Privacy policy

1. Scope and contact

This policy covers the PeptAI marketing website, operated by the Molecule team, and inquiries sent through its contact form. The team is responsible for deciding how the information described here is used. For questions about this policy or a privacy request, contact Rafael at rafael@molecule.to or use our contact page.

This website introduces our research and potential collaborations. It does not provide user accounts, accept payments, connect wallets, or conduct clinical studies. This policy does not cover services you access on other websites, including those linked from this site.

2. Information we handle

• Inquiries and correspondence. Your name, email address, optional organization, message, and any information you choose to send in subsequent correspondence. The contact form also records your agreement to be contacted about your inquiry.
• Technical and security information. Our hosting and security providers process information such as your IP address, request time, requested URL, browser and device details, and request outcome to deliver the website, diagnose faults, and detect or limit abusive traffic.
• Email delivery information. Email providers process sender and recipient addresses, message content, delivery timestamps, and delivery or failure events to route our messages.
• Appearance preference. If you change the website theme, your browser stores that preference as described below.

Please keep inquiries to business and research information relevant to your request. Do not submit patient records, identifiable health or genetic information, passwords, or information you are not authorized to share. The form is not a channel for medical care or confidential clinical data.

3. Why we use information

We use inquiry details to receive your message, send a receipt, evaluate your request, and communicate with you about it. Submitting the form does not subscribe you to a newsletter or give permission for unrelated marketing.

Where data protection law requires a legal basis, we rely on your consent to handle and respond to a contact-form inquiry. You can withdraw that consent at any time by contacting us or replying to our email; this does not affect processing that was lawful before withdrawal. Name, email, message, and agreement to be contacted are required to submit the form; organization is optional. You can browse the site without submitting an inquiry.

We process technical information on the basis of our legitimate interests in operating a reliable website, preventing spam and attacks, and protecting visitors and our systems. Where necessary, we also process information to meet a legal obligation or to establish, exercise, or defend legal claims. These purposes are separate from your permission to receive an inquiry response.

4. Who receives information

Inquiry information is sent to the PeptAI team and handled by the people responding to your request. We use the following service providers:

• Vercel hosts and delivers this website and provides security controls, including request rate limiting.
• Mailgun, a Sinch service, delivers contact-form inquiries to our inbox and sends an acknowledgment to the email address you provide. Our Mailgun sending region is the EU. Open and click tracking are disabled for these messages.
• Email and communications providers process messages in our inbox and in yours so correspondence can be delivered, stored, and answered.

We may also disclose relevant information when legally required, to respond to a valid authority request, or to professional advisers where necessary to protect legal rights. We do not sell inquiry information or provide it to advertising networks. Links to ecosystem websites do not send those operators the contents of your contact form.

5. International processing

Hosting and email services use international infrastructure and support teams. Your information may therefore be processed outside your country, including in the United States. An EU email sending region does not mean that all related processing takes place only in the EU.

Our providers publish information about their data processing and international transfer arrangements in the Vercel data processing addendum and the Sinch data processing agreement. Contact us for information about the safeguards applicable to your information and how to obtain a copy, where applicable.

6. Cookies and browser storage

The website does not run advertising pixels or audience analytics. It uses browser local storage under the key peptai-dash-theme to remember an appearance preference you choose. That value stays on your device until you change it or clear this website’s browser data; it is not sent to us as a contact field and is not an advertising identifier. If there is no saved preference, the site uses your system appearance setting.

Hosting security controls may use strictly necessary cookies or browser signals to protect the site from abusive traffic. These are separate from advertising or audience measurement. You can manage stored site data in your browser settings; clearing it resets your appearance preference.

7. How long information is kept

We retain inquiry correspondence for the time needed to address the inquiry and relevant follow-up, taking into account whether a collaboration is ongoing, whether the record is still needed, and any applicable legal retention or claim requirements. A separate agreement and notice may apply if an inquiry becomes a project.

Technical security and delivery records are retained according to the provider’s service settings and the time needed to operate the service or investigate an incident. Information subject to a legal hold may need to be retained until that requirement ends. You can ask us about retention of your information or request deletion; we will explain any legal reason that prevents deletion.

8. Security

The website uses HTTPS, validates form submissions, limits request sizes, and uses hosting security controls to reduce abuse. The contact endpoint does not write the message contents or email credentials to application logs. Information is nevertheless processed by hosting and email providers as described above. No website or email system can guarantee absolute security.

9. Your rights and choices

Depending on the law that applies to you, you may have rights to access your information, correct it, request deletion, restrict its use, obtain a portable copy, or object to processing based on legitimate interests. Where we rely on consent, you may withdraw it. These rights have conditions and exceptions under applicable law.

To make a request, email rafael@molecule.to, use our contact page, or reply to our correspondence. Describe your request and the information it concerns. We may request information reasonably needed to verify your identity before disclosing or changing personal information. We will respond within the period required by applicable law.

You may also complain to a data protection authority, including an authority where you live or work or where a suspected infringement occurred. The European Data Protection Board lists EEA authorities; UK visitors can contact the Information Commissioner’s Office. You do not need to contact us first to exercise a right to complain.

We do not use your inquiry for automated decisions that produce legal or similarly significant effects. Automated security controls can reject or temporarily limit requests suspected of abuse.

10. Children

The website is intended for a professional and research audience and does not offer services directed to children. Please contact us if you believe a child has submitted personal information that should be removed.

11. Other websites

Links to BIO, Molecule, BIOS, X, research records, and other sites take you to services operated separately. Their operators have their own privacy notices and terms. Those notices govern information you give them and data they collect when you visit. Review them before using a linked service.

12. Changes to this policy

We will update this page when the website’s data practices change and show the date above. Where applicable law requires additional notice or consent for a new use of information, we will provide it. An update to this policy does not itself provide your consent.