Privacy Policy

1. Introduction

Welcome to Colony.care ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our laboratory animal management platform.

By using Colony.care, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us, including:

• Email address (for account creation and communication)
• Password (encrypted and hashed with bcrypt)
• Name and organization information (optional, for team collaboration)
• Profile preferences and settings

Important: We do NOT store credit card information. All payment processing is handled securely by Stripe, our payment processor.

2.2 Research Data

When you use our platform, we store the following data you create:

• Animal colony records (species, strains, breeding information, cage assignments)
• Project and team information
• Cage and facility organization data
• Files and documents you upload (stored securely via Vercel Blob)
• Activity logs and audit trails for compliance

All research data belongs to you and your organization. We act only as a secure data processor.

2.3 Technical Information

We automatically collect minimal technical information to provide and improve our service:

• Session data (for authentication via NextAuth.js)
• IP address (for security and rate limiting)
• Browser type and operating system (for compatibility)
• Error logs (for debugging and service improvement)

We use Plausible Analytics for cookieless, aggregate website analytics, Vercel Analytics for basic performance metrics, and Sentry for error monitoring. None of these set cookies or track you across sites, and no personal research data is sent to them.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process your transactions and manage your account
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze usage patterns and trends
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our terms

4. Data Security

We implement industry-standard security measures to protect your data:

• Password Security: All passwords are hashed using bcrypt (10 rounds) - we never store plain-text passwords
• Encryption in Transit: All data transmitted between your browser and our servers uses HTTPS/TLS encryption
• Database Security: MongoDB Atlas with TLS 1.2+ encryption and IP whitelisting
• Session Management: Secure JWT tokens with HTTP-only cookies (30-day expiration)
• File Storage: Files stored securely via Vercel Blob with access controls
• Payment Security: PCI-compliant payment processing via Stripe (we never handle credit card data)
• Rate Limiting: Protection against brute force attacks via Upstash Redis
• 2FA Support: Optional two-factor authentication with TOTP

While we implement strong security measures, no system is 100% secure. We continuously monitor and update our security practices.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• With your team members: Data you enter is shared with authorized members of your research team based on role-based permissions
• Service providers we use:
  • Vercel (hosting and infrastructure)
  • MongoDB Atlas (database)
  • Stripe (payment processing - they handle all payment data)
  • Resend (transactional emails)
  • Vercel Blob (file storage)
  • Upstash Redis (rate limiting)
  • Sentry (error monitoring - no personal data sent)
• Legal requirements: When required by law or to protect our rights and safety
• Business transfers: In connection with a merger, acquisition, or sale of assets (with notice)

We do NOT: Sell your data, share it with advertisers, or use it for any purpose other than providing our service.

6. Data Retention

We retain your information for as long as necessary to provide our services and fulfill the purposes outlined in this policy. When you delete your account, we will delete or anonymize your personal information, unless we are required to retain it for legal or regulatory purposes.

Research data may be retained according to your organization's data retention policies and applicable regulations.

7. Your Rights

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to certain processing of your information
• Withdrawal: Withdraw consent where processing is based on consent

To exercise these rights, please contact us using the information provided below.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure that appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable data protection laws.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: