Privacy Policy
Version 2026-08.3 — Effective August 14, 2026
This Privacy Policy explains how Ploid AI Biotech, S.L., a Spanish limited liability company with Tax ID (CIF) B19786623, registered office at Avenida Diagonal, 612 - P. 1 PTA. 3, 08021 Barcelona, Spain ("Ploid", "we", "us"), processes personal data in connection with the Ploid platform (the "Services").
It applies to the Services as operated by Ploid on its own deployments. Where Ploid operates a dedicated deployment for your organization, that organization's separate written agreement governs, and this Policy applies only to the extent that agreement does not.
This Policy is referenced from Sections 7.1 and 12.4 of our End User License Agreement (the "EULA"). Terms defined in the EULA — in particular Customer Content and Conversations — have the same meaning here.
1. The two roles, and why the distinction matters
Read this section first. It determines which of the rights in Section 9 you exercise against Ploid and which you exercise against the organization whose workspace you are using.
1.1 Ploid as controller. For the data we need in order to run the Services as a business — your account and identity data, your workspace membership, your usage and billing records, and our security and operational logs — Ploid decides why and how the data is processed, and is the controller.
1.2 Ploid as processor. For personal data contained inside Customer Content — the datasets, files, scripts and results you upload or generate — the customer (you, or the organization whose workspace you use) is the controller and Ploid is the processor. We process that data on the customer's documented instructions, as expressed through their use of the Services and the EULA. Our processor obligations are set out in our Data Processing Agreement, which applies to every customer whose Customer Content contains personal data.
1.3 Consequence. If you are a member of an organization's workspace and want data inside that workspace corrected or deleted, address the request to that organization; we will assist them, but we cannot act on Customer Content against the controller's instructions. Requests about your own account, login, usage or billing data come to us directly.
2. Data we process as controller
2.1 Account and identity data. Email address, first and last name, display name, avatar URL where you provide one, the credentials or federated-identity link used to authenticate, and the account's status and history — including when the account was activated and by whom, where activation is subject to approval.
2.2 Workspace and membership data. The workspaces and organizations you belong to, your role in each, invitations you send or receive, and the workspace you last had selected.
2.3 Agreement records. The version of the EULA you accepted, when, and by which method (at registration, or in the application). These records are kept as an append-only history because they are the evidence of acceptance.
2.4 Usage and metering data. Records of your use of the Services: AI model calls and the tokens they consumed, workflow and analysis executions and the compute they used, storage held, and the resulting credit and quota accounting. This is what produces the usage figures and, on paid plans, the bill.
2.5 Billing data. Where a plan is paid, the workspace's billing email and name, the plan and subscription state, invoices and settlements, and an identifier issued by our payment processor. We do not receive or store your card number, expiry date or security code — those are entered directly with the payment processor.
2.6 Support and communications. Messages you send us, and the transactional emails we send you (verification, password recovery, invitations, and approval notices).
2.7 Technical and security logs. IP address, user agent, timestamps, requested endpoints, error and performance data, and records of administrative actions. These are generated by operating the Services and are used to run, secure and debug them.
3. Data we process as processor
3.1 Customer Content. Datasets and files you upload, scripts, workflow definitions and their runs, study materials, and the outputs the Services generate from them.
3.2 Conversations. The prompts, messages and interaction history you exchange with the AI-assisted features, together with the analysis steps and tool calls the assistant performs on your behalf. Those steps are also what you see in the conversation as the record of how a result was produced — each command the agent ran and each result it received — so that an output can be traced back to the work behind it.
3.3 Human genetic, clinical and other special-category data. The Services are built for research data. Data of this kind is special-category personal data under Art. 9 GDPR, and you may place it in the Services only where you have a valid legal basis under Art. 9(2), you have applied appropriate safeguards — such as pseudonymization or de-identification — before upload, and your use stays within the intended purpose of the Services, which excludes every clinical use. Section 4.3 of the EULA and Section 2.3 of the DPA state these conditions in full, and Section 4.2 of the EULA lists the uses they prohibit. We have no way to detect that you have not met them.
3.4 How the AI features are disclosed to you. Ploid is the provider of the AI system in the Services. What it is for, what the agent does without asking you, where its output is known to fail, and how generated content is marked are set out in our AI Transparency Statement and Instructions for Use. That document is published on every Ploid deployment, including deployments operated for a single organization.
4. How your Plan affects use beyond operating the Services
Whether Ploid may use Customer Content or Conversations to train or improve its models — as opposed to processing them to deliver the Services you asked for — depends on your Plan. Those terms are set out in Section 6 of the EULA and are incorporated here by reference rather than restated, so that there is exactly one authoritative statement of them.
In summary, and subject to that Section: operational processing happens on every Plan; training on Customer Content happens only on the Free Plan; use of Conversations for model improvement stops at the Team Plan; and anonymized, aggregated statistics that identify no one are used on every Plan.
5. Purposes and legal bases (Ploid as controller)
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and administer your account; authenticate you | Sections 2.1, 2.2 | Performance of a contract (Art. 6(1)(b)) |
| Provide the Services and their features | Sections 2.2, 2.4 | Performance of a contract (Art. 6(1)(b)) |
| Meter usage; apply quotas; bill paid plans; collect payment | Sections 2.4, 2.5 | Performance of a contract (Art. 6(1)(b)) |
| Send transactional messages about your account | Section 2.6 | Performance of a contract (Art. 6(1)(b)) |
| Keep records of agreement acceptance | Section 2.3 | Legal obligation and legitimate interests (Art. 6(1)(c), 6(1)(f)) |
| Secure the platform; prevent abuse; investigate incidents | Section 2.7 | Legitimate interests (Art. 6(1)(f)) |
| Maintain, debug and improve the reliability of the Services | Sections 2.4, 2.7 | Legitimate interests (Art. 6(1)(f)) |
| Improve models and features to the extent your Plan permits | Sections 3.1, 3.2 | Performance of a contract, on the Plan terms you accepted (Art. 6(1)(b)) |
| Comply with tax, accounting and other legal duties | Section 2.5 | Legal obligation (Art. 6(1)(c)) |
| Respond to lawful requests; establish or defend legal claims | As relevant | Legal obligation and legitimate interests (Art. 6(1)(c), 6(1)(f)) |
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms and recorded that assessment; we will provide it on request. You may object as described in Section 9.
No automated decision-making. We do not make decisions about you solely by automated means that produce legal effects or similarly significantly affect you. AI features generate analyses at your request; they do not decide anything about you.
6. Retention
6.1 Account data is kept while your account exists. To have the account itself closed and its data removed, ask us at privacy@ploid.ai — the Services do not carry a self-service account deletion, and we do it on request, subject to the records in 6.4.
6.2 Customer Content and Conversations are kept while the workspace holds them. You can delete individual resources at any time, and the deletion removes them from our storage.
6.3 Workspace deletion. When a workspace owner deletes a self-serve team workspace, its data is purged immediately as part of the deletion. When a workspace is suspended by an administrator, its data is retained for a grace period — 60 days by default on Ploid's own deployments — so that the account can be restored, and is then purged. An audit record of the deletion itself is retained.
6.4 Records we must keep longer. Billing and invoice records are kept for the period required by Spanish tax and accounting law (currently six years from the end of the relevant financial year). Agreement-acceptance records (Section 2.3) and administrative audit records are kept as evidence for as long as a claim relating to them could be brought. Security logs are kept for a limited period appropriate to detecting and investigating incidents.
6.5 Backups. Data deleted from the live Services may persist in encrypted backups for a short additional period until those backups age out on their normal cycle.
7. Who we share data with
7.1 Within your workspace. Other members of a workspace or organization you belong to can see your name, email and role, and the resources shared in that workspace, according to the permissions the workspace administrators set.
7.2 Service providers (processors). We use a small number of providers to host, operate and support the Services. Each acts on our instructions under a written data-processing agreement. They are listed, with their role and location, in our Subprocessors page, which we keep current.
7.3 Professional advisers and authorities. We may disclose data to our auditors and legal advisers under duties of confidentiality, and to public authorities where we are legally required to.
7.4 Corporate transactions. If Ploid is involved in a merger, acquisition or transfer of assets, data may transfer as part of it. We will notify you before your data becomes subject to a different privacy policy.
7.5 Identity providers. If you sign in with Google, Google receives the fact that an account is authenticating to Ploid and returns your verified email address and a stable account identifier to us. Google acts as its own controller for that authentication under its own terms, not as a processor on our instructions, which is why it is not listed on our Subprocessors page. You can avoid this entirely by registering with an email address and password instead. Where your organization uses its own single sign-on, the identity provider is your organization's and its handling of your data is governed by your organization's arrangements.
7.6 We do not sell your personal data, and we do not share it for advertising or cross-context behavioural profiling.
8. International transfers
8.1 EU by default. Ploid's own production infrastructure is hosted in the European Union, and workspaces on it are created with EU data residency, under which AI model calls are routed to inference endpoints within the EU. Under this setting, Customer Content and Conversations are processed in the EU.
8.2 A deployment operated in another region. Where Ploid runs a deployment for a single customer, that deployment is hosted in the region agreed with the customer and offers the matching regional residency instead — a deployment in the United States offers US data residency, under which model calls are routed to inference endpoints within the United States and Customer Content and Conversations are processed there. Each deployment offers exactly one regional setting; workspace settings show which. Choosing a US-hosted deployment is a decision taken with the customer before the deployment exists, and Customer Content it holds is transferred outside the EU by that choice; where that transfer requires it, we rely on the European Commission's Standard Contractual Clauses together with any additional measures.
8.3 Global residency is an explicit opt-in. A workspace owner or administrator can change the workspace to global data residency in workspace settings. Doing so allows model calls to be routed to providers and regions outside the workspace's region, which means Customer Content and Conversations sent to those models are transferred out of it. Where such a transfer occurs, we rely on the European Commission's Standard Contractual Clauses, together with any additional measures the transfer requires. Choosing global residency is a decision by the workspace's controller, not by Ploid — if you administer a workspace holding personal data, assess it before switching.
8.4 What data residency does not cover. The setting governs where a model call is processed. It does not confine every outbound request an AI feature can make: in particular, where the assistant performs a web search, the search query goes to our search provider in the United States regardless of the workspace's residency, because the models served regionally do not carry out search on the provider's own side. The query may reflect the content of your request; it does not include your datasets or files. A workspace that must not send queries outside its region should have web search disabled for its agents rather than rely on the residency setting. The provider and its transfer mechanism are listed on the Subprocessors page.
8.5 A small number of operational providers may process limited data outside the EU; each is identified as such, with its transfer mechanism, on the Subprocessors page.
9. Your rights
Where Ploid is the controller (Section 2), you have the right to:
- access the personal data we hold about you, and obtain a copy;
- rectify inaccurate or incomplete data;
- erase data, where one of the grounds in Art. 17 GDPR applies;
- restrict processing in the cases set out in Art. 18 GDPR;
- data portability for data you provided, where Art. 20 GDPR applies;
- object to processing based on legitimate interests, including profiling;
- withdraw consent at any time, where we rely on consent — which does not affect processing already carried out.
To exercise any of these, email privacy@ploid.ai from the address on your account, or contact us as in Section 13. We respond within one month, and will tell you if we need the extension Art. 12(3) GDPR permits. We may ask you to confirm your identity where a request is not clearly from you.
These rights are exercised by writing to us, not through a self-service control in the Services. There is no button that exports or erases your whole account, and this Policy does not imply one: a request to privacy@ploid.ai is the route, and we carry it out.
Where Ploid is the processor (Section 3), send the request to the controller of that workspace; if you send it to us, we will forward it and tell you we have done so.
Complaints. You may lodge a complaint with a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD, www.aepd.es); you may instead complain to the authority where you live or work. We would appreciate the chance to address your concern first.
10. Security
We protect personal data with measures appropriate to the risk, including: encryption of data in transit and at rest; logical separation of each workspace's data, enforced on every request; role-based access control within workspaces; least-privilege, audited administrative access to production systems; network restrictions on the environments that execute analysis code; secret management outside application code; and monitoring and alerting on the platform's behaviour.
No system is perfectly secure. If a personal data breach occurs, we will notify the competent supervisory authority and affected controllers and individuals as and when the GDPR requires.
11. Cookies and similar technologies
The Services use only what is necessary to work. We set:
- a session cookie placed by our authentication component, which keeps you signed in and expires 24 hours after sign-in;
- two functional cookies that remember which workspace and organization you had selected, so that a page you open directly loads the right one.
We also use your browser's local session storage to hold that same selection and to avoid re-showing a notice you have already seen in the current session.
We do not use analytics, advertising, or third-party tracking technologies, and we do not build behavioural profiles. Because every one of the above is strictly necessary to provide a service you requested, no consent banner is required for them; if that ever changes, we will ask for consent before setting anything that needs it.
12. Children
The Services are not directed to children and are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
13. Changes and contact
13.1 We may update this Policy. When we do, we publish the new version with a new version identifier and effective date on this page. Where a change materially affects how we process your personal data, we will notify you in the application or by email before it takes effect.
13.2 Three addresses, so that a request reaches the people who handle it:
- privacy@ploid.ai — to exercise any right in Section 9, or for anything about how we process personal data. This is the address that starts the one-month clock in Art. 12(3) GDPR, and it is monitored on working days.
- legal@ploid.ai — for anything else in this Policy, and for the other documents listed in Section 14.
- dpo@ploid.ai — the Data Protection Officer, in Section 13.3.
Ploid AI Biotech, S.L. Avenida Diagonal, 612 - P. 1 PTA. 3, 08021 Barcelona, Spain CIF B19786623
13.3 Data Protection Officer. We have designated a Data Protection Officer, who can be reached directly and in confidence:
Email: dpo@ploid.ai
You may contact the DPO about any matter relating to the processing of your personal data or the exercise of your rights, and you may do so instead of, or in addition to, using the addresses in Section 13.2.
14. Related documents
- End User License Agreement — the accepted terms, including the per-Plan data-use terms in its Section 6
- AI Transparency Statement and Instructions for Use — what the AI agent does, its known limitations, and how generated content is marked
- Data Processing Agreement — our Art. 28 processor terms for Customer Content
- Subprocessors — the providers we use, their role and their location
- Open-Source Software Notices — the third-party components the Services are built with