Scellis
EN
Launch app

§ Privacy

Privacy Policy

How we handle your data.

Controller

This privacy policy explains how Scellis processes personal data when you visit scellis.com (the “site”), and how the Scellis platform (the “product”) treats data by design. It is written to meet the information duties of Articles 12–14 of the EU General Data Protection Regulation (GDPR).

Controller within the meaning of Art. 4(7) GDPR: Scellis, [postal address — completed before launch]. Privacy inquiries: privacy@scellis.com. General inquiries: hello@scellis.com. Security reports: security@scellis.com.

A data protection officer has not been appointed, as the statutory thresholds for a mandatory appointment are not currently met. Every privacy request reaches us directly at privacy@scellis.com.

At a glance

The site uses exactly one third-party service: Google Analytics 4, which is on by default so we can understand, in aggregate, how the site is used. You can turn it off at any time — declining in the banner, or later via “Cookie settings” in the footer, stops measurement and clears its cookies. Every advertising feature stays permanently off.

Hosting and content delivery run on Cloudflare; this produces technically necessary server logs (IP address, user agent) used solely to secure and deliver the site.

The product is local-first: your research data stays on your device, our servers receive only what you explicitly choose to sync or share, and connector credentials never leave your device.

Hosting and server logs (Cloudflare)

The site is hosted and delivered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you access the site, Cloudflare processes connection data in server logs: your IP address, user agent (browser and operating system), the requested URL, the time of access, and the transferred data volume.

Purpose and legal basis: this processing is required to deliver the site reliably and to protect it against attacks and abuse (e.g. DDoS mitigation, rate limiting). The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in the secure, stable operation of the site. The log data is not merged with other data sources and is not used to identify individual visitors.

Server logs are kept for a short, rolling period for security analysis and are then deleted. Cloudflare acts as our processor under an Art. 28 GDPR data processing agreement; for transfers to the USA, see the international-transfers section below.

Web analytics (Google Analytics 4 — on by default, opt out any time)

We use Google Analytics 4 (GA4) to understand, in aggregate, how the site is used. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Analytics is on by default. On your first visit, GA4 loads and sets its cookies unless you have already declined. You can decline at any time — in the consent banner, or later via “Cookie settings” in the footer — which immediately stops measurement and expires the _ga cookies; on every later visit nothing loads. We deploy Google Consent Mode v2 with every advertising signal (ad_storage, ad_user_data, ad_personalization) permanently denied — Scellis runs no advertising — and only analytics_storage is used.

When active, GA4 processes: a pseudonymous client ID (stored in the _ga cookies), the pages you visit, the referrer, an approximate location derived from your IP address, and device and browser characteristics. GA4 does not log or store your full IP address; it is processed transiently to derive coarse geolocation and route the request.

Legal basis: our legitimate interest in understanding, in aggregate, how the site is used in order to improve it (Art. 6(1)(f) GDPR) — balanced by a prominent, one-click opt-out and by keeping every advertising signal permanently off. You can object at any time with effect for the future: open “Cookie settings” in the site footer and choose Decline. Objecting does not affect the lawfulness of processing carried out before it.

Google may transfer data to Google LLC in the USA; see the international-transfers section. Analytics event data is retained in Google Analytics for at most 14 months.

Contact by email

When you email hello@scellis.com, privacy@scellis.com, or security@scellis.com, we process your email address, the content of your message, and any data it contains, in order to handle your request. Legal basis: Art. 6(1)(b) GDPR where the contact relates to a (pre-)contractual matter, otherwise Art. 6(1)(f) GDPR — our legitimate interest in answering inquiries.

Correspondence is deleted once the matter is resolved, unless a statutory retention duty requires keeping it longer.

Cookies and local storage

Three functional localStorage entries store only your own choices on your device, send nothing to any server, and are therefore consent-exempt under § 25(2) no. 2 of the German TDDDG (storage strictly necessary for a service you explicitly request). The two Google Analytics cookies are set by default and are removed when you opt out:

You can change your analytics decision at any time via “Cookie settings” in the footer, and clear all entries through your browser’s site-data controls.

  • scellis-theme (localStorage) — remembers your light/dark theme choice. Lifetime: until you delete it. Functional; no consent required.
  • scellis-currency (localStorage) — remembers your display-currency choice. Lifetime: until you delete it. Functional; no consent required.
  • scellis-analytics-consent (localStorage) — records your analytics decision (granted/denied) so we do not re-ask on every visit. Lifetime: until you delete it. Functional; no consent required.
  • _ga (cookie, set by Google Analytics) — distinguishes visitors via a pseudonymous client ID. Lifetime: up to 2 years. Set by default; expired when you opt out.
  • _ga_* (cookie, set by Google Analytics) — maintains session state for the GA4 property. Lifetime: up to 2 years. Set by default; expired when you opt out.

The product: local-first by design

Scellis is a browser-native, local-first scientific compute platform. Your research data — datasets, workflows, models, results — is stored on your device and processed on your own hardware. By default, none of it reaches our servers.

Our servers receive only what you explicitly choose to sync or share. Any transfer of data off your device is an explicit, consent-gated action that names its destination — it never happens silently.

Credentials you supply to data connectors (API keys, tokens) are held client-side, encrypted at rest, and are never synced to or stored on our servers.

When you use account features, we process: your GitHub account identifiers (GitHub is the sign-in provider; we never see your GitHub password); the content you sync, stored in our database (hosted on Neon); and transactional email (e.g. verification messages), sent via an EU-resident email provider. Payment processing via Stripe will be added at launch — card data will never touch our servers; it goes directly to Stripe.

The product’s storage design supports data-protection rights technically: identifying data is kept in a per-user store whose erasure is cryptographically enforceable, and append-only technical logs carry no directly identifying data.

Recipients and processors

We never sell personal data and use no advertising networks. Personal data reaches only the following processors — each bound by an Art. 28 GDPR data processing agreement — and public authorities only where the law requires it:

  • Cloudflare, Inc. (USA) — site hosting, content delivery, and security. Active on every visit.
  • Google Ireland Limited (Ireland), with possible transfer to Google LLC (USA) — web analytics. On by default; stops when you opt out.
  • Neon (serverless Postgres) — the product’s database, storing account data and the content you choose to sync. Active only when you use account features.
  • An EU-resident transactional email provider — account emails such as verification and data-rights responses. Active only when you use account features.
  • Stripe — payment processing for paid tiers and the marketplace. Engaged only at launch; named here for transparency.

International data transfers

We prefer processing in the EU/EEA. Where personal data is transferred to the USA — to Cloudflare (hosting/security) and, after your consent, to Google (analytics) — the transfer rests on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which both providers are certified. Where the framework does not apply to a transfer, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures.

Retention

We keep personal data no longer than the purpose it was collected for requires:

  • Server logs (Cloudflare): a short, rolling security-analysis window, then deleted.
  • Analytics event data (GA4): at most 14 months, then deleted by Google.
  • Consent decision: stored only on your device (scellis-analytics-consent) until you change or delete it.
  • Email correspondence: until the matter is resolved, plus statutory retention periods where applicable.
  • Account data and synced content (product): until you delete the content or your account; statutory retention duties (e.g. invoices, from launch) remain unaffected and are access-restricted rather than erased.

Your rights

Regarding your personal data, you have the following rights against us under the GDPR:

Where processing rests on your consent (analytics), you may withdraw it at any time with effect for the future (Art. 7(3) GDPR); withdrawal is as easy as consenting — use “Cookie settings” in the footer. To exercise any right, email privacy@scellis.com; we answer within one month.

You also have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your workplace, or the place of the alleged infringement.

  • Access (Art. 15) — confirmation whether and which of your data we process, and a copy of it.
  • Rectification (Art. 16) — correction of inaccurate data and completion of incomplete data.
  • Erasure (Art. 17) — deletion of your data where a ground for erasure applies.
  • Restriction of processing (Art. 18) — restriction while a matter is contested.
  • Data portability (Art. 20) — receipt of the data you provided in a structured, commonly used, machine-readable format.
  • Objection (Art. 21) — objection at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f); we then stop unless compelling legitimate grounds prevail.

No automated decision-making; no obligation to provide data

We use no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Providing personal data is neither legally nor contractually required to visit this site. Without the technically necessary connection data (IP address) the site cannot be delivered; everything else — analytics included — is optional.

Changes to this policy

We update this policy when the site or the product changes — for example when accounts, paid tiers, or the marketplace launch. The current version, with its effective date, is always published at this address. Where a change affects consent-based processing, we ask for consent anew.

Effective date and pre-launch status

Effective date: July 3, 2026.

Scellis is pre-launch. This policy accurately describes today’s site and the product’s data architecture; a review by qualified legal counsel will be completed before launch, and any resulting changes will be published here.