Privacy notice

Who is responsible

Indaga is a product of CryptoSvit (Ruslan Plakhuta, eenmanszaak, KVK 89565568), Soesterberghof 102, 2631 LH Nootdorp, Netherlands. CryptoSvit decides how your data is used and is responsible for it. Write to support@indaga.ai about anything on this page. We have not appointed a data protection officer.

What we collect

• Your account. When you sign in with Google, or with a one-time code we email you, we keep your email address and account IDs, nothing else from Google.
• Your DNA file and what we build from it. The raw data file you upload (23andMe, AncestryDNA, MyHeritage or FamilyTreeDNA), the genotypes read from it, and your report.
• Health data from our iOS app, only if you use it and allow it: the Apple Health readings you choose to share, and notes you type.
• Payment records. Stripe takes your payment on its own page. We receive whether you paid, the amount and the date, never your card number.
• The kit and the whole-genome report: your name, email and country, and the account you order from; for a kit, your shipping address when it’s ready to post, which never goes to the laboratory.
• Withdrawals. If you withdraw from an order with the button on your dashboard, the statement you send: which order, the name you give (if any) and the address for the confirmation.
• What you write to us at support@indaga.ai.
• Technical logs. Our server logs requests, including IP addresses, to keep the service working and secure. The app sets only the cookies it needs: to sign you in and keep you signed in, and to remember one choice you make (the report's light or dark look). If you said OK to ads on indaga.ai, or we did not ask first and you did not switch the Meta Pixel off, the app also sets a two-minute cookie when you create your account, which tells our welcome page that an account was just created; it holds no id. It sets another two-minute cookie when you pay for an order, which tells our thank-you page the amount, the currency and which page to send you back to; it holds no id either. The app records which campaign brought you with your account and your order, in our own records only; it never goes to an ad platform. It reads this from the link you arrived by, or from our sites' campaign cookie, where it is set. The app has no advertising or analytics trackers.

Why, and on what legal basis

• Your DNA and health data are used only to build your report and show your readings, and, if you separately choose Connect, to answer your questions in your chosen AI service. This is on the basis of your explicit consent (GDPR Art. 9(2)(a)). You give it with the box on the upload page, and you can withdraw it at any time. Connecting through OAuth asks for a separate affirmative consent to the named client and data transfer.
• Your account and emails are used to provide the service you asked for (Art. 6(1)(b)), for example to tell you when your report is ready.
• Payment records are kept because Dutch tax law requires it (Art. 6(1)(c)).
• Technical logs are kept to protect the service (Art. 6(1)(f), our legitimate interest in its security).

Your report is produced by software. It makes no decision about you with legal or similarly significant effects, and it is wellness information, not medical advice.

Where it is kept, and how

On our dedicated server in the Netherlands (EU), rented from Worldstream, and, for raw sequencing files (FASTQ, BAM, CRAM), in our object storage in the same place, encrypted. Everything personal on the server sits on an encrypted disk, and our backups are encrypted before they leave the server. The disk is unlocked while the server runs, so the encryption protects a removed drive or a switched-off server, not a break-in to the running server. There is no separate key for each person.

Who else handles it

• Worldstream (Netherlands) hosts our server and our backups.
• Cloudflare runs the network in front of our server. Your upload and your report cross it on their way between your browser and our server; Cloudflare does not store them.
• Google handles sign-in. Stripe takes payment. Resend sends our emails, which never carry any genetic information. Your DNA data never reaches these three.

Your genetic data is stored and analysed only on our server in the Netherlands, and it is not sent to any outside database or service to make your report. If you choose to connect an AI assistant, it sees what it reads, under its provider's terms, and most providers process data outside the EU.

Cloudflare, Google, Stripe and Resend are US companies. Where they handle personal data in the US, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses in our agreements with them.

Optional: connect your own AI

If you choose Connect, the AI service or client you select can read parts of your Indaga record, including genetic results, health readings, labs and notes, to answer your questions. It can also add or update the records that the connection permits when you ask it to. The permissions are shown when you connect; the Connect guide explains them. This is optional and separate from processing your report.

For an OAuth connection, the approval page names the client, explains the transfer and asks you to check a consent box before approving. Your sign-up or upload consent does not cover this separate transfer.

A hosted AI provider handles the data it receives under its own terms and privacy policy. It decides how the data is used and stored, how long it is retained, and whether it is used to improve its services. Processing may take place outside the EU, including in the United States. Check that provider's terms and settings before connecting; Indaga cannot control or undo its handling of copies it has received. If you use software you run yourself, its configuration determines where data goes.

You can revoke a connection in Connect settings to stop its future access without affecting your other connections. Revocation or deletion in Indaga does not delete data already held by your AI provider; use that provider's controls or contact it about those copies. For help, contact Indaga support.

What we never do

Your personal data is never sold. Your DNA and health data are never shared for advertising. Your DNA data is never used for research. It never goes to an employer, an insurer or anyone who advises them. It goes to police or other authorities only with a warrant or court order, and we tell you unless we are forbidden to. We will not use data we already hold in a new way without asking you first.

If the business behind Indaga is ever sold, merged or closed, your DNA data will not pass to anyone else without your explicit consent. Without that consent, we delete it.

How long we keep it

• Your DNA file, what we build from it and your account: until you ask us to delete them. We keep the file so your report can be rebuilt when our methods improve. If you send a new DNA file, the earlier one, and anything built only from it, is deleted within 30 days of your new report being ready. Your report, including a full report you bought, is rebuilt from the new file.
• A whole-genome file you upload but don’t pay for is deleted 30 days after the upload, with what we read from its header.
• Backups: a deleted file stays in our encrypted backups for up to about 8 weeks, then expires.
• Payment records and withdrawal statements: 7 years, as Dutch tax law requires. They hold no genetic information.
• Server logs: 30 days.
• Sign-in codes: a record of each request for a code (the address, the time and a scrambled form of your network address) is kept for one day, to stop abuse, and stays in our encrypted backups for up to about 8 weeks. The code itself is never stored in a readable form.
• Emails to support: as long as we need them to help you.

What you can ask of us

Wherever you live, you can ask us to show you the data we hold about you and who else has handled it, to correct it, to give you a copy, to stop using it, or to delete it. You can also withdraw your consent at any time; that does not undo what was done with it before. To withdraw and have your DNA data deleted, use the button on your dashboard or email support@indaga.ai from the address you sign in with; for anything else, email. We stop using your DNA data within 15 days of a withdrawal (straight away with the button) and delete it within 30, and we answer every other request within 30 days.

If we turn a request down, reply with the word “appeal” and we will look at it again and answer within 45 days. You can also complain to the Dutch data protection authority (the Autoriteit Persoonsgegevens) or to the authority where you live. In the US, you can complain to your state's Attorney General.

A few specific rules

• Age. Indaga is for adults. Don't upload a file if you are under 18, or a file that isn't yours unless you are legally allowed to share it.
• Consumer health data. What Washington, Nevada and Connecticut law call consumer health data, and how we handle it, is on our consumer health data policy.
• Florida. We received your DNA data from you. We give the results to your doctor if you ask us to, and we never use them for insurance, employment or credit decisions.

Our websites: indaga.ai and go.indaga.ai

This part is about visiting our websites. It is not about your account or your DNA file; those are covered above.

Counting visits (no cookies). We count how our pages are used. Our website host, Vercel, records each page view. It also records moments on the page, such as:

• a step of our questions shown;
• a stop screen reached;
• a buy button pressed;
• the plan screen shown;
• a question sent to the sample chat.

It records the moment itself, never what you typed or chose. With it, Vercel records:

• the page, without anything after “?” in the address, so your answers in our questions never leave the page;
• the site that sent you;
• your country, region and city;
• your browser, operating system and type of device;
• the ad or link labels in the address (such as utm_source=google), if there are any.

Vercel works out the country, region and city from your IP address. It counts visitors with a code made from the request that it throws away after 24 hours.

• No cookies are set.
• We see only totals, never a profile of you. We do not use this for ads.
• We do this because we have a legitimate interest in knowing which pages work (GDPR art. 6(1)(f)).
• On our plan Vercel keeps these reports for 24 months, and may keep them longer.
• Vercel, Inc. (USA) is our host and does this for us under its data processing agreement. Our transfer safeguards are the EU standard contractual clauses in that agreement, and the EU–U.S. Data Privacy Framework, under which Vercel is certified.
• You can switch this off for your browser with “Privacy choices” at the bottom of every page, or block the script. The site works the same.

With your OK, or until you say no. In the European Union, Iceland, Liechtenstein, Norway, the United Kingdom and Switzerland, and in the US states of Washington and Nevada, we use the tools below only after you press OK on a bar that names the ones in use. The bar appears only when at least one is in use. If you press “No thanks”, or do nothing, none of them loads. Everywhere else we do not ask first about the Meta Pixel: it is on unless you switch it off in “Privacy choices”, or your browser sends a Global Privacy Control signal. For this we work out your country and state from your IP address; we do not store them. If we cannot tell where you are, we ask first. Your choice is remembered in your browser, and you can change it at any time with “Privacy choices”. None of them receives your DNA data, anything you upload, or which gene pages you read.

• Google Analytics (Google): which pages and buttons are used.
  • Cookies: _ga and _ga_… (2 years).
  • The page address goes without anything after “?” and without a gene's name.
  • Google does not store your IP address.
  • We keep the data for 2 months.
  • Google acts for us under its data processing terms. Safeguards: the EU standard contractual clauses in those terms, and the EU–U.S. Data Privacy Framework, under which Google is certified.
• Meta Pixel (Meta): measures our ads on Facebook and Instagram.
  • It gets page views (the page's address, without the labels), never from a page whose address carries your answers or names a gene, and one signal when you create an Indaga account. That signal says only that an account was created; it carries no name, email or DNA data. After you pay for an order, it also gets one signal from our website with the amount and the currency only; the amount can show which of our products you bought, and the signal carries no order number, name or email.
  • Cookies: _fbp, and _fbc if you came from a Meta ad (both about 90 days).
  • Meta and we are joint controllers for collecting these data and sending them to Meta, under Meta's Controller Addendum.
  • Meta then also uses them for its own purposes under its own privacy policy (facebook.com/privacy/policy).
  • We do not use it to show our ads to people who visited our site.
  • Safeguard: the EU–U.S. Data Privacy Framework, under which Meta is certified.
• PostHog (EU cloud, Frankfurt): how pages are used, and heatmaps.
  • With your OK it may also make a recording of how you move through a page.
  • Everything you type is masked, our question screens are never recorded, and recording pauses on gene pages.
  • You get an anonymous ID, never a profile.
  • Cookie: ph_…_posthog (1 year), plus the same in your browser's storage.
  • We keep events for no more than one year and recordings for 30 days.
  • Safeguards, for anything processed outside the EU: the EU standard contractual clauses in PostHog's data processing agreement, and the EU–U.S. Data Privacy Framework, under which PostHog is certified.
• Our campaign cookie, indaga_utm (ours; set after your OK, or, where we do not ask first, unless you switched the Meta Pixel off): it remembers the labels of the ad or link that brought you, such as utm_source=google.
  • It is set for all of indaga.ai and lasts 30 days.
  • When you create your account or start checkout, our app stores those labels with your account or order in our own database, so we can count sign-ups and sales per campaign.
  • They are kept with that record.
  • Labels that arrive in the link itself are stored the same way; for those we rely on our legitimate interest in knowing which campaigns work, and you can object at support@indaga.ai.
  • They are never sent to Stripe or to an ad platform.
  • They are blanked if you ask us to delete your data.

For these, where we ask first, we rely on your consent (GDPR art. 6(1)(a)). Taking it back does not affect what happened before.

Your rights. You can ask for access, correction, deletion, restriction or a copy of your data, and you can object. Email support@indaga.ai. You can also complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Who we are. CryptoSvit (Ruslan Plakhuta, eenmanszaak), KVK 89565568, VAT NL004741679B15, support@indaga.ai. Our full details are at the top of this notice.

Changes

When this notice changes, the new version appears here with its date. A change never lets us use data we already hold in a new way without asking you first.