Privacy Policy

1. Who is responsible for your data?

The controller for Molhaven account, billing, website, and support data is Anatoli Piven, an individual business registered in Poland, NIP 1133100563, REGON 525700892, postal address: ul. Fabryczna 6/33, 05-077 Warszawa, Poland.

Privacy contact: support@molhaven.com.

2. Our role for laboratory data

For account administration, subscriptions, security, and direct support, we act as a data controller. A customer laboratory usually decides why and how personal data contained in its inventory, documents, audit history, and other Customer Data is used. For that data, the laboratory is the controller and we act as its processor.

Users should direct requests about Customer Data to their laboratory administrator first. We assist customers with their data-protection obligations where required.

3. Personal data we collect

• Account data: name, work email, password hash, email-verification state, laboratory membership, and permissions.
• Registration evidence: accepted legal-document versions, acceptance time, IP address, and browser User-Agent.
• Billing data: organisation and billing details, plan, subscription status, transaction references, and tax details. Full payment-card data is handled by our payment provider and is not stored by Molhaven.
• Service and security data: sign-ins, audit events, actions taken in the application, device and browser information, IP address, errors, and infrastructure logs.
• Communications: contact-form messages, support correspondence, and information you provide during onboarding.
• Customer Data: information uploaded or entered by laboratory users, which may include names or identifiers connected with research and inventory records.

4. Why we process data

Where processing relies on legitimate interests, we consider the necessity of the processing and its impact on your rights. We do not use optional advertising storage without your consent.

5. Where data comes from

We receive data directly from you, from your laboratory administrator, from other users who invite you, from your use of the service, and from service providers involved in authentication, payment, hosting, security, or support.

6. Service providers and international transfers

We disclose data only where needed to operate Molhaven, including to:

• Amazon Web Services for application hosting, databases, private object storage, queues, logging, and transactional email;
• Stripe for checkout, payment, and subscription management;
• Cloudflare for Turnstile bot protection and security;
• Google only after consent, for advertising and conversion measurement;
• Telegram when you use the public contact form, so your message can be delivered to our support contact;
• professional advisers, authorities, or other recipients where law requires it or it is necessary to protect legal rights.

Some providers may process data outside the European Economic Area. Where GDPR requires it, transfers rely on an adequacy decision, standard contractual clauses, or another lawful safeguard. Contact us for information about the safeguard relevant to a particular transfer.

7. Cookies and similar storage

Molhaven uses browser storage that is necessary for authentication, security, application state, and remembering your cookie choice. These functions cannot reasonably be provided without that storage.

The public website and registration flow offer optional Google Ads conversion measurement. Google code is loaded only after you select Accept in the cookie banner or allow measurement after verifying your email. Your choice is shared between molhaven.com and app.molhaven.com. If you reject optional cookies, the tag is not loaded. You can reopen Cookie settings from the footer and change your choice at any time.

8. How long data is kept

Account and service data is generally retained while the account or customer relationship is active. After it ends, we delete or anonymise data when it is no longer needed, subject to reasonable export and backup cycles. Billing, tax, legal-acceptance, fraud, and dispute records may be retained for the period required by law or needed to establish, exercise, or defend claims.

Support communications and technical logs are periodically reviewed and deleted when they are no longer reasonably necessary for support, security, or legal purposes. A customer may define additional retention rules for Customer Data under its own responsibility.

9. Security

We use technical and organisational measures designed to protect personal data, including encrypted transport, access controls, private laboratory storage, audit history, backups, and restricted administrative access. No internet service can guarantee absolute security, so please report suspected incidents promptly.

10. Your data-protection rights

Depending on the circumstances, you may have the right to:

• access and receive a copy of your personal data;
• correct inaccurate or incomplete data;
• request deletion or restriction of processing;
• object to processing based on legitimate interests;
• receive portable data where the legal conditions apply;
• withdraw consent at any time without affecting earlier processing;
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) or another competent supervisory authority.

To exercise a right, email support@molhaven.com. We may need to verify your identity before responding.

11. Required data and automated decisions

Registration fields are required to create an account and provide a laboratory workspace. If they are not provided, we cannot deliver the requested service. Billing details are required only for a paid plan. We do not make decisions producing legal or similarly significant effects based solely on automated processing.

12. Policy changes

We may update this policy when our service, providers, or legal obligations change. The current version and effective date appear at the top of this page. We will provide appropriate notice of material changes.