ChemDBL Privacy Policy

This Privacy Policy explains how Juancheng Huashi Information Technology Studio ("we", "us" or "our") collects, uses, stores, shares and protects personal information when you use the ChemDBL website and web app (the "Service"), and what choices and rights you have. The Service is an international edition with its own accounts and data; it is separate from our China-based service at chemdb.top, which has its own Chinese-language policy.

• Your email address and password (we store only a one-way hash of the password and cannot see it)
• Email verification codes used for sign-up and password reset
• A display name if you choose to set one (used to tell group members apart), and an optional profile picture

• Label photos you take or upload, and the text recognized from them
• Chemical records you create or edit: name, CAS number, amount, package size, purity, manufacturer, lot number, expiry date, storage location (free text such as "Cabinet 3"), notes and usage logs
• Group information if you create or join a group: group name, members and the inventory shared in it
• Instrument and booking information if you use that feature
• Feedback you send us, including any attached images

We do not collect your GPS location, contacts or phone number.

When you buy a plan we record the order number, plan, amount, currency, payment status and the PayPal transaction ID. Payments are processed by PayPal; we never receive your card number or PayPal password.

• Server access logs: IP address, time, requested page and browser user agent
• Usage counters needed for plan limits (for example the number of label scans this month)
• Error logs used for troubleshooting

• To provide the Service: label recognition, inventory management, group sharing and data export (performance of our contract with you)
• To process payments, activate plans and enforce plan limits (contract)
• To send verification codes and service emails you need, and to answer your feedback (contract / legitimate interests)
• To keep the Service secure and prevent abuse, for example rate limiting and blocking disposable sign-ups (legitimate interests)
• To maintain, troubleshoot and improve the Service (legitimate interests)
• To comply with legal obligations

We do not sell your personal information, share it for cross-context behavioral advertising, or show you ads.

• United States — our application server: your account, inventory records, uploaded photos, orders, logs and backups.
• Mainland China — our label-recognition (OCR) servers. When you scan a label, the photo is sent over an encrypted, authenticated connection, processed and deleted as soon as recognition finishes (normally within seconds). The request contains only the image — no name, email address or account identifier — and only the recognized text is returned and stored in the United States.

If you use the Service from outside these countries, your information is transferred to and processed in them. These countries may have data-protection laws different from those where you live; we protect your information as described in this policy wherever it is processed.

We share only what each provider needs to perform its function:

• Cloudflare (content delivery and network security): all traffic to the Service passes through Cloudflare
• Resend (email delivery): your email address and the content of service emails we send you
• PayPal (payments): order number and amount; PayPal handles your payment details under its own privacy statement
• Public chemical databases such as PubChem: when a chemical is not in our local reference database we may look it up by CAS number or name only — never together with your personal information

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case the recipient must continue to honor this policy.

If you create or join a group, the inventory you add to the group is visible to its members and the group owner can manage group data and members. Items marked "private" are visible only to you and the group owner.

• Account information and your content: for as long as your account exists. After you ask us to delete your account we delete or anonymize it within 30 days, unless the law requires us to keep something longer.
• Payment and order records: for as long as tax and accounting laws require.
• Server logs: generally no more than 30 days.
• Backups: rolling backups are kept for up to 14 days, so deleted data disappears from backups within that period.
• Label photos sent for recognition: deleted from the recognition servers immediately after processing.

• Encryption in transit (HTTPS/TLS) for connections to the Service and between our servers
• One-way hashed passwords
• Access controls that keep each user's and each group's data separate
• Regular backups and monitoring

No system is perfectly secure. If a breach affecting your personal information occurs, we will take remedial action and notify you and the relevant authorities as required by law.

• A session cookie that keeps you signed in (strictly necessary)
• A preference cookie that remembers whether you chose the desktop or mobile layout
• Browser local storage for interface preferences, such as dismissing the "install app" banner
• Cloudflare may set strictly necessary security cookies

We do not use advertising or third-party analytics cookies. You can clear cookies in your browser at any time; you will then need to sign in again.

Depending on where you live (for example under the GDPR in the EU/UK or the CCPA in California), you may have the right to:

• Access the personal information we hold about you and receive a copy — your inventory can be exported to Excel at any time
• Correct inaccurate information (most of it you can edit directly in the Service)
• Delete your content (directly in the Service) or your whole account (by emailing us)
• Object to or restrict certain processing, and withdraw consent where we rely on it
• Not be discriminated against for exercising these rights
• Lodge a complaint with your local data-protection authority

To exercise any of these rights, email [email protected] from the address registered to your account, or use the in-app Feedback page. We will respond within 30 days.

The Service is intended for laboratory professionals and students aged 16 or older and is not directed at children. We do not knowingly collect personal information from children under 16; if you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy from time to time. We will post the new version here with a new "Last updated" date, and for material changes we will notify you by email or in the Service before they take effect.

Juancheng Huashi Information Technology Studio
Email: [email protected]