Privacy Policy
This policy applies to both our public marketing site and the authenticated DataCNVS application. Questions about this policy can be directed to support@datacnvs.com.
On this page
1. Introduction #
DataCNVS, provided by CNVS Scientific, LLC ("we," "us," "our"), provides a data visualization and analysis platform for physical science data. This Privacy Policy applies to both our public marketing site and the authenticated DataCNVS application (collectively, the "Service"). The two differ in what information they collect and how analytics and consent are handled, as described below.
2. Information We Collect #
Account information
Email, given/family name, and (optionally) a profile picture, collected via AWS Cognito at signup, either directly (native accounts) or through Google or Microsoft Entra ID single sign-on. We do not request or store group/role membership from your identity provider.
Content you upload
Scientific data files, parsed series, canvases, and related metadata. This remains yours; see Section 8 and our Terms of Service on ownership and licensing.
Payment information
Billing name, billing email, and your subscription plan/status, cached in our database. Card numbers, billing address, tax IDs, and invoice history are held only by our payment processor, Stripe. We never see or store full card details.
Usage data
Within the authenticated DataCNVS application, we collect a limited set of hand-selected product events, such as when a dataset is uploaded, a canvas is created, or an export is generated. These events are tied to a user and workspace ID. They do not include raw scientific data values, file contents, names, email addresses, or file URLs.
The public marketing site may also use PostHog for event analytics after an appropriate consent mechanism is in place. Marketing-site analytics is subject to the consent choices described in Section 9.
Support communications
If you contact support through an in-app support channel, your name, email, current page URL, and message content may be shared with our support chat provider.
Request/log data
Standard infrastructure logs (see Section 7) capture technical request metadata such as IP address, timestamps, and API routes. We do not currently log user-agent strings or request bodies at the API layer.
3. How We Use Your Information #
We use the information above to:
- Provide, operate, and maintain the Service, including authentication and workspace/tenant access
- Process payments and manage subscriptions
- Provide customer support
- Monitor and secure the Service (e.g., detecting abuse and debugging errors)
- Communicate with you about your account or changes to our policies
- Comply with legal obligations
- Understand how users interact with the Service and improve our products
We do not sell your personal information or your uploaded scientific data. No third-party AI/LLM service currently processes customer data as part of the Service.
4. Third-Party Service Providers #
| Provider | Role | What they receive |
|---|---|---|
| AWS (Amazon Web Services) | Hosting, storage, compute, authentication infrastructure | Account data, uploaded content, and derived metadata. |
| Stripe | Payment processing | Billing name, billing email, and payment details you provide directly to Stripe (not routed through our servers) |
| Sign-in (optional, if you choose "Sign in with Google") | Email, name, profile picture | |
| Microsoft (Entra ID) | Sign-in for organizations using Microsoft SSO | Email, given/family name |
| PostHog | Product and marketing-site analytics, where enabled and subject to applicable consent requirements | Hand-selected usage events and identifiers; no scientific data or file content |
| Chatwoot | Support chat widget, when enabled | Name, email, current page URL, and chat messages |
No advertising or ad-tech vendors, and no AI/LLM provider, receive customer data.
5. Where We Store Data #
All infrastructure runs in a single AWS region (US East). We do not currently offer regional or EU-specific data storage, and there is no per-customer residency option. If your organization requires data to stay within a specific region, this is something to discuss with us before committing to it contractually. It is not something we currently guarantee.
6. Data Security #
We use technical and organizational measures designed to protect your information, including:
- Encryption at rest: database and scientific-data storage are encrypted using customer-managed encryption keys; profile pictures and application assets use standard AES-256 encryption.
- Encryption in transit: all connections to our API, storage, and database use TLS.
- Access controls: access to infrastructure and customer information is restricted to authorized personnel based on their responsibilities and operational needs.
We maintain governance and audit information within our application infrastructure to support appropriate operational and security controls.
7. Logging and Retention of Technical Data #
API request logs capture technical metadata (timestamp, route, status code, response size, and the requesting IP address) for operational and security purposes. These logs are retained for a limited period before rotating out. We do not log request or response bodies, and application-level logs strip authentication headers before they're recorded.
8. Data Retention and Deletion #
While your account or workspace is active, your data is retained to provide the Service.
When a workspace is closed (by its owner, or when the last member leaves), it enters a grace period before deletion, after which associated files and records are removed, subject to the caveats below. Workspace membership and invitation history are retained afterward for administrative record-keeping and do not currently have an automatic expiration.
When an individual observation, series, or canvas is deleted, it is soft-deleted first and permanently removed after a retention window intended to allow recovery from accidental deletion.
Backups: deleted data may continue to exist in database backups for a limited period after deletion completes, consistent with standard backup-rotation practices.
Account-level deletion: closing a workspace removes that workspace's data, but does not delete your individual user profile if you belong to other workspaces. We do not currently offer full self-service account erasure. If you'd like your account and associated identity data fully removed, contact us at support@datacnvs.com and we'll process the request manually.
9. Cookies and Local Storage #
The public marketing site and the authenticated application have different analytics and consent practices.
Marketing site (public): The marketing site uses a consent mechanism designed to comply with applicable privacy requirements. PostHog event analytics are enabled only after the applicable consent has been provided. We do not use session replay on the marketing site. We also set a language-preference cookie when you choose a language, and a separate cookie if you dismiss a language suggestion, so later visits can remember that choice. These are functional cookies, not analytics cookies.
Application (signed-in product):
| Type | Examples | Purpose |
|---|---|---|
| Cookie | Session-status cookie | Lets the marketing site show the appropriate header CTA; not itself used to authenticate you |
| Cookie/localStorage | Analytics identifiers | Product usage measurement |
| localStorage | Theme, language, last-used workspace, dashboard search history | Preferences and convenience |
| sessionStorage | Post-login redirect, invite/checkout handoff state | Short-lived navigation state |
| Browser storage (via our auth library) | Sign-in session tokens | Keeps you signed in |
| IndexedDB | Local copy of collaborative document structure; optionally, a local cache of dataset values for performance | Offline resilience for collaborative editing; faster reloads of large datasets (cleared on sign-out) |
Application analytics: use of the authenticated application inherently involves providing the information necessary to operate and improve the product, including the limited product-usage analytics described in Section 2. These analytics do not include raw scientific data values, file contents, names, email addresses, or file URLs.
We do not use session replay to record your activity in the application.
10. Your Rights and Choices #
- Export: you can request an export of your scientific data in our interchange format from within the app. This covers dataset content but not account, billing, or collaboration metadata; for a complete copy of your data, contact support@datacnvs.com.
- Deletion: you can close a workspace to remove its data (see Section 8 for what that does and doesn't cover). For full account-level deletion, contact us directly.
- Access and correction: contact support@datacnvs.com to review or correct your account information.
- Marketing-site analytics choices: you can manage your consent choices through the consent mechanism provided on the marketing site.
Where applicable law provides additional privacy rights, you may exercise those rights by contacting us at support@datacnvs.com.
11. Children's Privacy #
The Service is intended for business and institutional use and is not directed to individuals under 16. We do not knowingly collect personal information from children.
12. Changes to This Policy #
We may update this Privacy Policy from time to time to reflect changes to our services, data practices, legal requirements, or other circumstances. When we make changes, we will update the "Last updated" date and post the updated policy on our website.
For material changes that affect how we collect, use, or share personal information, we may also provide additional notice, such as an email, an in-app notification, or a notice on our website, before the changes take effect.
13. Contact Us #
Questions about this policy or your data can be directed to support@datacnvs.com.