← Back to SurfFitter

Privacy Policy

Last updated: March 26, 2026

This Privacy Policy explains how SurfFitter handles your personal and scientific data in compliance with the General Data Protection Regulation (GDPR) and Artificial Intelligence data protection protocols.

1. Data Controller

The data controller is the SIMBIOS research group at CiQUS, Universidade de Santiago de Compostela. For any privacy inquiries, contact us at: surffitterprism@gmail.com.

2. Legal Basis for Processing

We process your data under the following legal bases:

Performance of a Contract: To provide account services and analysis tools (Art. 6(1)(b) GDPR).
Consent: For using anonymized data in AI model training and for non-essential cookies (Art. 6(1)(a) GDPR).
Legitimate Interests: For site security and performance monitoring.

3. Data We Collect

Account Data: Name, Institution, and Email address provided during registration.
Scientific Data: Isotherm files (CSV/TXT) and metadata uploaded for thermodynamic analysis.
Usage Data: We use Google Analytics (G-M98BW7QQ09) to collect anonymized information about how visitors use our site to improve performance and user experience.

4. Protection of Unpublished Data

We prioritize the confidentiality of unpublished research. For guest users, raw files and reports are deleted after the session expires. For registered users, data is stored securely until deleted by the user or upon account termination.

5. AI Training and Anonymization

We use numeric isotherm data to improve our PRISM fitting models via Artificial Intelligence. This only occurs with your explicit, opt-in consent. Our Anonymization Protocol ensures that numeric curves are completely detached from any personal identifiers or metadata before being used for training.

6. Third-Party Integrations (Zenodo)

SurfFitter facilitates data archiving via Zenodo. By using this optional feature, you acknowledge that:

We collect and store your Zenodo Personal Access Token securely using encryption in our database.
SurfFitter will only create a draft deposition on your behalf. We do not automatically publish any records; final publication must be manually initiated by the user directly on the Zenodo platform.
Data transferred to Zenodo is governed by their independent Privacy Policy and Terms of Use once it leaves our servers.

7. Your Rights

Under the GDPR, you have the right to:

Access, rectify, or erase your personal data.
Restrict or object to processing.
Data portability (receive your data in a structured format).
Withdraw consent at any time (e.g., for AI training).

To exercise these rights, please contact us. Note that truly anonymized data used in AI weights cannot be individually deleted as it is no longer identifiable.