Skip to content
CollabHub.ai
Sign inGet started

Privacy Policy

Effective date:

On this page16 sections

This Privacy Policy explains how PairOx Pty Ltd (New South Wales, Australia; 4 Lorikeet St, Glenwood NSW 2768), trading as “CollabHub.ai” (“CollabHub.ai,” “we,” “us,” or “our”) — the data controller — collects, uses, shares, and protects personal data when you use the CollabHub.ai research collaboration platform (the “Service”). It should be read together with our Data-Use Covenant, our binding promise never to sell your data or train AI on your private work without your consent.

1. Information We Collect

  • Account information you provide, such as your name, email address, institution, a securely hashed password, and your account's data-region setting.
  • Content you create on the Service, including notebooks, datasets, experiments, protocols, and files (“Your Content”).
  • Usage and device data such as log data, IP address, browser or device type, and interactions, which help us operate and secure the Service.
  • Payment information if you subscribe to a paid plan — processed by our payment provider; we do not store full card numbers.
  • Cookies and similar technologies used for authentication and preferences, as described below.

2. How We Use It

We use personal data to:

  • provide, operate, and maintain the Service;
  • authenticate you and enable collaboration and sharing features;
  • secure the Service and detect, prevent, and investigate fraud or abuse;
  • provide customer support and send service communications;
  • power collaboration discovery and search — our synergy, discovery, and knowledge-graph features analyze your content to surface anonymous collaboration matches and to structure your work for search, according to the discoverability setting you control (set it to Private to opt out of synergy scanning; withdrawing is forward-only — it stops future matches and further identity disclosure, but does not remove matches already made or identities already mutually revealed);
  • improve and develop features, using usage and aggregate, de-identified data — not the private contents of Your Content for model training (see our Data-Use Covenant); and
  • comply with legal obligations.

3. What We Never Do

We do not sell your personal data or Your Content. We do not use the private contents of Your Content to train, fine-tune, or improve machine-learning models — ours or any third party’s — without your explicit, revocable consent. We do not serve third-party advertising or build sellable profiles from your research. These commitments are set out in full and made binding in our Data-Use Covenant.

5. Data Sharing & Subprocessors

We do not sell your personal data. We share it only with: the service providers (subprocessors) listed below, each under contractual data-protection obligations; the services listed below that you choose to sign in with, link to your profile or import from; collaborators you choose to invite or share your work with; and authorities or third parties where required by law or to protect rights and safety. If we are involved in a merger, acquisition, or asset sale, personal data may be transferred subject to this Policy and our Data-Use Covenant. We can provide the current list of subprocessors on request and will make reasonable efforts to give notice of a new subprocessor. Business customers acting as data controllers can request a Data Processing Addendum (DPA).

The subprocessors we use today, what each one does and, where it is established, where it processes data:

  • Contabo GmbH — hosting, databases, file storage and search, in the European Union. This is where Your Content lives.
  • Anthropic — AI model inference, processed in the United States. It receives the content an AI feature needs when you invoke that feature, and research data that background features, such as synergy matching and discovery, send it for analysis.
  • OpenAI — AI model inference, processed in the United States. It receives the content an AI feature needs when you invoke that feature, and research data that background features, such as synergy matching and discovery, send it for analysis. If this installation turns on hosted text embeddings, it also receives research text and search queries to embed for search. Not enabled; no data is sent to it.
  • Resend — transactional email (sign-in, verification, notifications), processed in the United States.
  • SMTP email relay — transactional email (sign-in, verification, notifications) when this installation sends mail through an SMTP relay instead of Resend. The relay is chosen by whoever operates this installation; this page does not state its operator or location. Not enabled; no data is sent to it.
  • Migadu — hosting for our inbound @collabhub.ai mailboxes, including the privacy contact address in Section 16, in Europe. Anything you email us is processed there.
  • Sentry — error monitoring, processed in the United States. Error reports are scrubbed of personal data and credentials before they are sent.
  • Stripe — payment processing, in the United States.
  • Expo — delivery of push notifications to our mobile app, processed in the United States. Used only if you use the mobile app: it receives the push token that identifies your device and, once you allow notifications, each notification's title, text and the links the app uses to open it, which it passes to Apple Push Notification service (APNs) on an iPhone or Firebase Cloud Messaging (FCM) on Android for delivery.
  • Apple Push Notification service (APNs) — delivery of push notifications to our mobile app on an iPhone, by Apple Inc., a United States company. Used only if you use the mobile app on an iPhone: it receives the push token that identifies your device and, once you allow notifications, each notification's title, text and the links the app uses to open it, which it delivers to your device.
  • Firebase Cloud Messaging (FCM) — delivery of push notifications to our mobile app on Android, by Google, which states that this service can process data at any of its Google Cloud or data center locations. Used only if you use the mobile app on Android: it receives the push token that identifies your device and, once you allow notifications, each notification's title, text and the links the app uses to open it, which it delivers to your device.
  • Upstash — instant sign-out on every device: your account ID and the time your sessions were revoked, held by Upstash, Inc., a United States company. Not enabled; no data is sent to it.
  • Amazon CloudFront — delivery of the files you download, through the content-delivery network of Amazon Web Services, Inc., a United States company. Not enabled; no data is sent to it.

Further recipients are not subprocessors but should be named anyway, because data reaches them: if you choose Sign in with Google, Sign in with GitHub or Sign in with Apple (each is offered only where we have switched it on), you authenticate directly with that provider and it returns your basic profile to us. Each acts as an independent controller for that sign-in under its own privacy policy, not as a processor acting on our instructions. Signing in with an email address and password involves no third party. If you link an ORCID iD to your profile, we send that iD to ORCID’s public registry to confirm it exists. If you give us credentials to import records from Benchling, LabArchives or Google Drive, we use them to request those records from that service.

Apart from where Your Content is stored, the providers above process limited data for the purpose stated for each; where a provider’s location is established, it is stated with it. We will update this list before adding a new subprocessor.

6. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. When you delete your account or specific content, we delete or irreversibly anonymize the associated personal data within a reasonable period (typically within 30 days), except where we must retain limited records to meet legal, tax, accounting, or security obligations, or to resolve disputes.

7. Your Rights

Subject to applicable law, you have the right to access, rectify, erase, and receive a portable copy of your personal data, and to restrict or object to certain processing. You can exercise the core of these rights directly in the app: use the data export tools to download a portable copy of your data, and use account deletion to erase your account and associated content. You may also contact us to exercise any right, and, if you are in the EEA/UK, you have the right to lodge a complaint with your local data-protection authority.

8. Your Australian Privacy Rights (Privacy Act 1988)

We are an Australian company and handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You may request access to, and correction of, the personal information we hold about you (APPs 12–13), using the in-app tools or by contacting us. If you are not satisfied with how we handle a privacy matter, you can contact us first and then complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to and deletion of it, to correct inaccuracies, and to be free from discrimination for exercising your rights. We do not “sell” or “share” personal information as those terms are defined under the CCPA/CPRA, and we do not use sensitive personal information for purposes other than providing the Service. You can exercise these rights using the in-app tools or by contacting us.

10. International Transfers & Data Region

We are based in Australia. Your data is stored at rest in the European Union, on infrastructure provided by Contabo GmbH. We will confirm the specific country and datacentre on request, and name them in the Data Processing Addendum for business customers.

Because our team is in Australia, our staff access your data from outside the EEA in the course of operating and supporting the Service. That access is a cross-border transfer of personal information, which we handle consistently with APP 8 and, for EEA/UK personal data, under appropriate safeguards.

Some of the providers we rely on to deliver the Service process limited data in other countries; Section 5 (Data Sharing & Subprocessors) lists each one, with where it processes data when that is established, and you can also request the current subprocessor list. If we add further storage regions we will say so here before you can choose one.

11. Cookies

We use strictly necessary cookies to keep you signed in and to secure your session, and preference cookies to remember your settings. You can control non-essential cookies through your browser or any in-app cookie controls we provide; disabling essential cookies may prevent parts of the Service from working. We do not use third-party advertising cookies.

12. Security

We use technical and organizational measures to protect personal data, including encryption in transit, access controls, and support for two-factor authentication. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work continuously to protect your data and will notify you of a breach affecting your data as required by law.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

14. Automated Decisions

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. AI assistants run at your request, and our synergy/discovery features run in the background per your discoverability setting to surface anonymous collaboration suggestions; none of these make consequential decisions about you on our behalf.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, for example by email or through an in-app notice, before the changes take effect.

16. Contact

For privacy questions or to exercise your rights, contact our privacy team at privacy@collabhub.ai.