Legal
Ampliova is designed for scientific work. We collect only what is strictly necessary to operate the service and never share or monetise your data.
Data controller
Louis Müller, micro-entrepreneur (France)
Address: 21 Avenue Pauline, 94000 Créteil, France
SIRET: 108 830 514 00015
Code APE/NAF: 63.11Z – Traitement de données, hébergement et activités connexes
TVA: Non applicable (article 293 B du CGI)
Contact: contact@ampliova.com
Data collected
| Data | Purpose | Legal basis |
|---|---|---|
| Email address + password | Authentication (Supabase Auth, EU West, Ireland) | Contract performance |
| Display name | Account personalisation (optional) | Legitimate interest |
| Uploaded RDML files | qPCR analysis. Stored temporarily on Supabase Storage (EU). Never shared with third parties. Never used to train AI models. | Contract performance |
| Analysis data (Cq values, results, parameters) | Stored in Supabase EU database to allow later review and export. | Contract performance |
| Beta waitlist email | Beta access contact only. No marketing without explicit consent. | Consent |
| Primer database search queries | Logged with your account ID (if signed in) to surface genes researchers search for but can't find, so we know what to add next. Never used for advertising or shared with third parties. | Legitimate interest |
| Primer database contributions | Primer pairs and efficiency measurements you submit are linked to your account for attribution and curation history. Entries marked public are visible to all Ampliova users as part of the shared primer database. | Contract performance / consent |
| Payment data | Not collected at this time. Stripe will be integrated later; no banking data will ever transit through Ampliova's servers. |
Infrastructure
| Provider | Role | Data residency |
|---|---|---|
| Supabase | Database + file storage | EU West (Ireland), GDPR compliant |
| Vercel | Frontend hosting | EU, GDPR compliant |
| Vercel Analytics | Aggregate page-view counts | Cookieless: no cookies or persistent identifiers are set, no individual visitor is tracked. Only aggregate, anonymized page-view statistics are collected. |
| Railway | Python analysis engine | Computation data transmitted transiently; not persisted on Railway. |
| Mistral AI | Plate layout parsing (Mistral Small) | Only scientific data (sample names, gene names) is transmitted (no personal data). Data processed transiently and not retained per Mistral AI's API data policy. EU-based company (Paris). AI features available on paid tiers only. |
| Resend | Transactional email delivery (team invitations, beta access notifications) | Recipient email address transmitted for delivery only. No marketing emails sent without explicit consent. GDPR compliant. |
| Stripe | Payment processing | No payment data transits Ampliova's servers. Stripe handles all card data directly under PCI-DSS compliance. |
Security
Retention
Cookies
Ampliova sets exactly two cookies, both strictly necessary for authentication. No advertising or tracking cookies are used. Page-view statistics are collected through Vercel Analytics, which is cookieless: it sets no cookie and assigns no identifier to your browser or device.
| Cookie name | Purpose | Duration | Necessary |
|---|---|---|---|
sb-[ref]-auth-token | Stores the authenticated session (JWT access token + refresh token). Set by Supabase Auth when a user signs in. Read on every request by the Next.js middleware to verify authentication. | 400 days | ✓ Strictly necessary |
sb-[ref]-auth-token-code-verifier | PKCE (Proof Key for Code Exchange) verifier. Created at the start of an OAuth2 / magic-link / invite flow and deleted immediately after the code is exchanged for a session. Prevents authorisation-code interception attacks. | Transient (seconds) | ✓ Strictly necessary |
Both cookies are set by Supabase Auth, hosted in the EU (Ireland). They contain no personal information beyond the authenticated session token and are never transmitted to advertising networks or analytics platforms.
No consent banner is required. Under Article 5(3) of the ePrivacy Directive and the CNIL guidelines on cookies, strictly necessary cookies (those without which a service explicitly requested by the user cannot function) are exempt from the prior-consent requirement. Both cookies above fall squarely within this exemption. Vercel Analytics falls outside the scope of these cookie rules entirely, since it stores nothing on your device.
Your rights
You have the right to access, rectify, erase, port, and object to the processing of your personal data.
Changes
In the event of a material change, registered users will be notified by email at least 14 days before the change takes effect.
Effective date: 1 June 2026