incident investigation, debugging, and service reliability, then deleted, rotated, or anonymized.
• Account deletion: Following a verified request, account information and associated content are deleted or anonymized, except where retention is required for legal, tax, security, or dispute-resolution purposes.

7. Cookies and Similar Technologies

We use the following categories of browser storage and tracking technologies:

• Necessary: Used for sign-in, security, consent records, and preferences needed for requested functionality.
• Analytics: Google Analytics helps us understand website traffic and improve the site. It is controlled through the consent notice.
• Marketing measurement: Meta Pixel may measure campaign performance after you consent. It does not receive your Pipette research files, analysis queries, or results through the website tracking configuration.

You can accept, decline, or customize optional cookies from the consent notice. You can also clear stored choices through your browser and choose again. Blocking necessary storage may prevent account or security features from working correctly.

8. Security

We use technical and organizational safeguards appropriate to the nature of the Service, including encryption in transit and at rest, access controls, scoped project access, isolated analysis execution, logging, and abuse protections. No online service can guarantee absolute security. For more information, see our Security page or contact us for a security review.

9. International Processing

Pipette is operated from India, and our service providers may process information in other countries. Privacy protections can differ between jurisdictions. Where required, we use appropriate contractual or other lawful safeguards for international transfers. Organizations can contact us to discuss processing locations, transfer requirements, and a data processing agreement.

10. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, restrict, object to the use of, or receive a portable copy of your personal data. You may also withdraw consent for optional processing and complain to an applicable data protection authority.

• You can download analysis outputs and delete individual files through available product controls.
• You can unsubscribe from marketing messages using the link in those messages.
• You can request account deletion or exercise a privacy right by emailing us.

We may need to verify your identity before completing a request, and some rights are subject to legal exceptions. Contact info@pipette.bio with the subject “Privacy request.”

11. Regulated and Sensitive Data

Contact us before uploading protected health information or other data subject to special contractual, regulatory, residency, or institutional requirements. We will review the proposed use, safeguards, and agreement requirements with your team. A data processing agreement may be available for eligible organizational use cases.

12. Children's Privacy

The Service is not intended for children under 18, and we do not knowingly collect personal information from children. Contact us if you believe a child has provided personal information to Pipette.

13. Changes to This Policy

We may update this Privacy Policy as the Service or applicable requirements change. We will update the date above and provide additional notice when required. The version posted on this page is the current website Privacy Policy for the Service.

14. Contact Us

Questions, privacy requests, security reviews, or DPA inquiries can be sent to info@pipette.bio or through our contact form.

Variome Analytics
Operator of Pipette.bio