Privacy Policy

CrimsonScan operates the Spectra platform, an AI-driven materials discovery service. We are committed to protecting the privacy and security of our users' data. This Privacy Policy applies to all users of the Service, including researchers, organization administrators, and any other individuals who access the platform. It covers data collected through the web application, computational services, and any associated APIs.

Account Information: When you create an account, we collect your name, email address, organization name, and role. Authentication is managed through Firebase Authentication (Google).

Usage and Query Data: We collect natural-language search queries, model selections, generation parameters, analysis requests, timestamps, and session metadata associated with your use of the Service.

Generated Content: Candidate crystal and molecular structures, computational analysis results (symmetry, DFT, phase stability, etc.), reports (scientific, economic, patent), and research notes produced through your use of the Service.

Payment Information: Billing details are processed by Stripe, our payment processor. CrimsonScan does not store full credit card numbers or payment account numbers. Stripe acts as the PCI-DSS compliant data controller for all payment card data.

Technical Data: We automatically collect IP addresses, browser type and version, device information, operating system, and access logs for security monitoring and service improvement.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process and fulfill computational jobs (generation, analysis, DFT calculations)
• Authenticate users and enforce organization-scoped access controls
• Process subscription payments and manage billing
• Improve the platform, models, and user experience (see Section 9, Pooled Research Data)
• Communicate service updates, maintenance windows, and policy changes
• Comply with legal obligations and respond to lawful requests
• Prevent fraud, abuse, and enforce our Terms of Service

Your data is stored on Google Cloud Platform (GCP) infrastructure. Structured data — including accounts, generated candidates, analyses, reports, and research notes — is stored in Cloud Firestore.

All data is scoped to your organization's workspace. Users in one organization cannot access data belonging to another organization. This isolation is enforced at the database query level and through security rules.

Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256 via GCP's default encryption. We maintain access controls, audit logging, and conduct regular security reviews to protect the integrity and confidentiality of your data.

We use the following third-party services to operate the platform:

• Firebase Authentication (Google) — user authentication and identity management
• Google Cloud Platform — infrastructure hosting, Cloud Firestore database, Cloud Run compute
• Stripe — payment processing and subscription management
• OpenAI API (via authenticated proxy) — powers LLM-based report generation, natural-language query interpretation, and analysis summaries
• Materials Project API — phase stability data, convex hull references, and known material lookups for comparison and validation
• Google Analytics (Google) for aggregate site-usage statistics such as page views, session counts, and approximate geographic region

Each subprocessor processes only the data necessary for its designated function. We do not sell your personal information or generated content to any third party.

Enterprise customers may connect their own cloud infrastructure for computational workloads through our Bring Your Own Compute (BYOC) program. When BYOC is active:

• Proprietary input data, generated structures, and DFT calculation artifacts are processed entirely on your infrastructure
• These data do not transit CrimsonScan-managed servers
• Only metadata necessary for job orchestration (job IDs, status codes, timestamps) passes through the Spectra platform
• You retain full control over data residency, retention, and deletion on your own infrastructure

We use essential cookies for authentication session management (Firebase Auth session tokens). These cookies are necessary for the Service to function and cannot be disabled.

We use Google Analytics to collect aggregate usage statistics such as page views, session counts, and approximate geographic region. This helps us understand how the Service is used and where to improve it. Google Analytics sets first-party cookies for this purpose. It does not access the content of your research data, generated structures, or reports. You can block these cookies through standard browser settings or extensions without affecting the Service.

We do not use advertising cookies or third-party tracking pixels.

We retain organizational data for the duration of the organization's active subscription. Upon organizational subscription termination — whether initiated by the organization or by CrimsonScan — the organization's admin has a 30-day window to export org-owned research data, consistent with Section 12 of our Terms of Service. Individual seats removed by an org admin lose access immediately; the underlying authentication account remains unless separately deleted on request.

After the 30-day export window, your data (including generated candidates, analyses, reports, and research notes) will be permanently deleted from our systems. Account information (name, email, organization) may be retained for an additional 90 days for legal compliance and fraud prevention purposes.

Anonymized, aggregated usage statistics (such as total jobs processed, model usage distribution) may be retained indefinitely for service improvement. These statistics cannot be used to identify individual users or organizations. Contributions to the pooled research dataset are governed by Section 9.

Some plans include participation in our pooled research dataset. Participation is stated on the plan's terms and agreed to at signup; for self-serve Researcher plans it is a standard plan feature, and Enterprise agreements may exclude pooling entirely.

What is contributed: When your organization participates, anonymized candidate structures generated on the platform, meaning compositions, crystal and molecular structure data, and associated computed properties, are added to a pooled research dataset. Contributions are stripped of account, organization, user, and project identifiers before entering the pool.

What is never pooled: Natural-language queries, research notes, reports, uploaded files, account information, and any data processed on customer infrastructure under BYOC (Section 6) are never added to the pooled dataset.

How it is used: The pooled dataset may be used to improve the Service, including model evaluation, ranking calibration, benchmarking, and the training of platform models. Pooled data is not sold to third parties.

Retention: Because pooled contributions contain no identifiers linking them to your organization, they are not deleted when your subscription ends. Your organization's own workspace copies of the same structures remain subject to the retention and deletion terms in Section 8.

CrimsonScan operates a business-to-business platform. Access to the Service is provisioned by your organization, which acts as the data controller for scientific and research data generated on the platform (candidates, analyses, reports, notes). CrimsonScan acts as a data processor for that content under a Data Processing Agreement with your organization. The only personal data CrimsonScan directly holds for individual users is your email address and authentication credentials.

You have the right to:

• Access your personal data and any org-owned content you are authorized to view through the platform
• Correct inaccurate personal data — contact your organization's admin to update your seat email, or contact us for authentication-related corrections
• Delete your seat by contacting your organization's admin, who can remove you from the org through the Admin Portal. For deletion of the underlying authentication account or unresolved requests, contact legal@crimsonscan.com
• Export org-owned research data — requests are handled by your organization's admin, who controls the data. CrimsonScan will assist the admin on request
• Object to processing of your data for purposes not directly related to providing the Service
• Restrict processing in certain circumstances as required by applicable law

Route individual requests through your organization's admin first. For unresolved issues or direct GDPR/CCPA escalations, contact legal@crimsonscan.com. We will respond within 30 days.

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Performance of a contract — processing necessary to provide the Service under our Terms of Service
• Legitimate interests — improving the Service, preventing fraud, ensuring security
• Consent — where specifically obtained for optional data processing activities

You have the right to lodge a complaint with your local data protection authority. For data transfers outside the EEA, we rely on Standard Contractual Clauses approved by the European Commission to ensure adequate protection of your personal data.

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Know what personal information is collected and how it is used
• Request deletion of personal information
• Opt out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising these rights

To submit a CCPA request, contact legal@crimsonscan.com with the subject line "CCPA Request."

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly. If you believe a child under 16 has provided us with personal data, please contact us at legal@crimsonscan.com.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-platform notification at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

For questions about this Privacy Policy or to exercise your data rights, contact us at legal@crimsonscan.com.