Privacy policy

ToxAgent is operated by {{Company legal name}}, {{Registered address}}, registration number {{Company registration number}} (“ToxAgent”, “we”, “us”). We are the controller of the personal data described in this policy, except where section 4 says we act as a processor for our customers.

For any privacy question or request, write to contact@toxagent.com.

This policy applies to toxagent.com, the ToxAgent application and the pilot reviews we run for customers (together, the “Service”). It does not cover websites we link to, such as journal pages reached through a DOI.

Website visits. We use Vercel Analytics to count page views and see which pages are read. It does not set cookies and reports aggregated figures, such as page, referrer, country and device type, without building a profile of you. Our hosting provider also processes your IP address in server logs to deliver the site and protect it from abuse. Legal basis: our legitimate interest in running and improving a secure website (Art. 6(1)(f) GDPR).

Pilot requests and correspondence. When you request a pilot through our form or write to us, we receive your name, email address, organisation, role and whatever you choose to tell us. We use it to answer you and to set up the pilot. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in answering business enquiries (Art. 6(1)(f)).

Accounts. If you are given an account, we store your email address, a user ID, your display name, organisation and settings. Legal basis: performance of our contract with you or your employer (Art. 6(1)(b)).

Study documents and review data. When you upload a study PDF, it is checked, processed in memory and sent to our AI model provider to draft an assessment. The PDF itself is not stored. If you save a study, we store its scores, your notes and the short quotes you applied, but not the PDF. Protocols, screening decisions, sign offs and reports you create are stored as part of your review. Legal basis: performance of the contract (Art. 6(1)(b)).

Security and usage records. We keep a usage counter per account and audit records of who did what and when, such as each sign off with name, time and what was approved. Audit records do not contain document content. Legal basis: our legitimate interest in securing the Service, enforcing fair use and keeping an accountable record of review decisions (Art. 6(1)(f)), and, where your regulatory work requires such a record, compliance with legal obligations (Art. 6(1)(c)).

We do not sell personal data, use it for advertising or make decisions about you based solely on automated processing that have legal or similarly significant effects. AI output in the Service is a draft that a named human reviewer checks and signs.

Study documents, protocols and review data that customers bring to the Service may contain personal data, such as author names in published papers. For that content we act as a processor on behalf of the customer, who remains the controller. We process it only to provide the Service and under a data processing agreement with the customer, available on request.

We do not use customer content to train AI models.

We use these service providers, each bound by a data processing agreement:

• Google Cloud and Firebase (Google Ireland Ltd): authentication, database and processing in the EU region europe-west1, and the Vertex AI model that drafts assessments, called in the EU.
• Google Forms (Google Ireland Ltd): pilot request form.
• Vercel (Vercel Inc.): website hosting and privacy friendly analytics.
• Google Workspace (Google Ireland Ltd): Gmail, for correspondence.

We may also disclose data where the law requires it, or to a successor if our business is sold or merged, in which case this policy continues to apply.

We store and process Service data in the EU. Some providers, such as Vercel and Google, are part of groups based in the United States and may access data from there. Such transfers rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses with additional safeguards.

• Study PDFs: not stored; held in memory only while a draft is made.
• Saved studies, profile and account data: until you delete them or your account is closed.
• Usage counters: 90 days.
• Audit records: 12 months, and kept after account deletion for that period because they show who approved what.
• Pilot requests and correspondence: up to 24 months after our last contact, unless they become part of a contract.
• Server logs at our hosting provider: as set by that provider, typically a few days.

Under the GDPR you can ask us for access to your personal data, correction, deletion, restriction of processing and a copy in a portable format. You can object at any time to processing based on our legitimate interests. Where we rely on consent, you can withdraw it without affecting earlier processing.

Write to contact@toxagent.com. We answer within one month and may ask you to confirm your identity. If your data is customer content (section 4), we pass your request to the customer and help them answer it.

You also have the right to complain to a data protection authority, in particular in the EU country where you live or work. Our lead authority is {{Lead supervisory authority}}.

Data is encrypted in transit and at rest. Access to the Service requires sign in and an app verification check; each account can read only its own data. Uploaded PDFs are checked and cleaned in an isolated sandbox before processing, and every quote the AI returns is checked against the document text. No system is perfectly secure, and we will notify you and the authorities of a breach where the law requires it.

The website sets no tracking or advertising cookies. If you sign in to the application, it stores what it needs to keep you signed in, which is strictly necessary and does not require consent.

The Service is for professionals and is not directed at anyone under 16. We do not knowingly collect data from children.

We may update this policy as the Service changes. The date at the top shows the latest version. We will tell account holders by email before a change that materially affects how we use their data.