Privacy notice

1. Who is responsible and how to contact us

The publicly verified operator contact is BIOSPHERE ROCKS, 60 rue François Ier, 75008 Paris, France. Privacy and data-rights requests may be sent to bios@biosphere.rocks.

Depending on the service and contract, Biosphere Rocks may act as controller or processor. Organizational clients remain responsible for the personal data they instruct Biosphere Rocks to process in their Workspace.

2. Data we may process

• Identity, contact, account, organization, Workspace, role and permission information.
• Content, documents, prompts, AI outputs, decisions, evidence, project and operational records supplied by authorized users.
• Technical data such as IP address, device/browser information, timestamps, security and service logs.
• Commercial, billing and transaction references when a paid service or authorized contribution is used. Payment-card data is handled by the relevant payment provider, not stored by this public website.
• Support, contact, Operational Preview and other communications voluntarily submitted to us.

3. Purposes and legal bases

We process data only where a purpose and legal basis apply: providing or preparing a requested service or contract; complying with legal obligations; protecting services, users and records; pursuing legitimate interests such as support and service improvement where those interests are not overridden; or acting on consent where consent is required.

AI prompts and organizational records are processed only within the enabled service and authority context. Users should not provide unnecessary sensitive data. AI output requires human review and is not automatically a verified fact or professional advice.

4. Recipients, providers and transfers

Current configured infrastructure includes Vercel for public application hosting and Supabase for database, authentication and storage services. The main Biosphere production project is hosted in Supabase's Paris region and BioTrace in its Frankfurt region. Provider support, telemetry, content delivery and subprocessors may nevertheless involve processing outside those primary regions; this notice does not claim that all Biosphere data stays exclusively in France or Germany.

Managed cloud AI uses OpenAI models through Vercel AI Gateway when that entitled capability is enabled. Ollama is an optional local execution mode and does not transmit prompts to a cloud AI provider when it is used exclusively on local infrastructure. DeepSeek is planned for selected future services or users but is not represented as an active processor; its processing terms and international-transfer safeguards must be reviewed before activation. Stripe may support legitimate subscription or credit services under their applicable terms. Public Initiative and crowdfunding contributions are disabled and cannot initiate a project charge.

Vercel, Supabase and OpenAI publish data-processing terms that include transfer mechanisms for applicable international processing. The applicable agreement, provider configuration and supplementary safeguards must still be confirmed before regulated or sensitive deployment. This notice does not claim that every optional provider or customer configuration is suitable for every regulated dataset.

5. Retention, security and immutable references

Accounts and Workspaces are kept while necessary to provide the service, subject to valid deletion requests and legal exceptions. AI conversations are kept only as necessary for the service and documented purposes. Payment and accounting records are kept as required by applicable fiscal and accounting obligations. Operational Evidence is kept according to contractual, legal and traceability requirements. Retention is purpose-based; this notice does not invent universal periods or claim automatic deletion.

Access controls, Workspace authority, confirmation flows and technical logging may protect current services. No absolute security guarantee is made. Integrity references or hashes may be technically irreversible; they should not contain personal data and deleting a source record may not remove a non-identifying integrity reference.

6. Your rights and account requests

Subject to applicable law, individuals may request access, rectification, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing. Requests can be sent to bios@biosphere.rocks with enough information to identify the relevant account or Workspace. Identity and authority may need to be verified before action is taken.

There is currently no universal self-service deletion workflow across all Biosphere services. Requests are handled through the verified contact and may be limited by legal obligations, security records, organizational-controller instructions, backups and technically irreversible non-personal integrity references. Individuals may also lodge a complaint with the competent supervisory authority, including the CNIL in France.

7. Children, marketing and changes

Biosphere Rocks is intended for professional and organizational use and is not directed to children. A minor must not create or use an account unless permitted by applicable law and appropriately authorized by a parent, guardian or responsible organization.

Marketing messages must provide an unsubscribe method where required. Service and security communications may still be necessary. Material changes to this notice will be dated and published here.