Legal
Privacy Policy
Ampliova is designed for scientific work. We collect only what is strictly necessary to operate the service and never share or monetise your data.
Data controller
Who is responsible for your data
Louis Müller, micro-entrepreneur (France)
Address: 21 Avenue Pauline, 94000 Créteil, France
SIRET: 108 830 514 00015
Code APE/NAF: 63.11Z – Traitement de données, hébergement et activités connexes
TVA: Non applicable (article 293 B du CGI)
Contact: contact@ampliova.com
Data collected
What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address + password | Authentication (Supabase Auth, EU West, Ireland) | Contract performance |
| Display name | Account personalisation (optional) | Legitimate interest |
| Uploaded RDML files | qPCR analysis. Stored temporarily on Supabase Storage (EU). Never shared with third parties. Never used to train AI models. The sample and gene names they contain are sent to Mistral AI for plate layout suggestions, unless those are turned off (see sub-processors below). | Contract performance |
| Analysis data (Cq values, results, parameters) | Stored in Supabase EU database to allow later review and export. | Contract performance |
| Beta waitlist email | Beta access contact only. No marketing without explicit consent. | Consent |
| Primer database search queries | Logged with your account ID (if signed in) to surface genes researchers search for but can't find, so we know what to add next. Never used for advertising or shared with third parties. | Legitimate interest |
| Primer database contributions | Primer pairs and efficiency measurements you submit are linked to your account for attribution and curation history. Entries marked public are visible to all Ampliova users as part of the shared primer database. | Contract performance / consent |
| Billing details | Managing your subscription. When you subscribe, your profile stores your Stripe customer ID, your subscription ID, your plan, the end date of the current billing period and whether the subscription is set to end. A Lab plan's record also holds its number of paid seats. You enter your card on Stripe's checkout page and it stays with Stripe: Ampliova never receives or stores card details. Ampliova sends Stripe your email address and account ID so the payment is linked to your account. | Contract performance |
Infrastructure
Hosting and subprocessors
| Provider | Role | Data residency |
|---|---|---|
| Supabase | Database + file storage | EU West (Ireland), GDPR compliant |
| Vercel | Frontend hosting | EU, GDPR compliant |
| Vercel Analytics | Aggregate page-view counts | Cookieless: no cookies or persistent identifiers are set, no individual visitor is tracked. Only aggregate, anonymized page-view statistics are collected. |
| Railway | Python analysis engine (EU, Netherlands) | Computation data transmitted transiently; not persisted on Railway. |
| Mistral AI | Plate layout suggestions (Mistral Small) | Only scientific data (the sample and gene names of the uploaded plate) is transmitted, no personal data. Data processed transiently and not retained per Mistral AI's API data policy. EU-based company (Paris). Available on every plan, including the free one. Each user can turn it off in Settings, and a lab's owners and admins can turn it off for all its members; when it is off, nothing is sent to Mistral AI. |
| Resend | Transactional email delivery (team invitations, beta access notifications) | Recipient email address transmitted for delivery only. No marketing emails sent without explicit consent. GDPR compliant. |
| Stripe | Payment processing, and seller of record for card subscriptions | Stripe sells card subscriptions as seller of record and collects the billing details it needs to sell and tax them, under its own privacy policy. Card data goes directly to Stripe under PCI-DSS and never transits Ampliova's servers. |
Security
How your data is protected
- In transit: all connections to Ampliova are encrypted (TLS).
- At rest: the underlying database and file storage are encrypted at rest by Supabase (AES-256, EU infrastructure).
- Batch names and notes(the free-text labels and comments you write yourself) are additionally encrypted at the application level (AES-256-GCM) before being stored. The decryption key is held only in Ampliova's server infrastructure; it is never stored in the database and never sent to your browser.
- Access between accounts: row-level access control ensures a batch (including sample and group labels, gene names, Cq values, and computed results) is only ever visible to its owner and, where explicitly shared, their team or organisation, never to other Ampliova customers.
- Who can access your data: database access is limited to what is needed to operate and support the service (e.g. diagnosing a reported bug) and is never used to browse, share, or analyse your research data for any other purpose.
Retention
How long we keep your data
- Account data: retained until you delete your account.
- Billing records: the Stripe IDs, plan and period end stored on your profile are deleted with your account. Deleting your account also cancels any active subscription at once, and the time left on it is not refunded. Stripe keeps the invoices and payment records: it issues them as seller of record and must keep them as long as accounting and tax law require. Deleting your Ampliova account does not erase them. If you pay Ampliova directly by purchase order or bank transfer, Ampliova issues the invoice and keeps it for 10 years, as French accounting law requires (article L123-22 of the Commercial Code).
- Uploaded plate files (RDML, or QIAGEN GeneGlobe CSV/XLS exports): stored in Supabase EU storage for the lifetime of the batch, to allow re-analysis. Deleted when the batch is deleted or upon account deletion.
- Beta waitlist emails: deleted on request.
Cookies
Cookies and tracking
Ampliova sets exactly three cookies, all strictly necessary for authentication. No advertising or tracking cookies are used. Page-view statistics are collected through Vercel Analytics, which is cookieless: it sets no cookie and assigns no identifier to your browser or device.
| Cookie name | Purpose | Duration | Necessary |
|---|---|---|---|
sb-[ref]-auth-token | Stores the authenticated session (JWT access token + refresh token). Set by Supabase Auth when a user signs in. Read on the server on every request to verify authentication. | 400 days | ✓ Strictly necessary |
sb-[ref]-auth-token-code-verifier | PKCE (Proof Key for Code Exchange) verifier. Created at the start of an OAuth2 / magic-link / invite flow and deleted immediately after the code is exchanged for a session. Prevents authorisation-code interception attacks. | Transient (seconds) | ✓ Strictly necessary |
ampliova-active | Records that you were active within the last hour. Ampliova renews it while you work, and your browser deletes it after an hour without activity. The next page you open then signs you out, so a session left open on a shared computer does not stay signed in. It holds only the value 1. | 1 hour, renewed while you are active | ✓ Strictly necessary |
The two sb- cookies are set by Supabase Auth, hosted in the EU (Ireland). ampliova-active is set by Ampliova itself. None of the three contains personal information beyond the authenticated session token, and none is ever transmitted to advertising networks or analytics platforms.
No consent banner is required. Under Article 5(3) of the ePrivacy Directive and the CNIL guidelines on cookies, strictly necessary cookies (those without which a service explicitly requested by the user cannot function) are exempt from the prior-consent requirement. All three cookies above fall squarely within this exemption. Vercel Analytics falls outside the scope of these cookie rules entirely, since it stores nothing on your device.
Your rights
GDPR rights (Art. 15–22)
You have the right to access, rectify, erase, port, and object to the processing of your personal data.
- How to exercise your rights: contact@ampliova.com
- Response time: 30 days.
- Supervisory authority: You may lodge a complaint with the CNIL at www.cnil.fr.
Changes
Policy updates
In the event of a material change, registered users will be notified by email at least 14 days before the change takes effect.
Effective date: 1 June 2026 · Last updated: 5 October 2026 (payment data now lists what Ampliova stores since Stripe went live, and billing records have a retention line)