Privacy Information

Controller

Linus Ammer, handelnd unter Abakos-Systeme, Schönrain 10, 84152 Mengkofen, Germany, email contact@basedongenes.com. For Canadian customers, Linus Ammer is also the individual designated as Privacy Officer under PIPEDA; privacy requests and complaints may be sent to the same postal and email address.

Local genetic processing

The genome file, filename, variants and score result are processed only in the browser and are not transmitted to Based on Genes, Paddle or the server. The analysis worker has no network capability.

After a successful calculation, the app automatically stores the derived score result together with its licensed product release in the local browser database (IndexedDB) and asks the browser for persistent storage. Site and score-catalogue updates invalidate neither that licence nor an existing result; required local storage formats are migrated and packages for licensed older releases remain available. The genome file itself is not copied; supported browsers may only remember the local file access granted by the user. These local data normally remain until deletion or browser-site-data clearing. The browser may nevertheless reclaim storage under its own rules.

Preview, order and licence data

For preview access, the email address is retained briefly for delivery; after that, the persistent record contains only a product-scoped HMAC of the normalised address, the fixed score, timestamps, hashed one-time and package tokens, and the hash and idempotent response of the blinded signature request. Connection data arising briefly is processed only in pseudonymous form for technical security. The confirmed session is stored for up to 30 days in an encrypted, signed HttpOnly cookie. A purchase adds order, payment, consent, market, licence and Paddle customer-mapping data; Canadian orders also include the purchaser name for the contract copy. Email HMACs and pseudonymous connection data remain personal data. Raw genetic data, identity-block hashes and results are not stored on the server.

Retention and recipients

Unused one-time links expire after 20 minutes and are removed under the operational deletion schedule. Order, tax, contract, consent and refund evidence is retained for applicable commercial and tax-law periods; security and outbox data only as long as needed for delivery, reconciliation, security and proof. Recipients are processors used for hosting, transactional email and operations, and Paddle as an independent controller for payment, invoicing and tax. No marketing email is sent.

Legal bases and consent

In the EEA and United Kingdom, local genetic analysis is performed under Article 6(1)(b) GDPR or UK GDPR together with explicit consent under Article 9(2)(a) GDPR or UK GDPR. In Australia and New Zealand, processing likewise begins only after express consent; applicable rules for sensitive information, transparency, access, correction, complaints and overseas disclosures are observed in addition. PIPEDA principles of accountability, identified purposes, consent, data minimisation, safeguards, openness, access, correction and complaint handling are observed for Canadian order, contract and licence data. The genome file and result remain local.

United Kingdom

Based on the expected low volume of UK orders, analysis being performed only on the user's device and Based on Genes receiving neither the genome file nor genetic results, the operator currently assesses the relevant processing as occasional and unlikely to pose a risk within Article 27(2)(a) UK GDPR. Special-category genetic data is not processed on the server on a large scale. No UK representative is therefore currently appointed. This assessment will be repeated if UK activity becomes materially larger or regular, or if the data flow changes. UK users may contact the Information Commissioner's Office at ico.org.uk.

Paddle

Paddle processes payment and billing data as its own controller and merchant of record under its privacy information at https://www.paddle.com/legal/privacy. Paddle never receives the genome file.

Rights and complaints

Applicable law may provide access, correction and, where applicable, erasure, restriction or objection rights for server-side order and licence data. Contact contact@basedongenes.com. Based on Genes cannot technically access or delete genome and result data kept only locally.

Regional rights and complaints

In addition to GDPR and UK GDPR rights, applicable access, correction, deletion, portability, objection, opt-out and complaint rights under US state and Canadian law are honoured. Based on Genes does not sell personal data or use it for behavioural advertising. Complaints may be made to the competent privacy regulator.

Local deletion

“Remove local result” deletes the cached result and remembered file access from the local browser database while retaining the local licence for recovery. Users separately delete licences and downloaded files in their browser or file system, and can remove all site data through browser settings. Based on Genes cannot view or remotely delete data held only locally.