Privacy

1. About this notice

1.1 This notice describes how Sauriq processes personal data when you visit the public website, submit a Join private preview request, or use the invite-only product. It covers both the marketing site and the signed-in product as they are operated today.

1.2 Our Terms explain invite-only preview use.

2. Who this notice applies to

2.1 This notice applies to visitors of the public site, people who submit a Join private preview request, invited product users, and teammates who can see membership or content in a shared workspace.

2.2 Product access is currently by invitation. A Join private preview request does not create an account.

3. Join private preview

3.1 When you use Join private preview, we use the details you provide to respond to your request and arrange a walkthrough. We collect your name and work email, and any organization, team size, or message you choose to provide. We also record your agreement to be contacted, the form’s source page, and when the request was submitted. Your name, work email, and agreement to be contacted are needed to handle the request; the other fields are optional.

3.2 We use your request for that conversation, not for an advertising list. We do not sell your information. If you do not submit the form, we do not create a demo-request record from an ordinary page view.

4. Product accounts

4.1 For invited users, we process an email address, sign-in credentials, name and profile details to provide and administer an account. We store a password hash, not a recoverable password.

4.2 We also remember the preferences you set, such as language, timezone, working hours, availability, and interface settings.

4.3 We record when you accept the Terms and the versions of the Terms and Privacy notice presented to you. When your institution uses single sign-on for your account, we store the identity-provider subject, the identifier your institution’s sign-in system assigns to you, and the related sign-in fields needed to link that login to your account.

4.4 Authorized people operating the service can access account information where needed. Teammates can see membership and content made available to them through their workspace access.

5. Workspace content

5.1 Your organization decides whom it invites. Access follows workspace membership and permissions. For personal data an organization is allowed to place in a workspace under a written agreement, that organization is the controller: it decides why the personal data is used and who it is shared with. We process that content on the organization's behalf to provide the service. For a request about workspace content, contact your organization and write to [email protected]. We will coordinate with your organization.

6. Support requests

6.1 When you report a problem, ask a question, or share an idea from inside the product, we store your message, the kind of request, your account, and technical details that help us reproduce the issue: the page you were on, the app release, your browser and screen size, language and display settings, and an error reference if one was shown. If you were in a workspace you can access, we also record which workspace it was. The form shows these technical details before you send it. These automatic details exclude workspace content, passwords and browser logs. Please include only information needed to explain your request.

6.2 A copy of each request, including your name and email address, is emailed to the people operating Sauriq so they can answer you. Replies are sent by email.

6.3 We use support requests to answer you and to fix and improve the service. We delete a support request 12 months after the last substantive contact about the support request. Section 12.1 explains what substantive contact means.

7. Security and technical data

7.1 We process technical information such as IP addresses, requested pages, access times, and sign-in or error events to deliver the site, keep the service available, prevent misuse, and diagnose problems.

7.2 We do not use this information for advertising or make decisions about people solely by automated means that have legal or similarly significant effects.

8. Cookies

8.1 We use necessary cookies to protect forms, remember a request confirmation, and keep signed-in users authenticated. We do not use analytics or advertising cookies.

8.2 The following cookies may be set, depending on which host you use:

8.3 The public site and the signed-in product each set their own csrftoken. The name is the same. The cookies are separate. The signed-in product also uses browser storage on your device for interface preferences, your recently selected workspace, and local draft information such as scratch notes. Visiting this notice does not itself set the cookies listed above. You can clear cookies and browser storage in your browser; doing so may affect forms, sign-in, and locally stored preferences or drafts.

9. Why we process this information

9.1 We rely on your consent to contact you about a Join private preview request. You may withdraw that consent at any time by writing to [email protected]. Withdrawal does not affect processing that took place before you withdrew.

9.2 Where you are the customer, we process account and preference information as necessary to perform our agreement with you. For users invited by an organization, we rely on legitimate interests in providing and administering the service requested by that organization. For personal data an organization places in its workspace, that organization determines its legal basis and we process the content on its behalf to provide the service.

9.3 We rely on legitimate interests, our reasons for keeping the service reliable and preventing misuse, for technical logs, rate limits, and security measures. You can object, as section 13 describes.

9.4 We rely on legitimate interests in answering support requests and fixing and improving the service. Where a request concerns our agreement with you as the customer, we also process the information necessary to perform that agreement.

10. Where information is stored

10.1 Primary application data, uploaded files, and our own database backups are stored in the EU. We use access controls and encrypted connections to protect the service. Deleted information may remain in backup copies until those copies expire under section 12.

11. Who else can see it

11.1 Authorized people operating Sauriq may access information where needed to administer the service and respond to requests. Other users in your organization may see directory, schedule and shared workspace information according to their access.

11.2 Service providers process data as needed for application hosting and backups, network delivery and protection, email, and error monitoring. We do not sell personal data or share it for advertising.

12. How long we keep it

12.1 We delete Join private preview requests 12 months after the last substantive contact about the request. Substantive contact means a real reply or conversation about that request. Submitting the request starts the 12 months. A later real exchange starts the 12 months again. You can withdraw consent to follow-up, or ask us to delete the request sooner, by writing to [email protected].

12.2 Authentication email links expire or become unusable when consumed or revoked. A daily cleanup removes expired, used, revoked or unsent token records once they are 30 days old.

12.3 We keep account and workspace information while the relevant account or workspace is active. Account deletion removes personal records and replaces profile details in retained organization records as section 13.3 describes. Files are queued for removal from storage when the deletion is processed. Backup copies expire under section 12.5.

12.4 Application access, error and authentication logs are kept through 100 daily rotations. Records needed to investigate a specific security incident or defend a claim may be kept for up to 12 months.

12.5 Information deleted from the live service may remain in backup copies for up to 35 days after deletion. We use backups for service recovery and re-apply account deletions when restoring them.

12.6 We delete support requests 12 months after the last substantive contact about them, as described in section 6.

12.7 A completed export of your data, as section 13.2 describes, can be downloaded for 7 days after it is ready. After expiry, it is unavailable for download and scheduled for removal from storage. Deleting your account also removes access to the export and queues its file for removal. Backup copies follow section 12.5.

13. Your requests

13.1 Depending on the circumstances, you can ask to access, correct, erase, or restrict processing of your personal data; object to processing based on legitimate interests; and receive or transfer data you provided where portability applies, meaning a copy of that data in a form that can be moved. You can withdraw consent to follow-up on a Join private preview request at any time without affecting prior processing.

13.2 You can prepare an account export under Settings → My account → Delete account in the product. Select Prepare export. When it is ready, you can download a zip file from that page; we also send an email notification. The export includes your profile, settings, memberships, time entries, comments, notebook pages and personal protocols. For a personal account, it also includes workspace records, canvases, plans and stored vault files. For an organization account, the export covers your own records rather than the organization's workspaces and files. Section 13.5 explains how to request other personal data.

13.3 You can also request account deletion on the same page. Before you confirm, the product shows what will be deleted and what will stay, and any steps needed before deletion can proceed. For a personal account, deletion removes the account and its workspaces, with files removed as section 12.3 describes. For an organization account, deletion disables sign-in, clears your profile name and email address, and removes settings, notebook pages, personal protocols and support requests from the product. Workspaces you own pass to another owner, or to an administrator selected by your organization. Shared contributions, including comments, shared content, protocol copies attached to shared work, and recorded time, remain with the organization, linked to a replacement account labelled "Deleted member". Notes on your time entries are removed. A sign-in identifier may be retained to prevent reuse of a deleted single sign-on login. Requests about personal information within shared contributions are handled under section 13.5. Deleting cannot be undone. If you are your organization's only owner, make someone else an owner first. If you are its only member, contact us about closing it.

13.4 After your organization deactivates your account, an owner or admin can carry out the deletion described in section 13.3. The organization retains an audit record of that action linked to the replacement account. The new audit record contains identifiers and status information rather than your former profile name or email address.

13.5 You can send any personal-data request, including a request about information outside the account export or deletion tools, to [email protected]. You may tell the person who invited you as well. We may need to verify your identity before disclosing account or workspace information, and we may need to coordinate with your organization about its workspace content. We respond without undue delay and normally within one month. If a request's complexity or number requires an extension permitted by law, we will explain the reason within that month.

13.6 You can lodge a complaint with a data protection supervisory authority, including the authority in the EU country where you live or work.

14. International transfers

14.1 Primary application hosting is in the EU. Providers that deliver and protect the service, handle email or monitor errors may process connection, correspondence and diagnostic data outside the European Economic Area, including in the United States. For transfers covered by an adequacy decision, we rely on that decision; otherwise we rely on the European Commission's Standard Contractual Clauses in our provider agreements. You can request information about the applicable safeguards or a copy of them at [email protected].

15. Children

15.1 Sauriq is for professional laboratory and research teams. It is not directed at children. We do not knowingly collect personal data from children on the public website or in the invite-only product. If you believe we have, write to [email protected].

16. Changes

16.1 We may update this notice when our practices change. The version date above identifies the current text. If a change affects what we collect, why we use it, or how long we keep it, we will post the updated notice before it takes effect and, where we have your email, write to you.