Privacy policy

As of October 2026. The German version is binding.

1. Controller

Christoph Müller
Marienstraße 30
63069 Offenbach am Main
Email: hello@ivive.app

2. In short

ivive.app uses no analytics or tracking tools, shows no advertising and sets no cookies. Structures and inputs you calculate with are processed in memory only and not stored.

3. Visiting the website

This website and the application at app.ivive.app are served by Vercel Inc. (USA). When you visit, Vercel processes technically necessary data such as IP address, date and time, the address requested and the browser identifier in server log files, to deliver the pages and keep the service secure. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is secure operation. Retention follows the provider's terms.

4. Calculations

Calculations run on a server of netcup GmbH (Karlsruhe, Germany) in a data centre in Nuremberg. Inputs and structures are processed in memory for the duration of the request and not stored. The exceptions are what you explicitly save with an account: a lab correction with the compounds you entered, and uploaded IVIVC datasets (the file, compound name, formulation and source) with the models fitted from them. Both are visible only to you and kept until you delete them or your account. The server logs requests technically with IP address, time and the path requested, without input values; these logs are deleted after 14 days at the latest. The legal basis is Art. 6(1)(b) and (f) GDPR.

5. Request limits

To prevent abuse, the number of requests is limited per IP address or, for signed-in users, per credential. For this the IP address is held in memory for at most 24 hours and not stored permanently. The legal basis is Art. 6(1)(f) GDPR.

6. Accounts

For a voluntary account, your email address, a hash of your password (not the password itself), your plan and the time of registration are stored in a database of Databricks, Inc. (USA), the parent company of Neon, LLC, in Frankfurt am Main. The legal basis is Art. 6(1)(b) GDPR. The account is kept until you delete it under Settings, which takes effect at once, or ask for its deletion by email, which is done within one month. Either way everything saved under it is deleted with it. The database provider's restore history keeps a copy until its window passes, at most 30 days.

7. API keys

If you create an API key, a hash of the key, its name and the times it was created and last used are stored. For each request made with a key, the endpoint, method, status code and duration are logged, to understand usage and detect abuse. These usage records are deleted after 90 days; the key itself is kept until you revoke it or delete your account. The legal basis is Art. 6(1)(b) and (f) GDPR.

8. Storage in your browser

When you sign in, the application stores a sign-in token in your browser's local storage. It is technically necessary for signing in (§ 25(2) no. 2 TDDDG) and removed when you sign out.

9. Contact by email

Email to hello@ivive.app is forwarded to me by Cloudflare, Inc. (USA), which also provides this domain's name resolution (DNS). I process your message to answer it and delete it once the matter is settled, unless retention is required by law. The legal basis is Art. 6(1)(b) or (f) GDPR.

10. Use through AI assistants

If you use ivive.app through an AI assistant (for example over the MCP protocol), that assistant's provider processes your inputs under its own responsibility and terms. I have no influence on that.

11. Transfers outside the EU

Vercel, Databricks (Neon) and Cloudflare are based in the USA. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and otherwise on standard contractual clauses (Art. 46(2)(c) GDPR). Data processing agreements under Art. 28 GDPR are in place with the providers, netcup included.

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21 GDPR). You may complain to a data protection supervisory authority (Art. 77 GDPR), for example the Hessian Commissioner for Data Protection and Freedom of Information. Write to hello@ivive.app.