Privacy Policy

1. Introduction

Discovery Loop, Inc. ("the Company," "we," "us," or "our") operates discoveryioop.dance (the "Service"). Discovery Loop is a research automation platform that closes the experiment cycle for scientific discovery labs. It proposes experiments, parses instrument output, and schedules each next round in an automated loop.

This Privacy Policy describes information collected through the Service, how we use and protect it, and your available choices. It covers visitors, registered researchers, and lab team members using the platform.

Our address is 2150 Shattuck Avenue, Suite 400, Berkeley, CA 94704. Contact us at [email protected].

2. Information We Collect

2.1 Information You Provide

We receive information you submit, including:

• Account details: name, institutional affiliation, role, and email address;
• Scientific submissions: instrument output files, including HPLC .asc/.dat, plate-reader CSV exports, JSON API responses from lab systems, experiment parameter configurations, and hypothesis queue inputs;
• Contact forms, early-access requests, and support inquiries, including message content;
• API credentials and endpoint settings used to connect a laboratory instrument or simulation layer.

We process submitted scientific data and instrument output only to provide the research loop. We will not use submitted experimental data, hypothesis sets, or instrument files to train or fine-tune machine-learning models without your explicit written consent.

2.2 Automatically Collected Information

Visits to discoveryioop.dance generate limited technical information, such as:

• IP address and approximate city and region;
• Browser, operating system, and device type;
• Visited pages, referring URLs, and time spent;
• Platform telemetry, including activated loop stages, experiment cycles started, and API call patterns, to improve reliability and find errors rather than profile researchers;
• Cookies and similar identifiers; see Section 5.

2.3 Children's Data

discoveryioop.dance is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child submitted information, email [email protected] and we will promptly delete it.

3. How We Use Information

We use collected information to:

• Run the research loop: parse and normalize instrument output, rank experiment proposals, queue experiments for an instrument or simulation layer, and return results to the loop;
• Run, maintain, and improve the platform, including debugging data ingestion and refining the hypothesis engine;
• Answer support requests and contact-form messages;
• Send service notices and, where consent is required, feature updates;
• Find, investigate, and prevent abuse or unauthorized access;
• Meet legal obligations.

We do not sell personal information for money. If state law treats an advertising arrangement as a "sale" or "share," consult the applicable state section below.

4. Sharing of Information

We share personal information only with:

• Service providers for cloud infrastructure, transactional email, or anonymized usage analytics, under written contracts limiting use to the shared purpose;
• Legal authorities when required by law or court order, or to protect Company or other rights, safety, or property;
• A successor entity in a merger, acquisition, or asset sale, subject to this Policy's commitments.

We do not sell personal information or submitted research data to third parties.

5. Cookies and Tracking

We use cookies and similar technologies to manage lab sessions, protect against CSRF attacks, and measure anonymous usage. See our Cookie Policy for details and choices.

6. Data Retention

Active account data and associated research data remain stored while the account is active, plus a 90-day termination grace period for exporting experiment history. After that period, account data and uploaded instrument files are permanently deleted. We purge inactive early-access contacts after 24 months. Server logs remain for 90 days, then become aggregated counts.

7. Security

Our safeguards include TLS encryption in transit, restricted-access databases, least-privilege controls for platform engineers, and rotation of API tokens used for instrument connections. Protect your API credentials and recognize that no system can be guaranteed completely secure.

8. Your General Rights

Your jurisdiction may provide rights to access, correct, or delete personal information, and to limit some processing. Send requests to [email protected]. We will reply within the period required by applicable law.

9. California Residents (CCPA / CPRA)

The California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA") give California residents rights concerning their personal information. This section adds to the rest of this Policy.

9.1 Categories We Collect

In the past 12 months, we collected these categories under Cal. Civ. Code §1798.140: identifiers (name, institutional email, IP address); professional or employment-related information (institutional affiliation and role); commercial information (service inquiries and subscription tier); internet activity (browsing on discoveryioop.dance and platform telemetry); and inferences from these for platform improvement. We do not systematically collect sensitive personal information under Cal. Civ. Code §1798.140(ae).

9.2 Sources, Purposes, Disclosure

We get this information from you through registration, instrument-data uploads, and contact forms, and automatically through site instrumentation. We use it to operate and improve the research loop, communicate with you, and meet legal obligations. We disclose it only to contracted service providers and legally required authorities.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not use sensitive personal information for purposes beyond those permitted without authorization.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may revise this Policy. Material changes will receive a new "Last updated" date and, when appropriate, notice on the Service or by email to registered account holders.

11. Contact

Send Privacy Policy questions, requests, or complaints to: