Privacy Policy.

01Who we are

LingoCell is a research-use analysis service for single-cell data. It is operated by [operator: legal name to be confirmed] (“we”, “us”). Postal address: [postal address of the operator: to be added]. For anything that concerns this policy or your data, write to [contact e-mail address to be confirmed].

02What this policy covers

This policy describes what happens to information about you and to the files you upload when you use the LingoCell website, create an account and run jobs. It applies together with the Terms of Use.

LingoCell is meant for coded research data. It is not a place for data that identifies study participants, and before every upload you confirm that your file contains none (Terms of Use, section 4).

03Data from human samples collected in mainland China

04What we collect

Your account. Your e-mail address; the username, the institution or organisation, the education or position and the country or region that you enter at your first sign-in; whether you want job e-mails; and when the account was created and last used.

How you sign in. We never set or store a password. If you sign in with an e-mail code, we keep the code only as a keyed checksum from which it cannot be read back, and only until it has expired. If you sign in with Google or GitHub, we store which provider it was, the identifier that provider gives your account, and the e-mail address it reported (section 11).

Sessions and the sign-in log. For each signed-in browser: when the session started and was last used, the sign-in method, the IP address and the browser's identification. For each sign-in attempt: the time, the method, the outcome, the IP address and the browser's identification. An attempt for an address that has no account is logged with a keyed checksum of the address, not with the address.

Your consents. For each box you tick (the Terms of Use together with this policy; the separate consent to processing outside your own country; the three statements you confirm before each upload): which box, the version of the text, the time, the IP address and, for the upload statements, the upload they belong to.

Files you upload. The file itself, its name and size, and checksums of its content.

Jobs and results. The task and the settings you chose, the times and the state of the job, facts measured about your input (for example the number of cells and genes), warnings and error messages, the result files with their checksums, and the software release that produced them.

E-mail we send you. For each message: the address, the kind of message, the time and whether it could be delivered. The text of a message is discarded once it has been sent.

Technical logs. Our web server logs each request: IP address, time, the address requested (which can contain a job ID), the status of the answer and the browser's identification. Sign-in credentials are not written to the log.

What we do not collect. We use no analytics or advertising service, nothing on this site is loaded from another company's servers, and we do not track you across other sites.

05What we use it for

• to create your account, sign you in and keep the account secure;
• to run the analyses you request and to show you their results;
• to tell you by e-mail that a job has finished or failed (you can switch this off under Account), and to warn you when a sign-in method is added to your account;
• to keep the service working and safe: limits against overload and misuse, finding and repairing faults;
• to answer you when you write to us;
• to keep evidence that you agreed to the terms and confirmed the statements about each upload.

We use uploaded files and results for nothing else. In particular they are not used to train, tune or evaluate models, and we do not analyse them for any purpose of our own.

[Legal basis: the legal ground for this processing under the law that applies to the operator is to be stated here by the university office.]

06Where your data is stored and processed

Your data leaves the country you are in. When you create your account we ask for your separate consent to this.

• Hong Kong. The website, the database with the account and job records, and the stored files (your upload and your results) are on a cloud server in Hong Kong that we rent from Alibaba Cloud.
• Japan. Analyses run on a GPU machine of our laboratory in Japan. For each job that machine fetches your file from the server over an encrypted connection, computes, sends the result files back to the server and deletes its working copy when the job has ended.
• Singapore. E-mail (sign-in codes, job notices, security notices) is sent through Alibaba Cloud's e-mail service in Singapore, which therefore receives your e-mail address and the text of each message. [A second e-mail provider that would be used if the first one fails: to be named here if one is configured.]
• Google or GitHub, only if you choose to sign in with one of them (section 11).

Encrypted backups of the database (not of uploaded files or results) are kept on the server [and where else, for example on the laboratory's machine in Japan: to be confirmed by the operator].

[Information on the personal-data protection systems of the places named above and on the safeguards taken by the providers, with links to the official country reports: to be added by the university office.]

07Who can see your data

• You. Results can be opened only from your account, after signing in. A job link does not work for anybody else: another user, or a visitor who is not signed in, is not shown the job. An uploaded file cannot be downloaded again from the website, not even by you.
• The laboratory's administrators. The few administrators named by the operator can see, on a read-only administration page, the account records (e-mail address, username, institution, education or position, country or region, sign-in methods, consents, sessions and sign-in log, the number of your jobs and the size of the file you have stored), the job records (file name, task, state, times and error details) and the record of e-mails sent. They can also save the list of accounts and the list of jobs as a table; each time this is done it is recorded. That page gives no access to the content of uploaded files or of results.
• The people who run the machines. The few people who maintain the server and the GPU machine have technical access to the disks on which files are stored. The GPU machine is also used for other work of the laboratory. [The operator's rule for this access (for example: stored files are opened only to repair a fault or at the user's request), who these people are, who else has an account on the GPU machine and how job files are kept apart from them: to be confirmed by the operator.]
• Our service providers. Alibaba Cloud runs the data centre and the e-mail service on our behalf.

We do not sell your data and do not give it to anyone else. [Cases in which the law may require disclosure: to be stated by the university office.]

08How long we keep it

Your uploaded file

• An upload that was not finished is discarded 24 hours after its last part arrived, and at the latest 72 hours after it was started.
• A finished upload that no job has used is deleted after 24 hours.
• After a job, the file is kept for 24 hours from the end of the last job that used it, so that you can run another task on it. It is kept for 72 hours if that job stopped because of a fault on our side or because it reached a time, memory or output limit, so that it can be run again. Then it is deleted automatically.
• An account holds one file at a time: a new upload replaces the earlier file as soon as the new one is complete. If a job is still using the earlier file, that file is deleted when the job ends.
• The working copy on the GPU machine is deleted when the job ends.
• After a file has been deleted, the record of it (its name, size and checksums) is kept for a limited time and then removed as well.

Results

• Result files are deleted 30 days after the job finished, large data files after 7 days. Both dates are shown on the job page and in the e-mail.
• When the files are deleted, the details of the job (file name, settings, messages, summary numbers) are removed as well. For a job that failed or was cancelled this happens 30 days after it ended.
• What then remains is a minimal record: job ID, task, state, dates and software release, together with the technical record of the run (software and hardware versions, the random seed, timings, and the size and checksum of each input and result file, without the name or the content of your file). It is deleted 365 days later.
• A job that could not start within 7 days is closed.
• When you delete a job yourself, one time stamp per account stays: when a job of yours was last started. It is used only to share the GPU fairly between users, and it goes with the account, at the latest when it is as old as a job record may become.

Account and sign-in

• Your account record is kept until you delete the account. [Whether accounts that have not been used for a long time are removed: to be decided by the operator.]
• An account whose first sign-in was never completed (no profile entered, no consent given) is deleted automatically after a short time.
• A sign-in code is valid for 10 minutes. Expired codes and ended sessions are cleared from the database soon afterwards.
• The sign-in log is kept for 90 days.
• Consent records are kept for as long as the account exists; what happens to them afterwards is described in section 9.
• Records of e-mails sent and the web server's log are kept for a limited time only. [The exact periods are to be printed here once the service publishes them: to be confirmed by the operator.]

Backups

• A backup of the database is made every day and kept for 14 days. Uploaded files and result files are not backed up.

09Deleting your data

You can do all of this yourself, at any time:

• delete your uploaded file, on the Server page or under Account (a file that a waiting or running job still needs can be deleted once that job has ended or been cancelled);
• delete a job together with its result files, on the job's page;
• delete your account, under Account. This removes your profile, your sign-in methods and sessions, your file, your jobs and your results, and cancels jobs that are still running. It cannot be undone.

After an account has been deleted we keep only:

• the record of your consents (which box, which version, when, from which IP address), linked to a random account number and no longer to your e-mail address or name [for how long: to be decided by the operator];
• the minimal job records described in section 8, without your identity;
• entries of the sign-in log (time, method, outcome, IP address, browser's identification) without your e-mail address, until they reach the age stated in section 8;
• records that e-mails were sent, without the address they went to, for the limited time mentioned in section 8;
• for a short time, a keyed checksum of your e-mail address with the times of your most recent jobs and the times and sizes of your most recent uploads, so that the limits cannot be reset by deleting an account and creating a new one;
• backups: database backups made before the deletion still contain your account data until they are 14 days old. If the database ever has to be restored from a backup after a failure, an account deleted in the meantime reappears and has to be deleted again [procedure: to be confirmed by the operator].

If you cannot sign in, write to [contact e-mail address to be confirmed] and we will delete the account for you.

10Cookies and browser storage

The site sets only the cookies it needs in order to work:

• a session cookie while you are signed in. If you tick “Keep me signed in on this device” it stays on the device and is renewed while you use the service; otherwise it ends when you close the browser. Signing out removes it. [The exact lifetimes are to be printed here once the service publishes them.]
• a short-lived cookie while a sign-in code is on its way to you; it lasts as long as the code, 10 minutes;
• a short-lived cookie during a sign-in with Google or GitHub.

Your browser also keeps two small notes on your device, which are not sent to us: your choice for the Chinese helper lines and, while an upload is unfinished, a note that lets the page continue it (the upload's ID, the file's name and size, and a fingerprint of the file).

There are no analytics, advertising or third-party cookies.

11Signing in with Google or GitHub

If you choose one of these, that company learns that you signed in to LingoCell. We receive from it the identifier of your account there, your e-mail address (only one that the company has verified) and, to prefill the form, your name. We do not receive your password, we keep no access to your account there, and we write nothing to it.

If the e-mail address already belongs to a LingoCell account, the provider is added to that account as a sign-in method, in most cases after you have entered a code sent to that address, and we tell you by e-mail. You can remove a provider under Account at any time.

12Your rights

You can see and change your profile under Account, and you can delete data as described in section 9. You may also ask us for a copy of the information we hold about you, for a correction you cannot make yourself, for deletion, or to withdraw the consents you gave. Withdrawing consent ends your use of the service: in practice it is done by deleting the account, which you can do yourself or ask us to do. Write to [contact e-mail address to be confirmed].

[How soon requests are answered: to be stated by the operator.]

[The formal procedure of the operator's university for requests to disclose, correct or stop the use of personal information, and where such a request is sent: to be added by the university office.]

The e-mail address of an account cannot be changed. To use another address, create a new account with it and delete the old one.

13Security

All connections to the site are encrypted (HTTPS). There are no passwords: you sign in with a one-time code or through Google or GitHub. Sign-in codes, session keys and the keys of our GPU machine are stored only as checksums. Every request for a job or a file is checked against the account that owns it. Database backups are encrypted before they are stored.

No system is perfectly secure. If we learn of an incident that affects your data, we will tell you [how and how soon: to be confirmed by the operator].

14If you are outside Japan

Wherever you are, using LingoCell means that your account data and your files are processed in Hong Kong, Japan and Singapore as described in section 6. If you are in mainland China, please also note section 3.

[Further information that the law of particular places may require, for example for users in the European Union: to be added after review.]

15Changes to this policy

This is version 2026-10-draft2. When the policy changes, its version changes, and we ask you to read and accept the new version before you upload a file or submit a job again. The version you accepted is recorded with your consent.