Last Updated: June 21, 2026

1. Introduction

1.1 Who We Are

Welcome to SciEval (accessible at www.sci-eval.com) ("we," "us," or "our"). We operate in Luxembourg, and this Privacy Policy explains how we collect, use, share, and protect your personal data when you use our scientific data analysis platform ("Services"). We are committed to safeguarding the privacy of our users and handling personal data in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation, or "GDPR") and applicable Luxembourg data protection legislation.

1.2 Scope

This Privacy Policy applies to all personal data we process through our website and application, including information you provide when you create an account, upload scientific or experimental data for analysis, define mathematical models, purchase subscriptions, or contact us. By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy.

2. Data We Collect

2.1 Account Data

When you register for an account, we collect and store:

  • First name and last name
  • Email address
  • Password (stored only in securely hashed form — we never store plaintext passwords)

2.2 User Preferences

We store settings you configure within the platform:

  • Task notification preferences (email notifications on/off)
  • Newsletter subscription preference (opt-in/opt-out)

2.3 Scientific and Experimental Data

When you use our analysis features, we process and store:

  • Measurement data that you upload or enter for curve fitting, function evaluation, and ODE (ordinary differential equation) solving
  • Mathematical function definitions including function names, expressions/formulas, parameter names, units, and descriptions
  • Fit models that combine functions for data fitting, including weighting and scaling configurations
  • ODE system definitions including equations, independent/dependent variables, initial conditions, and integration parameters
  • Data manipulation sequences (operation pipelines you create for data import and transformation)
  • Publication references (DOI, title, authors, date) that you associate with functions or models

2.4 Computation and Task Data

When you run analyses, we store:

  • Task metadata: task identifiers, names, status, creation time, start and end times, and duration
  • Task results (e.g., fitted parameters, evaluated function outputs) stored in our database backend with a configurable retention period
  • User-assigned task names and visibility preferences

2.5 Billing and Subscription Data

If you purchase a subscription, we store:

  • Stripe customer and subscription identifiers (linking your account to your Stripe payment profile)
  • Subscription details: product name, pricing information (amount, currency, billing interval), subscription status, and billing period dates
  • Whether a subscription was purchased by you or gifted to you by another user

Important: We do not store credit card numbers, bank account details, or other direct payment credentials. All payment processing is handled securely by Stripe, Inc. Stripe's privacy policy applies to data they collect directly. See Stripe's Privacy Policy.

2.6 Technical and Authentication Data

We use JSON Web Tokens (JWT) for authentication. These tokens are stored locally in your browser and are not tracked server-side beyond validation. We do not currently use analytics or advertising trackers.

2.7 User-Submitted Third-Party Personal Data

If you upload or submit data containing personal data of third parties (such as research participants, patients, employees, or other identifiable individuals) to our computation services, you act as an independent data controller for that data, and we act as a data processor on your behalf, processing it solely as necessary to deliver the requested computation.

In this capacity, you are solely responsible for:

  • Having a valid legal basis under applicable data protection law (including the GDPR) for processing and disclosing that personal data to our Service
  • Providing appropriate privacy notices to the affected individuals and obtaining any required consents
  • Complying with all applicable privacy, data protection, confidentiality, and professional obligations
  • Anonymizing or pseudonymizing personal data before submission wherever practicable

A formal Data Processing Agreement (DPA) in accordance with Art. 28 GDPR is available upon request. We strongly recommend avoiding submission of directly identifiable personal data where it is not strictly necessary for your scientific analysis. We assume no liability for your compliance with data protection laws in connection with data you submit to the Service.

2.8 Contact Form Data

When you send us a message through our contact form, we collect and store:

  • Your email address (required, so that we can reply to you)
  • Your name (optional)
  • The subject and message content you provide
  • Proof that you accepted this Privacy Policy when submitting (a consent flag and the timestamp at which consent was given)
  • If you are logged in when you submit, a link to your user account; if you are not, the message is stored without any account association

We use this information solely to receive, understand, and respond to your inquiry. Please do not include sensitive personal data, or personal data of third parties, in your message.

3. How We Use Your Data

3.1 Purposes and Legal Basis

We process your personal data based on one or more of the following legal bases under the GDPR:

  • Performance of a contract (Art. 6(1)(b) GDPR): Processing your account data, scientific data, and computation results is necessary to provide the Services you signed up for — including account management, function evaluation, curve fitting, ODE solving, data manipulation, and subscription management.
  • Consent (Art. 6(1)(a) GDPR): We rely on your explicit consent for optional processing such as sending you our newsletter. You may withdraw consent at any time via your account settings.
  • Legitimate interests (Art. 6(1)(f) GDPR): We may process data for our legitimate interests, including improving our Services, ensuring platform security, receiving and responding to messages you send us through our contact form, and sending transactional emails (e.g., task expiry reminders, account activation), provided these interests are not overridden by your rights and freedoms.
  • Legal obligation (Art. 6(1)(c) GDPR): We may process data to comply with applicable legal or regulatory requirements.

3.2 Specific Uses

  • Creating, managing, and authenticating your user account
  • Performing scientific computations you request (function evaluation, least-squares fitting, ODR fitting, ODE solving)
  • Storing and retrieving your function definitions, fit models, and data manipulation sequences
  • Processing subscription purchases via Stripe
  • Sending transactional emails: account activation, password reset, email change confirmation, task expiry reminders
  • Sending the newsletter (only if you have opted in)
  • Receiving and responding to messages you send us through our contact form

4. Cookies and Local Storage

Our website uses the following client-side storage mechanisms:

  • Authentication tokens (strictly necessary): JWT access tokens stored in your browser's local storage to keep you logged in. These are required for the Services to function.

We do not currently use analytics cookies, advertising cookies, or third-party tracking scripts. If this changes in the future, we will update this policy and implement a cookie consent mechanism in accordance with the ePrivacy Directive.

5. Data Retention

We apply the following retention practices:

  • Account data: Retained for as long as your account is active. When you delete your account, your personal data (name, email) is pseudonymized and archived temporarily to allow account restoration. The archived personal data is permanently deleted after the restoration period expires.
  • Scientific data (functions, models, ODE systems, data manipulation sequences): Retained for as long as your account is active and you choose to keep them. You may delete individual items at any time.
  • Publication-linked content: Items (such as functions, models, or ODE systems) that you have associated with a scientific publication are retained indefinitely as part of our shared scientific library, even after your account is deleted. Upon account deletion, these items are dissociated from your personal identity. See Section 8 and our Terms of Service for details.
  • Computation task results: Stored in our database with a per-user expiry policy. You receive an email reminder before task results are scheduled for deletion. You may mark specific results to be kept indefinitely.
  • Contact form messages: Messages you send us through the contact form, together with the email address and any name you provide, are retained for a limited period of 90 days from submission and are then automatically and permanently deleted. If your inquiry leads to an ongoing matter (for example a support case or a legal claim), we may retain the relevant correspondence for as long as necessary to handle that matter.
  • Billing records: Subscription records are retained as required by applicable tax and commercial law.

We reserve the right to delete or anonymize data once it is no longer needed for the purposes for which it was collected.

6. Data Sharing and Disclosure

We do not sell or rent your personal data. We share personal data with the following categories of third-party processors, each acting under a data processing agreement:

  • Hosting provider: Our application is hosted on Heroku (Salesforce, Inc.), deployed in the European Union region (EU). Your application data resides on servers physically located within the European Economic Area.
  • Database provider: We use a Heroku Postgres (PostgreSQL) database add-on, deployed in the same EU region as our application. Persistent personal data is stored within the EEA.
  • Message broker: We use the Heroku Key-Value Store (Redis) add-on, deployed in the same EU region. Task queue data (including any computation inputs) transits through Redis temporarily and remains within the EEA.
  • Payment processor: Stripe, Inc. processes all payments. When you purchase a subscription, Stripe receives your payment details directly — we only store Stripe-generated identifiers and subscription metadata.
  • Email delivery: Transactional emails (account activation, password reset, task reminders) and contact-form notifications sent to our team are delivered via our SMTP email provider.

We may also disclose personal data:

  • If required by law, regulation, or court order
  • In connection with a merger, acquisition, or sale of assets, in which case you will be notified

6.1 International Data Transfers

Our primary infrastructure — including our application server, PostgreSQL database, and Redis message broker — is deployed in Heroku's European Union region. Personal data stored and processed by these components remains within the European Economic Area (EEA) and is therefore not subject to third-country transfer restrictions under Chapter V of the GDPR.

The following processors involve transfers of data outside the EEA:

  • Heroku / Salesforce, Inc. (corporate entity, USA): Although your data is stored in the EU region, Heroku's parent company Salesforce, Inc. is headquartered in the United States and may have administrative access to infrastructure. Salesforce is certified under the EU-US Data Privacy Framework (DPF) and we rely on Standard Contractual Clauses (SCCs) as an additional safeguard.
  • Stripe, Inc. (USA): Payment processing involves transfer of billing data to Stripe in the United States. Stripe is certified under the EU-US Data Privacy Framework and we rely on SCCs as an additional safeguard.

You may request a copy of the applicable transfer safeguards by contacting us at the details in Section 12.

7. Security Measures

We implement the following technical and organizational measures to protect your data:

  • Passwords are stored using Django's hashing framework (PBKDF2 with SHA-256 by default) — we never store or have access to your plaintext password
  • Authentication via short-lived JWT tokens with HTTPS-only transmission
  • CSRF protection for all state-changing requests
  • CORS restrictions limiting cross-origin access
  • Email account verification required before account activation
  • Account deletion uses pseudonymization (replacing personal data with random identifiers) rather than immediate hard deletion, ensuring data integrity
  • Encryption of computation results at rest: Computation task results stored in our database (including any measurement data echoed back as part of a result) are encrypted at the application level using authenticated symmetric encryption (Fernet — AES-128 in CBC mode with an HMAC-SHA256 integrity check) under an application-held key. Results are decrypted only when you retrieve them through the Service, so they — and the database backups that contain them — remain encrypted at rest, in addition to any storage-level encryption provided by our hosting provider.
  • Upload size limits: Submitted data is subject to a size limit, enforced before the request body is read, to bound the amount of data we ingest and to protect the availability of the Service

However, no method of data transmission or storage is 100% secure. While computation task results are encrypted at rest at the application level as described above, the temporary message broker copy of your computation inputs (used to queue a task for processing, see Section 6) is protected by encryption in transit and by our EU-based hosting infrastructure rather than by separate application-level encryption. We continuously work to improve our security measures.

7.1 Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Luxembourg data protection authority (CNPD) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by Art. 33 GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by Art. 34 GDPR, unless an exemption under that article applies (e.g., the data was encrypted). We maintain an internal record of all data breaches in accordance with Art. 33(5) GDPR.

8. Account Deletion and Data Portability

When you request account deletion:

  • Your personal data (name, email) is immediately pseudonymized — it is replaced with anonymized values in our active database
  • Your original personal data is archived separately to allow you to restore your account within a limited time window
  • A restoration link is sent to your original email address. After the time window expires, the archived data is permanently deleted
  • Scientific data, task results, and subscription records linked to your account remain associated with the pseudonymized account and may be deleted upon request
  • Exception — publication-linked content: Items that you have associated with a scientific publication (e.g., functions, models, ODE systems) will remain in our database as part of the shared scientific library accessible to all users. These items are dissociated from your personal identity upon account deletion. This retention is based on our legitimate interest (Art. 6(1)(f) GDPR) in maintaining a useful scientific knowledge base, and on the license you grant in our Terms of Service. If you wish to prevent this, you have to ask us for removal of the publication-linked content.

To request a machine-readable export of your data (data portability), please contact us at the details below.

9. Children's Privacy

Our Services are intended for use by researchers, scientists, and professionals. They are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete such information promptly.

10. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15): Request a copy of the personal data we hold about you.
  • Right to rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
  • Right to erasure (Art. 17): Request deletion of your personal data, subject to legal retention requirements.
  • Right to restriction of processing (Art. 18): Request that we restrict processing of your data in certain circumstances.
  • Right to object (Art. 21): Object to processing based on legitimate interests, including for direct marketing.
  • Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
  • Right to withdraw consent (Art. 7(3)): Where processing is based on consent (e.g., newsletter), you may withdraw it at any time without affecting the lawfulness of prior processing.
  • Rights related to automated decision-making (Art. 22): We do not make any automated decisions that produce legal or similarly significant effects solely based on automated processing. Computation results generated by the Service are tools for your own analysis and are not used by us to make decisions about you.

To exercise any of these rights, contact us using the details in Section 12. We will respond within 30 days as required by law. We may need to verify your identity before processing your request.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or via a prominent notice on our website at least 30 days prior to the change becoming effective. The "Last Updated" date at the top of this page indicates when the policy was last revised. Continued use of the Services after the updated policy takes effect constitutes your acknowledgement of the changes.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your rights, or have a data protection concern, please contact us:

Email: [Your Contact Email]

Address: [Your Business Address, Luxembourg]

You also have the right to lodge a complaint with the Luxembourg national data protection authority: Commission nationale pour la protection des données (CNPD), or any other competent EU supervisory authority, if you believe your data protection rights have been infringed.

BY USING OUR SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY.