Privacy policy

Last updated: October 22, 2026

This Privacy Policy explains how Amiravo ("Amiravo," "we," "us") collects, uses, shares, and protects personal information when you use amiravo.com and related services (the "Site"). It is written to meet the California Consumer Privacy Act as amended by the CPRA ("CCPA"), the Virginia, Colorado, Connecticut, and Utah consumer privacy laws, and, for visitors in the European Economic Area, United Kingdom, and Switzerland, the GDPR and UK GDPR. Capitalized terms not defined here have the meaning in our Terms of Use.

1. Who we are and how to reach us

The controller (or "business") responsible for your personal information is Amiravo, which you can reach through our contact form. We have not appointed a Data Protection Officer; privacy questions go through our contact form.

2. Information we collect

2.1. Information you provide. (a) Account data: email address (required), name (optional), password hash, account settings. (b) Lab Notebook content: vial records (compound identifier, stated mass, lot or batch identifier), preparations (diluent volume, computed concentration), entries (date, amount withdrawn, free-text notes), and any other information you choose to type into the notebook. You control what you enter. Notebook content may be sensitive to you. Do not enter information about other people, health information about yourself, or anything you would not want stored on a third-party server. (c) Email list: email address and subscription preferences when you subscribe to library updates. (d) Saved calculator inputs: if you choose to save calculator inputs or results to your account, the numbers and labels you enter. (e) Communications: messages, error reports, and support requests you send us, with any attachments. (g) COA checker uploads: certificate-of-analysis files you upload, the fields read from them and the grade, kept private to your account until you delete them. Do not upload documents containing personal information. (f) Referral hand-offs: when you are signed in and follow a link to our research partner's checkout, the items and time of that hand-off, so we can show it in My Research and email you a research checklist. We do not receive your payment details or confirmation of what you bought.

2.2. Information collected automatically. (a) Device and log data: IP address, browser type and version, operating system, device identifiers, language, referring URL, pages viewed, timestamps, and interactions with the Site. (b) Cookies and similar technologies: see the Cookie Notice in Section 14. (c) Analytics: aggregated and event-level usage data collected by our analytics provider (Base44 analytics), configured, where the tool permits, to truncate IP addresses and not to use data for the provider's own advertising. (d) Security data: data collected by Cloudflare to detect bots, abuse, and attacks.

2.3. Information from third parties. We do not purchase personal information. If you sign in through a third-party identity provider (such as Google), we receive the identifiers that provider shares according to your settings.

2.4. Sensitive information. We do not ask for and do not want government identifiers, financial account numbers, precise geolocation, biometric data, or health information. We do not infer health conditions from notebook content. If notebook content could be considered sensitive under applicable law, we process it only to provide the notebook to you, which is a permitted purpose that does not require additional consent under the CCPA, and under the GDPR we rely on your explicit consent given when you activate the notebook, which you may withdraw by deleting the content or your account.

3. How we use information and our legal bases

Purpose	Data	Legal basis (GDPR/UK GDPR)
Provide the Site, accounts, calculators, and Lab Notebook	Account data, notebook content, saved inputs, device data	Performance of a contract (Terms of Use); explicit consent for notebook content where it is sensitive
Send library-update emails you subscribed to	Email address, preferences	Consent (withdraw at any time via unsubscribe link)
Send service messages (security alerts, changes to terms, account notices)	Account data	Contract; legitimate interest in operating the Site
Respond to support and error reports	Communications	Legitimate interest; contract
Secure the Site, prevent abuse, fraud, and attacks	Device/log data, security data	Legitimate interest in security; legal obligation
Understand aggregate usage and improve content	Analytics data	Legitimate interest (with privacy-protective configuration); consent where local law requires for non-essential cookies
Comply with law, enforce the Terms, establish or defend legal claims	Any	Legal obligation; legitimate interest
Business transfers	Any	Legitimate interest

We do not use personal information to make decisions producing legal or similarly significant effects. We do not use notebook content for marketing, profiling, or to train machine-learning models.

4. How we share information

4.1. Service providers (processors). We share information with vendors who process it on our behalf under contracts that limit their use to our instructions: Base44 (application hosting, database, authentication; United States); Cloudflare (DNS, CDN, security, and edge services; United States with global edge network); Base44 (transactional and newsletter email, and usage analytics). We use no payment processor because the Site sells nothing. A current list of processors is available on request.

4.2. Legal and safety. We may disclose information if we believe in good faith that disclosure is required by law, subpoena, court order, or governmental request; is necessary to enforce our Terms; or is necessary to protect the rights, property, or safety of Amiravo, our users, or the public. Where lawful and practicable we will notify you of a legal demand for your notebook content before complying.

4.3. Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

4.4. With your direction. We share information when you ask us to, for example by exporting your notebook.

4.5. Aggregated or de-identified data. We may use and share data that cannot reasonably be linked to you, and we commit not to re-identify it.

5. No sale; no sharing for cross-context behavioral advertising; no targeted advertising

We do not sell personal information and have not done so in the preceding 12 months. We do not "share" personal information for cross-context behavioral advertising as defined by the CCPA, do not process personal information for targeted advertising as defined by the Virginia, Colorado, Connecticut, or Utah laws, and do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. We do not knowingly sell or share the personal information of anyone under 16. Because we do not sell or share, we do not offer a "Do Not Sell or Share" link; if that changes, we will add one and update this Policy first.

6. Retention

We keep personal information only as long as needed for the purposes above, then delete or de-identify it. Specific periods appear in the Retention Table in Section 15. Backups are overwritten on a rolling 30-day cycle; deleted data may persist in encrypted backups until that cycle completes.

7. Security and its limits

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including encryption in transit (TLS) and at rest as provided by our hosting provider, access controls, authentication, logging, and vendor due diligence. Notebook content is stored in our hosting provider's database and is accessible to a limited number of our personnel for support, security, and legal purposes only.

No system is perfectly secure. We cannot guarantee that unauthorized access, loss, or disclosure will never occur. You are responsible for choosing a strong, unique password, for keeping it confidential, and for deciding what to enter into the notebook. If you would not want a record to be read by someone else, do not store it here.

8. Your rights and choices

8.1. Everyone. You may: unsubscribe from marketing emails using the link in any email; access, update, export, and delete your account data and notebook content through your account settings; and contact us through our contact form with any request.

8.2. California residents (CCPA). You have the right to know what personal information we collect, use, disclose, and the categories of sources and recipients; to access that information in a portable format; to correct inaccurate information; to delete your information, subject to exceptions; to limit use of sensitive personal information (we already limit it to providing the service); to opt out of sale or sharing (we do none); and not to be discriminated against for exercising your rights. Categories we collect, as defined in Cal. Civ. Code § 1798.140: identifiers; customer records information (email, name); internet or network activity; geolocation (coarse, from IP); and, to the extent notebook content qualifies, sensitive personal information. We disclose these to the service providers listed in Section 4.1 for business purposes only. You may designate an authorized agent to make requests; we will verify the agent's authority and your identity.

8.3. Virginia, Colorado, Connecticut, and Utah residents. You have the right to confirm whether we process your personal data, to access it, to correct it (VA, CO, CT), to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, and profiling (we do none). If we deny a request, residents of Virginia, Colorado, and Connecticut may appeal by replying to our decision email with "Appeal" in the subject line; we will respond within the period required by law, and if we deny the appeal we will tell you how to contact your state Attorney General.

8.4. EEA, UK, and Switzerland (GDPR / UK GDPR). You have the rights of access, rectification, erasure, restriction, data portability, and objection (including to processing based on legitimate interests), and the right to withdraw consent at any time without affecting prior processing. You may lodge a complaint with your supervisory authority; a list is at edpb.europa.eu, and the UK authority is the ICO (ico.org.uk). Providing account data is necessary to open an account; you are not required to use the notebook or subscribe to emails.

8.5. Other U.S. states. Residents of other states with comprehensive privacy laws (including Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island) have substantially similar rights, which we honor through the same process.

8.6. How to exercise rights and verification. Use our contact form (topic “Privacy request”) or use the controls in your account. We will verify your identity by confirming control of the email on file and, for sensitive requests, by asking for additional information that we will use only for verification. We respond within 45 days (extendable once by 45 days with notice), or within one month under the GDPR (extendable by two months). Requests are free unless manifestly unfounded or excessive. We will keep a record of requests as required by law.

9. Do Not Track and Global Privacy Control

We do not sell or share personal information, so there is nothing to opt out of with a universal signal. We nonetheless treat a Global Privacy Control (GPC) signal as a valid opt-out request for the browser or device that sends it, and we will configure any analytics or future advertising technology to honor it. We do not respond to legacy "Do Not Track" headers because there is no accepted standard, but GPC achieves the same result on our Site.

10. Children

The Site is for adults engaged in research. We do not direct the Site to anyone under 18, and we do not knowingly collect personal information from anyone under 18 (or under 13 for purposes of COPPA). If you believe a person under 18 has provided information to us, contact us through our contact form and we will delete it promptly.

11. International transfers

We are located in the United States and our processors are located or operate in the United States. If you access the Site from outside the United States, your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those of your jurisdiction. For transfers from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or, where a processor is certified, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You may request a copy of the relevant safeguards through our contact form.

12. Data breach notification

If we discover a breach of security involving your personal information, we will investigate, contain it, and notify you and relevant regulators as required by applicable law, including Utah Code § 13-44-202 and, where applicable, Articles 33 and 34 of the GDPR, within the required timeframes. Notification will be by email to the address on file or by notice on the Site, and will describe what happened, what data was involved, what we are doing, and what you can do.

13. Changes to this Policy

We may update this Policy. We will post the revised Policy with a new "Last updated" date and, for material changes, notify account holders by email or site notice before the change takes effect. We will not use previously collected information for materially different purposes without obtaining any consent required by law.

14. Cookie Notice

We use a small number of cookies and similar technologies.

Strictly necessary. Session and authentication cookies set by our hosting platform (Base44) to keep you signed in and to protect forms; security cookies set by Cloudflare to distinguish humans from bots. These cannot be disabled without breaking the Site and do not require consent.

Preferences. A cookie or local-storage entry recording that you have acknowledged the entry notice, your theme, and similar settings. Lifetime: 12 months.

Analytics. Base44 analytics cookies or identifiers to measure page views and usage in aggregate. We configure analytics to minimize identifiers and not to share data with the provider for advertising. Where local law requires consent for analytics cookies (for example, EEA/UK), we will not set them until you consent through our cookie banner, and you may withdraw consent at any time through your browser’s cookie and site-data settings.

Advertising. None. We do not use advertising cookies, pixels, or tracking for targeted advertising.

Controlling cookies. You can delete or block cookies through your browser settings. Blocking strictly necessary cookies will prevent sign-in.

15. Data Retention Table

Data category	Retention period	Trigger for deletion
Account data (email, name, settings)	Life of the account plus 30 days	Account deletion by you or by us
Lab Notebook content	Life of the account, or until you delete the record, plus 30 days in backups	Record or account deletion
Saved calculator inputs	Life of the account or until deleted	Deletion by you
Email list subscription	Until you unsubscribe, plus a suppression record of the address to honor the unsubscribe	Unsubscribe
Support and error-report communications	24 months after last contact	Automatic
Server and security logs (IP, request data)	30 days (Cloudflare and hosting defaults; may be shorter)	Automatic rotation
Analytics data	14 months in identifiable form, then aggregated	Automatic
Privacy-request records	24 months (CCPA requirement)	Automatic
Legal hold or dispute records	Until the matter concludes plus the applicable limitations period	Matter closed
Backups	Rolling 30-day overwrite	Automatic

16. Contact

Amiravo, Attn: Privacy, through our contact form.

---