Privacy policy
Privacy and data handling
QuestOmics is built for scientific work that requires strong data stewardship, clear operational boundaries, and predictable handling of uploaded sequencing data. This policy explains what we collect, why, and what we will never do with it.
Last updated: July 2026
Who we are
QuestOmics is operated by Sandro Valenzuela as a sole proprietorship (eenmanszaak) established in the Netherlands and registered with the Dutch Chamber of Commerce. You can reach us about any privacy matter at svalenzuela@questomics.app.
Under the General Data Protection Regulation we hold two different roles. We are the controller of your account details, your billing records, and the operational logs we keep to run the platform. We are a processor of the sequencing files, sample metadata and analysis results you upload or generate, which describe your study and its participants: you or your institution decide what to study and who to study, and we act on your instructions. Those instructions are set out in our data processing agreement.
Information we collect
- Account information: your name, email address, and institution, used to create and secure your account.
- Uploaded data: the sequencing files you choose to upload (FASTQ reads, assembled FASTA, and MAG files) and the analysis results generated from them.
- Operational data: basic usage and diagnostic information needed to run analyses, monitor jobs, and keep the platform reliable.
- Consent record: when you create an account we store which version of these Terms and this Privacy Policy you accepted, the time of acceptance, and the IP address and browser used, so we can show what was agreed and when.
How we use your data
We use your data only to operate the service you asked for: running the analyses you configure, generating interpretable results and reports, maintaining your workspace, and providing support. We do not use your personal information for our own benefit. We do not profile you, we do not sell your data, we do not use it for advertising, and we do not share it with third parties for their own purposes.
We do not use your data for external research
Your uploaded sequencing data and analysis results are processed solely to deliver the outputs you request. They are never used for external research, never pooled into external datasets, never sold, and never used to train external models. Your data belongs to you and your study, not to us.
Legal basis for processing
Under the GDPR we rely on the following bases. We process your account and uploaded data to perform the contract you enter into when you use the service. We rely on your consent for anything optional, which you can withdraw at any time. We rely on our legitimate interest to keep the platform secure, prevent abuse, and maintain reliable operations, and we process billing data to meet our legal and tax obligations.
Where your data is stored and how we protect it
Your uploaded files and results are stored with our cloud provider in Sweden, and analyses run on dedicated servers in Germany. Both are inside the European Economic Area, so your sequencing data does not leave it. Access is restricted to the systems and personnel required to operate the platform. Data is encrypted in transit and at rest, account passwords are stored only as salted scrypt hashes (never in plain text), and access follows least-privilege principles. We maintain a breach-response process: if a security incident affects your personal data, we will act to contain it and notify affected users and the relevant authority as required by law.
Our security page describes these measures in the detail a research office or security reviewer needs.
Data retention and deletion
You stay in control of your data. You can delete individual files, projects, and analysis results from your workspace at any time. When you delete your account from Settings, we permanently erase the projects, files, and analysis outputs associated with it, including the underlying objects in our storage. A minimal set of records is kept only where the law requires it, such as the consent record (with your identity removed) and any invoices needed for tax and accounting.
Your rights
Under the GDPR you have the right to access, correct, export, and delete your data, to restrict or object to certain processing, and to withdraw consent. You can exercise most of these directly in your workspace, including deleting your account. For anything else, or to raise a concern, contact us at svalenzuela@questomics.app. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Service providers
We rely on a limited set of providers strictly to operate the service: EU-based cloud and object storage, the compute servers that run the analyses, a payment processor for billing, and an email provider for account messages. They process data only on our instructions and are bound by confidentiality. They are never permitted to use your data for their own purposes. Every one of them is named on our subprocessors page, along with what it can see and where it operates.
One case deserves calling out. When you ask for a written interpretation of a result, we send the result table as text, the group labels, and the study context you set on the project to Mistral, in France, to write it. When you use the Gut Assistant, your question and the literature passages matched to it are sent to Groq, in the United States, under Standard Contractual Clauses, to compose the answer. Your raw sequencing files are never sent in either case, and both providers are named on our subprocessors page. If you would prefer that no result content leaves our infrastructure, contact us before you upload and we will tell you which analyses can run without this step.
Changes and contact
We may update this policy as the platform evolves; material changes will be reflected here with an updated date. For any privacy question, or to request assistance with your data, contact us at svalenzuela@questomics.app or through the support options available in your QuestOmics workspace.