Privacy Policy

1. Information We Collect

We collect only the information necessary to provide our services:

• Genetic Data Files (e.g., VCF, 23andMe, or AncestryDNA format) that you voluntarily upload
• Session UUID to track your analysis anonymously
• Email address (optional, if you choose to receive your results by email)
• Payment information is handled securely by third-party processors (e.g., Stripe); we do not store your credit card information

2. How We Use Your Information

We use your data solely to deliver the service you requested — to analyze your uploaded genetic file and provide a summary of potential genetic insights.

We do not:

• Sell your data
• Share your data for research or advertising
• Use your data for internal training or development purposes

3. Data Retention and Deletion

• All uploaded data and generated results are automatically deleted after 30 days.
• You may request early deletion by contacting us at legal@crimsoniris.com.
• Logs and metadata (e.g., session IDs) may be retained longer for operational or security purposes but do not contain identifiable genetic information.

4. Data Storage and Security

• Data is processed and stored using secure infrastructure provided by Amazon Web Services (AWS) and may be temporarily processed by ChatGPT (OpenAI) to generate explanations or insights.
• All data transfers are encrypted using HTTPS and stored in compliance with U.S. data security best practices.

5. International Data Transfers

Our infrastructure is based in the United States. By using our services, you understand that your data may be transferred to and processed in the U.S., regardless of your country of origin.

6. Cookies and Tracking

• We may use basic cookies or analytics tools (e.g., Google Analytics) to understand usage trends on our website. These do not track personal or genetic data.
• You may disable cookies in your browser settings.

7. Your Rights

Depending on your location, you may have the right to:

• Request access to the data you submitted
• Request deletion of your data before the 30-day window
• Withdraw consent at any time by ceasing use or contacting us

We do not require user accounts, so any access or deletion requests must be verified via your upload UUID or email (if provided).

8. Children's Privacy

Our services are intended only for users 18 years and older. We do not knowingly collect data from anyone under 18. If you believe a minor's data has been submitted, please contact us for immediate deletion.

9. Changes to This Policy

We may update this Privacy Policy as our services evolve. The latest version will always be posted on our website with a revised “Effective Date.”

10. Contact

For any questions about this Privacy Policy or your data, please contact: