Privacy Policy
Last updated: 2026-11-04
In plain words
- We do not keep your file or your reports. The file is held while a report is built and then deleted; the report data is deleted when you log out or after about six hours of inactivity.
- What we keep is an irreversible cryptographic hash derived from your file so you can come back, and with it your paid status, your encrypted favorites, your payment reference in a form we cannot read back, and the acknowledgements you gave. What we keep lists it in full.
- No account, no email, no password. You upload the same file again to return.
- No analytics, no advertising, no sale or sharing of data. Amazon Web Services in Frankfurt hosts the service and processes your genetic data. The payment processor Creem handles payments only and never receives your genetic data or your reports.
- No user data goes to any AI service. The question-and-answer feature that did so (using zero data retention endpoints) has been discontinued as an extra precaution against any fraudulent model providers.
- You can delete everything we keep about you with Delete my record, at any time, in one click.
Who we are
The data controller is GTCA23 SRL, a private limited company registered in Romania (EUID ROONRC.J2026032062007), registered office Str. Constantin C. Nottara 5, Vladiceasca, Ilfov 077168, Romania. Data protection contact: contact@codegen.eu. General contact: contact@codegen.eu. See also the Imprint.
What we process and do not keep
Your raw data file. When you upload it, the application reads it in memory, checks its format, computes the irreversible cryptographic hash described below and hands the file to a background job that builds your report. For that hand-over the file is written to private object storage in Frankfurt, encrypted at rest, and the job deletes it as soon as it has finished. A sweeper runs every hour and removes any such object older than one hour, so a job that fails cannot leave a file behind.
Your report data. The job stores, in our database, which catalog entries your file matched, together with your sex as derived from the file and your working favorites. This is the data that renders your pages. It is deleted when you log out, when a sweeper finds the session idle for about six hours, or when you delete your record.
What never leaves the application. We checked each of the places where a file or report could leak and this is what the code does:
- Application logs pass through a redacting formatter and record event codes, never file contents, genotypes or report text.
- We run no error-tracking or analytics service and no third-party scripts. Every byte of the site is served by us.
- Pages that contain your report are served with private cache headers and are not cached by the content delivery network; only static assets such as stylesheets are.
- Nothing you upload or read is sent to an AI service. The catalog entries are prepared in advance from published literature, without any user data.
What we keep
| What | Why | How long |
|---|---|---|
| An irreversible cryptographic hash derived from your file (a keyed HMAC-SHA-256 over a small, medically uninformative subset of positions; see the Annex) | So that the same file, uploaded again, finds your paid status and favorites | Up to 10 years from its creation, or until you delete your record |
| Your paid status (free or unlocked) and the key material that lets you decrypt your favorites | To honour what you paid for and keep favorites readable only to you | Same as the identifier |
| Your favorites, encrypted so that only a re-upload of your file can decrypt them (not kept at all for Genes for Good and WeGene files) | So that starred entries come back | Until you clear them at exit or delete your record |
| The acknowledgements you gave at upload: which statements you ticked, the revision of the wording you saw, the Terms and Privacy dates and a timestamp | To show that consent and the other acknowledgements were given (GDPR Article 7(1)) | Same as the identifier |
| Purchase record: a keyed digest of the processor's payment reference (not the reference itself), the status of the purchase, and the acknowledgements you gave at upload and at payment | To process refunds and revocations and to show that the acknowledgements were given | As required by Romanian accounting law, up to 10 years, or until you delete your record |
| Comments you post | Community contributions | Kept anonymously, with no link to any identifier, and not removed when you delete your record |
| Session and CSRF cookies | To keep you logged in and to block cross-site request forgery | About six hours of inactivity |
| Service logs (event codes, no personal data by design) | Operations and security | Rotated by size on AWS CloudWatch, Frankfurt |
The irreversible cryptographic hash is personal data under a strict GDPR interpretation (it may be functionally anonymous because identity or genetic data cannot be derived from a keyed HMAC-SHA-256 alone). The payment itself (name, card, address, VAT country) is held by the payment processor, not by us.
Acknowledgements. The statements you tick at upload are stored with your irreversible cryptographic hash, whether or not you ever pay, and are replaced each time you upload again. They hold no genetic data and no report content. Deleting your record removes them.
Legal basis
- Your genetic data is a special category of personal data (GDPR Article 9). We process it only on the basis of your explicit consent (Article 9(2)(a)), which you give by ticking the separate consent box at upload. You can withdraw it at any time by deleting your record; withdrawal does not affect processing that already took place.
- The irreversible cryptographic hash, your paid status and the purchase record are processed because they are necessary to perform the contract you enter with us (Article 6(1)(b)) and, for the purchase record, to meet our legal obligations in accounting and consumer law (Article 6(1)(c)).
- Session cookies are strictly necessary for the service and rely on Article 6(1)(b).
We do not process your data for advertising, profiling, research, training of models or any other purpose, and we do not make decisions about you by automated means within the meaning of Article 22.
Processors and transfers
| Processor | Role | Region |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, compute, object storage, database and logs | Frankfurt (eu-central-1), in the EEA |
| Amazon CloudFront (AWS) | Content delivery in front of the site. The edge location closest to you terminates the encrypted connection and forwards each request to Frankfurt without storing your file or report | Edge locations in Europe and North America |
| Creem, operated by Armitage Labs OÜ (Estonia, registry code 16977866) | Merchant of record for payments: card processing, VAT, receipts | Estonia, in the EEA |
We have a data processing agreement with AWS and the Creem terms include processor commitments. There is no AI service, analytics service, email service, CRM or advertising network.
Transfers outside the EEA. Your file and your report data are processed and stored in Frankfurt and payment data in Estonia. If you connect from outside Europe, your request transits the CloudFront edge location nearest to you, which may be in North America, before reaching Frankfurt; the edge does not store the content.
Relatives and children
Your file also describes your biological relatives, who did not take part in your decision. By uploading you confirm the file is yours, or that of an adult who gave you explicit permission, and you accept that what you learn may also concern them. We do not accept data of anyone under 18, even from a parent or guardian; if we learn that a file concerned a minor, we delete the related record.
Your rights
- Access (Article 15): write to us. In most cases the honest answer is that we hold only the record listed above and nothing that we could tie to you without your file.
- Rectification (Article 16): the entries are not about you individually; corrections to an entry go to questions@codegen.eu.
- Erasure (Article 17): Delete my record in the exit menu removes everything we keep about you at once. Erase all data at logout removes your report data and, if you choose, your favorites, but keeps the record so your paid status survives. You may also ask by email.
- Withdrawal of consent (Article 7(3)): delete your record.
- Restriction and objection (Articles 18 and 21): write to us.
- Portability (Article 20): the only portable data we hold is your report while you are logged in; print or save any page.
- Complaint (Article 77): you may complain to the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, dataprotection.ro), or to the authority of the EU country where you live.
We will answer within one month and will never penalise anyone for exercising a right.
Security
Traffic is encrypted in transit. Storage is encrypted at rest, instances have no inbound administrative access, and the irreversible cryptographic hash is signed with a key held in a hardware security module in production. No system is unbreakable; we designed ours so that a breach would expose as little as possible. If a personal data breach occurs we will notify the supervisory authority within 72 hours (Article 33) and, where the risk to you is high, publish a prominent notice on the site (Article 34), since we have no way to contact you.
Changes to this policy
The date at the top changes when this policy changes. A change that expands what we keep or do with your data is announced on the site before it takes effect and, where consent is the basis, asked for again.
Annex: how the irreversible cryptographic hash is built
TLDR: a scheme-tagged, keyed hash (HMAC-SHA-256) over uninformative genetic noise. It cannot be reversed into your DNA; it can only be matched by a party who already holds both our signing key and your genome file.
What we compute and why it is not sensitive
Your raw file contains hundreds of thousands of positions, many of which encode medically meaningful variants, ancestry composition and drug-response traits. None of that is used in the irreversible cryptographic hash. The core subset is restricted to autosomal positions with a high minor allele frequency across all five continental superpopulations, chosen to be medically and ethnically uninformative, and pruned so that no two selected positions are statistically correlated.
How it is constructed
From the selected positions only the biallelic genotype call is extracted and canonicalised to a strand-orientation-invariant form, so the same person produces the same identifier whichever provider wrote the file. The resulting string is tagged with a scheme marker, reduced with SHA-256 and signed under a dedicated domain separator with a key that, in production, never leaves a hardware security module.
Low-coverage providers. Files from Genes for Good and WeGene do not cover enough of the core panel, so for them the same construction is applied to the whole file. Their identifier is unique to the exact file uploaded, and favorites are not persisted for them.
Why it cannot be reversed
The irreversible cryptographic hash is a keyed message authentication code, not a plain digest; there is no algorithm that inverts it. Anyone who holds the live signing key and a candidate genome file could recompute the hash for that candidate and test it against a stored value, which is why the key is kept where it cannot be exported. Should the hash database be exfiltrated, no genotype, medical, ancestry or trait information is recoverable from it.
Legal requests
We have never received a subpoena, court order or other legal request for user data. Our policy: when in doubt, delete everything.