1. Who we are
This website, darkbiome.bio, is operated by DarkBiome LLC, a Delaware limited liability company based in Alameda, California. DarkBiome LLC decides how the personal information described here is used, which makes it the controller under European data-protection law.
For anything in this notice, including a request to see, correct or delete your information, write to [email protected]. We are a small company with no office outside the United States. We have not appointed a data protection officer, and we have not appointed a representative in the European Union, the United Kingdom, Japan or China, so that address is the way to reach us wherever you are. Sections 12 to 14 say more for visitors in those places.
2. What we collect and why
Inquiry forms. The contact form and the dataroom request on the licensing page ask for your name, organization, work email address, the topic or type of inquiry, and your message. The dataroom request also asks which candidate you are interested in and your intended field of use. We use these details to answer you and, if you ask for it, to start a confidentiality agreement and share data files. We do not use them for marketing lists.
How a form is sent. The forms are built to send through Formspree, a form-delivery service. Until that connection is switched on, a form transmits nothing: it opens a prefilled message in your own email application, and nothing reaches us unless you send that email. The form tells you on screen which of the two happened. Once the connection is on, Formspree receives the fields you filled in, together with the technical details that accompany any web request (such as your IP address and browser type), stores the submission and forwards it to us by email.
Spam check. Each form contains one hidden field that people do not see. If an automated program fills it in, the submission is discarded in your browser. It collects nothing from you.
Email. If you write to us directly, we receive your email address and whatever you include in the message. Our mailbox is hosted by Google Workspace. The addresses on this site ([email protected], [email protected], [email protected], [email protected] and [email protected]) are labels for what a message is about: they all deliver to that one mailbox, read by the same people.
Server logs. The site is hosted on Cloudflare Pages. As with any web host, Cloudflare processes the IP address, the page requested, the time, and the browser and referrer details of each request in order to deliver the site and keep it secure. Cloudflare delivers the site from data centers in many countries, so your request is normally answered from one near you. From those same requests Cloudflare produces the aggregate statistics described in section 3. We do not combine these logs with form submissions.
3. Analytics & Enterprise Network Intelligence
We do not load consumer tracking cookies, advertising trackers, or cross-site tracking scripts. To assess institutional licensing interest, our edge infrastructure and optional B2B intelligence tools (such as Factors.ai and Dealfront) evaluate network autonomous system numbers (ASNs) and corporate IP address ranges to identify visits originating from corporate and research networks (such as pharmaceutical, biotechnology, and industrial organizations), without tracking or profiling individual consumers.
Cloudflare, which hosts the site, produces aggregate statistics from the requests it already processes in order to serve the pages (section 2, server logs). They show us totals such as the number of requests, the amount of data served, a count of unique visitors, and the number of requests by country. We use them to monitor infrastructure performance and gauge institutional interest in our discovery programs.
4. What the site does not do
- It sets no consumer tracking cookies.
- It loads no advertising or social-media trackers, and we do not sell or profile individual personal data.
- It loads no fonts from a font service. The fonts are served directly from darkbiome.bio.
5. What is stored in your browser
Two items are kept in your browser's local storage so the site remembers a choice you made. They stay on your device and are not sent to us.
darkbiome_lang: the language you picked in the language menu.darkbiome_lang_notice_dismissed: that you closed the notice saying the technical pages are in English.darkbiome_factors_token: optional Factors.ai account token configuration.darkbiome_dealfront_id: optional Dealfront account identifier configuration.
Each is written only when you make that choice, and is used only to show the site the way you chose. Storage of that kind does not need consent under the EU and UK rules on device storage, so we do not ask for it. If you would rather not have them, do not use the language menu, or clear them as described below.
The site also installs a service worker, which keeps copies of pages and files you have loaded in your browser's cache so the site opens faster and can show pages you have already seen when you are offline. The cache holds site files only. You can remove all of this at any time by clearing site data for darkbiome.bio in your browser settings.
6. Requests to other companies' servers
3Dmol.js. The home page and candidate dossier pages include an interactive 3D structure viewer built on 3Dmol.js, which is loaded from 3dmol.org. Those pages open a connection to 3dmol.org when they load, and download the library when a viewer comes near the visible part of the page or when you press a viewer control. As a result 3dmol.org receives your IP address and browser details, as any web server does. No other page contacts it. The structure files themselves are served from darkbiome.bio.
Formspree. Once the forms are connected, submitting a form sends it to formspree.io. Nothing is sent to Formspree by simply viewing a page.
B2B Account Intelligence & Telemetry. To assess institutional licensing interest and measure traffic, the site connects to privacy-focused and corporate identification services without consumer cookies: Factors.ai (app.factors.ai, api.factors.ai), Dealfront (sc.lfeeder.com, tr.lfeeder.com), and Umami (cloud.umami.is, gateway.umami.is).
7. Legal bases
Where the EU or UK General Data Protection Regulation applies, we rely on Article 6(1) as follows.
- Steps before a contract, at your request (Article 6(1)(b)). Handling a request for an evaluation option, a license, a confidentiality agreement or dataroom access, where you would be a party to the agreement yourself.
- Legitimate interests (Article 6(1)(f)). Handling the same requests when you make them for an organization, which is the usual case; answering other inquiries; keeping a record of business correspondence; keeping the site available and secure; and reading the aggregate request statistics in section 3. You can object to this at any time.
We do not rely on consent under these laws: the site sets no cookies and loads no advertising trackers. We make no decisions about you by automated means.
8. Who processes it
- Cloudflare (Cloudflare, Inc., United States) hosts the site on Cloudflare Pages and delivers it through its network of data centers around the world, and produces the aggregate request statistics in section 3. It states that it handles visitors' request data as a processor, on its customers' instructions, and its data processing addendum forms part of the terms we use it under.
- Formspree (Formspree, Inc., United States) receives, stores and forwards form submissions, once that connection is switched on. Its servers are in the United States.
- Google (Google LLC, United States) hosts our email through Google Workspace and so stores the correspondence we receive.
- 3dmol.org delivers the viewer library described in section 6. It acts on its own account, not on our instructions.
- Factors.ai (Factors.ai, Inc., United States) provides B2B account identification and session attribution.
- Dealfront (Liidio Oy, Finland / Germany) provides corporate reverse-IP identification.
- Umami (Umami Software, Inc., United States) provides cookie-free aggregate traffic statistics.
We do not sell personal information and do not share it for advertising. Beyond the providers above, we disclose it only to professional advisers who need it, or where the law requires.
9. How long we keep it
- Inquiries that go no further. We keep the correspondence for 24 months after the last message in the conversation, then delete it from our mailbox and from our Formspree account. Two years covers the time a licensing discussion can take to resume; we review the mailbox once a year.
- Inquiries that lead to a signed agreement. The correspondence is kept with the records of that confidentiality, evaluation or license agreement for as long as the agreement runs, and afterwards for as long as a claim under it could still be brought.
- Spam. Deleted when we see it.
- Request statistics. The aggregate figures in section 3 are held by Cloudflare for the period its plan provides. They contain no names or contact details.
- Hosting logs. Held by Cloudflare under its own retention schedule, which we do not control.
We delete inquiry correspondence sooner if you ask, unless we need it for an agreement or a legal claim. Items stored in your browser stay there until you clear them.
10. International transfers
DarkBiome LLC is in the United States. If you fill in a form or write to us from another country, you are sending your details directly to a US company, and they are stored and used in the United States. US data-protection law differs from that of the European Economic Area, the United Kingdom and Switzerland. The European Commission and the UK government treat the United States as offering adequate protection only for organizations that have joined the EU-U.S. Data Privacy Framework. DarkBiome LLC has not joined it.
The providers in section 8 that handle your details for us are also in the United States. Each publishes the safeguard it offers for personal data from the EEA, the UK and Switzerland:
- Cloudflare states that it is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. framework. Its data processing addendum also includes the European Commission's standard contractual clauses and the UK addendum to them, which apply if that certification lapses. Because Cloudflare answers requests from data centers worldwide, your request may be handled in the country you are in, in the United States, or in another country where Cloudflare operates.
- Google states the same certifications, and its Cloud Data Processing Addendum includes the standard contractual clauses.
- Formspree states that it relies on the standard contractual clauses.
You can ask us for a copy of the terms we have with any of them.
11. Your rights
You can ask us for a copy of the personal information we hold about you, ask us to correct or delete it, ask us to restrict how we use it, object to our use of it, and, where that right applies, receive it in a portable format. Where the EU or UK GDPR applies you also have the right to complain to the data-protection supervisory authority where you live or work; in the United Kingdom that is the Information Commissioner's Office.
California residents. The California Consumer Privacy Act applies to businesses above set revenue or data-volume thresholds. DarkBiome LLC is below them, so the Act does not currently apply to us. We honor the same requests anyway: you may ask what we hold about you and ask us to correct or delete it, and we will not treat you differently for asking. We do not sell personal information, do not share it for cross-context behavioral advertising, and are not a data broker, so there is no sale or sharing to opt out of.
To use any of these rights, write to the address in section 1. We answer within 30 days.
12. Visitors in the European Economic Area and the United Kingdom
This site is written in English, with menus and headings also available in Japanese. People at companies in the EEA and the UK can contact us through it. We treat the EU General Data Protection Regulation and the UK GDPR as applying to the personal information of people in the EEA and the UK who contact us. Sections 7, 10 and 11 are written on that footing.
Representative. Both laws ask some companies outside Europe to appoint a local representative. There is an exception for processing that is occasional, involves no sensitive categories of data on a large scale, and is unlikely to put anyone at risk. What we handle is small and low-risk: a few business inquiries a month, containing work contact details and nothing sensitive. Whether an inquiry form that is always available counts as occasional is not settled, and we do not claim the exception with certainty. We have not appointed a representative in the EU or the UK. We keep this under review, and if we appoint one, its name and contact details will appear here. Until then, write to us directly at the address in section 1.
Complaints. You can complain to the data-protection authority where you live or work at any time. You do not need to contact us first, and the fact that we have no representative does not affect that right.
13. Visitors in Japan
We offer licenses to companies in Japan, and the menus and headings of this site are available in Japanese. For that reason we treat Japan's Act on the Protection of Personal Information as applying to the personal information of people in Japan who contact us.
- Purpose of use. We use your details only for the purposes in section 2: to answer your inquiry and, if you ask, to arrange a confidentiality agreement, an evaluation or a license.
- Where they are handled. Your details are sent to and kept in the United States, by us and by the providers in section 8 that store them for us. The United States has no single national privacy law comparable to the Act, and it is not among the places that Japan's Personal Information Protection Commission has designated as offering equivalent protection.
- Sharing. Apart from those providers, we do not give your details to anyone else without your consent, unless the law requires it.
- Security. Access to inquiries is limited to DarkBiome's owner.
- Your requests. You can ask us to disclose, correct, stop using or delete your details by writing to the address in section 1. There is no fee.
We have no office or representative in Japan. This notice is available in English only.
14. Visitors in mainland China
We offer licenses to companies, not goods or services to individuals. This site is not available in Chinese. Whether China's Personal Information Protection Law applies to a foreign company in that position is not settled. We have not established an entity or appointed a representative in mainland China, and we do not use servers there. If you contact us from mainland China, this is what happens.
- Who receives your details, and where. You send them directly to DarkBiome LLC in the United States, through the form provider in section 8 or by email. They are stored and used in the United States for the purposes in section 2 and kept for the periods in section 9.
- Consent. We handle them on the basis of your consent, which you give by choosing to send the inquiry. You can withdraw it at any time by writing to the address in section 1. We will then delete your details unless we need them for an agreement or a legal claim.
- What to send. Please send business contact details only. Do not send identity document numbers or other sensitive personal information. We do not need it.
- Your requests. You can ask us for a copy of your details, or ask us to correct or delete them, at the same address.
This notice is available in English only.
15. Children
This site is written for businesses and researchers. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.
16. Changes to this notice
If what the site does changes, we will update this page and the effective date above.