Privacy Policy

RINAE.AI (the “Service”) is operated by AlphaRose Therapeutics, PBC (“AlphaRose,” “we,” “us,” or “our”), a Texas public benefit corporation headquartered in Austin, Texas. The Service is reachable at rinae.ai.

This Privacy Policy explains what information we collect when you use the Service, why we collect it, how it flows through the third-party services that make the Service run, and the choices you have about it.

This policy applies to information we collect through:

• the RINAE.AI web application at rinae.ai and any subdomains we operate;
• the authentication flow that runs when you sign in, including the hosted sign-in pages we use through our identity provider;
• emails we send to you about your account or the service.

It does not cover third-party sites you reach by following links we surface, the public bioinformatics databases the Service queries on your behalf, or the practices of other companies even when their tools are used inside the Service. Where useful, we link out to those companies’ own privacy notices below.

Information you provide

• Account details — your email address and name. If you sign in with Google, your account’s avatar URL is processed by our identity provider during the OAuth handshake but is not currently stored by AlphaRose. We do not receive your Google password.
• Project content — the disease names, gene targets, research goals, questions, notes, and other text you enter while using the Service.
• Uploaded files — any documents, data files, or other artifacts you attach to a project (for example, supporting publications or reference data).
• Conversations — messages you exchange with the Service’s AI-assisted research interface, and the system prompts and intermediate tool outputs associated with those conversations.

Information we generate about your use of the Service

• Pipeline run records — metadata about each Argus / Admiral / Metamorph job you initiate, including status, timing, and the input you submitted.
• Research artifacts — reports, scored evidence, and oligonucleotide design candidates produced by the Service from your inputs.
• Workspace, audit, and telemetry records — the local user identifier we assign to your account; workspace preferences such as your default research persona, default mode, and application role; project events, findings, agent sessions and actions, prompt-edit audit rows, and Admiral per-agent telemetry (cost, object keys, errors). These records exist so that runs are auditable, so the Service can show you what happened, and so authorized internal reviewers can debug the Service.
• Operational logs — standard server logs (request paths, timestamps, approximate IP, browser type, error traces) used to keep the Service running and debug problems.

Information the Service is not designed to handle

• Protected Health Information. The Service is not designed for, and must not be used with, Protected Health Information (PHI) about identifiable patients as that term is defined under HIPAA, state health privacy law, or any equivalent foreign regime. AlphaRose is not a HIPAA-covered entity for the Service and does not sign Business Associate Agreements (BAAs). Although the Service has no automated PHI filter on chat or file uploads, you agree not to submit PHI; if PHI is discovered we may delete or quarantine it without notice.
• Payment data. The Service does not charge users during the closed beta and we do not collect credit-card or banking information. If we introduce paid features, we will update this policy and route payments through a regulated processor.
• Sensitive identifiers such as government ID numbers, precise geolocation, or biometric identifiers.

We use the information described above to:

• provide the Service and run the analyses you request;
• authenticate you and keep your account and projects separate from other users’;
• generate the research outputs (evidence summaries, amenability reports, sequence designs) that the Service exists to produce;
• monitor performance, prevent abuse, and improve the Service;
• respond to support requests and communicate with you about the service.

We do not sell your information, we do not share it with advertisers, and we do not use the content of your projects to train external AI models on your behalf without telling you.

The Service is a thin orchestration layer over a small number of third-party providers. The information you put into the Service necessarily flows through them. We list them by name so you know where your data sits and so you can read each company’s own privacy notice if you want to.

Infrastructure administrator disclosure

The rinae.ai DNS zone and the R2 object-storage bucket are administered through a Cloudflare account currently held by Hekla Ventures, an investor and partner of AlphaRose. Personnel of Hekla Ventures who administer that account therefore have infrastructure-level visibility into DNS records, edge logs, and object-storage administration. Hekla’s access is limited to that infrastructure role; they do not have application-level access to your account, your projects, or any user content stored in the Service’s database. We are working to bring this infrastructure under an AlphaRose-owned Cloudflare account and will update this notice when the migration is complete.

We do not disclose your information to any party that is not a provider listed above or that is not specifically permitted by Section 9.

The Argus stage of the Service reads from public bioinformatics resources such as ClinVar, gnomAD, GTEx, OpenTargets, UCSC, and similar databases. These are queries we make on your behalf for a gene or variant; no personal information about you or about anyone else is sent to those resources. The results are stored with your project so you can revisit them, but they remain public-source data.

Our primary application servers and database are hosted in the United States (Fly.io, region EWR). Cloudflare, Google, OpenAI, Modal, Inngest, and our other providers may process requests in other countries depending on routing.

The Service is offered only to users in the United States during the closed beta. We do not market the Service to, and you may not use the Service from, the European Economic Area, the United Kingdom, or any jurisdiction outside the United States without our prior written consent. We have not implemented a GDPR-specific consent, transfer, or Data-Protection-Agreement framework, and we do not currently rely on Standard Contractual Clauses or similar transfer mechanisms. If you nonetheless access the Service from outside the United States with our consent, you acknowledge that your information will be processed in the United States and other jurisdictions where our providers operate.

During the closed beta, deletion of your account and project content is performed manually by AlphaRose engineers in response to a written request. We have not yet implemented a self-service deletion flow or an automated garbage-collection process for object storage; uploaded files and generated artifacts marked “deleted” in our database remain in the underlying object stores until manually purged.

When we receive a deletion request, we will, on a best-effort basis, remove your account record and the project content associated with it from active systems. Some information may be deleted, deidentified, or retained where retention is required to operate the Service securely, comply with law, resolve disputes, enforce our agreements, or maintain audit trails for runs that depended on your input. Backups and operational logs follow our providers’ standard retention windows.

To request deletion, write to subscriptions@alpharose.com from the email address on the account.

We share information only:

• with the service providers listed in Section 5, strictly to operate the Service;
• if required by a valid legal process (subpoena, court order) or to protect rights, safety, or property of AlphaRose, our users, or the public;
• in connection with a corporate transaction (acquisition, merger, restructuring), in which case we will give notice and the receiving party will be bound by this policy or a successor that is at least as protective.

We use commercially reasonable practices to protect the Service: TLS in transit, encryption at rest at our hosting providers, scoped service credentials, application-layer access controls based on your account, and short-lived authentication tokens managed by WorkOS. No system is perfectly secure; if you believe your account has been compromised, contact us immediately at the address above.

Security incident notification

In the event of a security incident affecting personal information that we are required to notify under applicable law (including, in particular, Texas Business & Commerce Code § 521.053 and similar state breach-notification statutes), we will notify affected users and the appropriate regulators within the timeframes those laws require, using the email address on file for your account.

• Access: you can see your account and project information in the application.
• Correction: you can edit your name or sign in with a different identity to change the email associated with your account.
• Deletion: contact us as described in Section 8.
• Communications: service emails (sign-in codes, password resets, account notices) cannot be opted out of while your account is active. We do not currently send marketing email; if we begin, the emails will include an unsubscribe link.

RINAE.AI is intended for adult researchers and clinicians. The Service is not directed to children under 18 and we do not knowingly collect information from anyone under 18. If you believe a child has created an account, contact us and we will remove it.

When we update this policy, we will revise the “Last updated” date at the top of the page. Material changes will be announced in the application or by email to active users. The updated practices apply to information collected from and after the new effective date.

Questions, requests, or concerns about this policy can be sent to:

AlphaRose Therapeutics, PBC
Attn: Privacy
Austin, Texas
subscriptions@alpharose.com