Privacy Policy

This policy says which personal data chemXplore processes, why, with whom it is shared, how long it is kept, and what your rights are. It applies to the website, the subscription, the AI connection and the chemXplore Weekly. The use of the Service itself is covered by our Terms of Use.

1. Who is responsible

Darueber B.V., 1e Pauwenlandstraat 12, 7413 ZA Deventer, the Netherlands (Chamber of Commerce 82353735), is the controller for the processing described here. For any question or request about your personal data, write to [email protected].

2. What we process, and why

Accounts

For every User: name, email address, password (stored only as an encrypted hash), the subscription and what it includes, and sign-in data: when you signed in, how often, from which IP address, and failed attempts. We use this to give you access, keep accounts secure and support you. Basis: the agreement with you or your employer, and our legitimate interest in a secure service.

What you keep in the Service

Saved searches, their email alerts, and lists. We use them only to provide these features. Basis: the agreement.

The AI connection

Users can search chemXplore from an AI assistant, such as Claude or ChatGPT, through our MCP server. For every call from an assistant we log the User, the tool, the number of results, the duration, the client and any error, with a digest (a one-way code) of the filters used. We do not store the question asked in the assistant, nor the filters themselves. We use the log to keep the connection working and to see how much it is used. Basis: our legitimate interest in a reliable service.

Payments and invoices

A subscription bought on our website is sold by Paddle, who processes the payment details itself as a separate controller, under Paddle’s privacy policy. We receive the name, email address, company, country and VAT number needed to set up the account. For subscriptions by order form we keep the company details, the contact persons and the invoices. Basis: the agreement, and our legal duty to keep financial records.

The chemXplore Weekly

Your email address, when you signed up and confirmed, and, if it happens, when you unsubscribed or when mail to you could no longer be delivered. Basis: your consent, which you can withdraw at any time through the link in every issue.

Business contacts

When we are in touch with you as a customer, prospect or partner: your name, organisation, role, work contact details, our correspondence and our notes of conversations. We use this to manage the relationship. Basis: our legitimate interest in running our business.

Visits to the public website

On the public website, chemxplore.com, we measure visits with statistics software that runs on our own server: which pages are viewed, searches made on the public site, where a visit came from, and the browser and device type. IP addresses are anonymised, and the data is not shared with anyone else. We use it to improve the site. Basis: our legitimate interest. These statistics are not collected in the subscription at app.chemxplore.com.

Our servers also log requests, including the IP address and the page requested, for security and to find faults.

People named in the Record

The Record is about plants, projects and companies. It may name people in their professional roles, such as an executive quoted in an announcement, as they appear in public sources, with the source. We do this to show who is behind a project or company. Basis: our legitimate interest, and that of our subscribers, in information about the industry. If you are named and object, write to us.

3. What we do not do

• We do not sell personal data or share it for others’ marketing.
• We do not follow what an individual User searches or views in the subscription, or asks through the AI connection.
• We do not make decisions about you by automated means alone.

4. Who processes data for us

We use these providers, each bound by a data processing agreement or equivalent terms:

• Hosting: our servers and database are hosted in the EU (currently by Tilaa B.V., the Netherlands).
• Email delivery: Postmark (United States) sends account mail, alerts and the Weekly.
• Email, calendar and video calls: Google Workspace (Google Meet for calls).
• Payments: Paddle (United Kingdom), as a separate controller (section 2).
• Network and security: all traffic to chemXplore passes through Cloudflare (United States), which protects the site against attacks and delivers it faster. Cloudflare processes IP addresses and requests to do this. Its Turnstile also checks the Weekly signup form for bots, using technical data about your browser.
• Maps: map images are loaded from MapTiler (Switzerland), which receives your IP address when you view a map.
• Fonts: the site’s fonts are loaded from Google Fonts, which receives your IP address.
• Compiling the Record: we process public news and announcements with AI models of external providers (currently OpenAI, Anthropic and xAI, in the United States). These texts may name people, as in section 2. No data about Users or readers is sent to them.

5. Data outside the EU

Some of these providers are outside the European Economic Area. The United Kingdom and Switzerland have an adequacy decision from the European Commission. For providers in the United States, transfers rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

6. How long we keep it

• Accounts and what you keep in the Service: for as long as the account exists. We delete an account on request, and within two years after the last subscription or trial on it ended.
• The AI connection log: for as long as the account exists.
• Invoices and financial records: seven years, as Dutch tax law requires.
• The Weekly: until you unsubscribe. After that we keep only your email address and the date, so that we never mail you again.
• Business contacts: for as long as the relationship is relevant, and no longer than needed.
• Website statistics: the detailed record of each visit is deleted after 13 months; after that we keep only totals, such as visits per page.
• Server logs: for a limited time, for security and to find faults.

7. Cookies

• Sign-in: a session cookie keeps you signed in, and a “remember me” cookie if you choose it. These are needed for the Service.
• Statistics: our statistics set cookies on the public website to recognise a returning visit. They are not shared with others.
• Checkout and security: Paddle and Cloudflare may set cookies needed for payment, for protection against attacks and for the bot check, under their own policies.

We use no advertising or tracking cookies of other parties.

8. Security

All traffic to chemXplore is encrypted (HTTPS). Passwords are stored only as encrypted hashes. Access to personal data is limited to the people who need it for their work.

9. Your rights

Under the GDPR you may ask for access to your personal data, and for it to be corrected, deleted, restricted or handed over to you. You may object to processing based on our legitimate interest, and withdraw consent at any time. Write to [email protected]; we answer within a month. You may also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

10. Changes

We may change this policy, for example when we change providers. The current version is always on this page, with its date.