Privacy policy
The short version: the installed build runs on your machine and sends us nothing. What we hold is what you give us — an email address if you ask for access, and a licence record if you buy. This policy sets that out in the form the GDPR requires.
Discovera S.r.l. · Via IV Novembre 24, 37126 Verona (VR), Italy · a spin-off of the University of Verona · info@discoverapharma.com · discovera@pec.it (PEC)
Registro Imprese di Verona / C.F. 05103200233 · P.IVA 05103200233 · REA VR-470689 · capitale sociale €20.000,00 i.v.
1Who is responsible
1.1Discovera S.r.l., Verona, Italy, is the data controller for the processing described here. You can reach us at info@discoverapharma.com.
1.2We have not appointed a Data Protection Officer. Our processing does not meet the thresholds in Article 37 GDPR; if that changes we will appoint one and say so here.
2What the software does not do
This section is stated first because it is the substance of the policy rather than an aside. DiscoveraVS, installed on your machine:
- transmits no compound, structure, target or result to us or to anyone else;
- contains no telemetry, no analytics and no crash reporting;
- performs no licence check-in — activation writes a local file and reading it is a local read;
- performs no update check;
- loads no third-party scripts, fonts or assets — the entire interface is served from your own disk.
The only outbound requests it can make are three public structure lookups — a receptor download and a chemical-component lookup from RCSB, and a ligand lookup from PDBe — each carrying nothing but a public identifier you typed. Starting the application with --offline refuses even those. The full technical account, including how to verify it with a packet capture, is in docs/PRIVACY.mdships with access →.
3What we collect, why, and on what basis
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Name, email address, organisation, role, what you tell us you are evaluating it for, and expected number of users — when you request access | To send you the software and reply to you | Art. 6(1)(b) — steps at your request prior to a contract | 24 months from last contact |
| Name, email, billing details, VAT identifier — when you purchase | To perform the contract and meet tax obligations | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation | 10 years (Italian accounting law) |
| Licence record: email supplied at activation, seat identifier, machine names | To operate the licence you bought | Art. 6(1)(b) — performance of the contract | For the licence term, then 12 months |
| Correspondence you send us, including any diagnostics bundle you choose to attach | To answer you | Art. 6(1)(f) — our legitimate interest in supporting customers | 24 months |
| Website analytics — aggregate page views, no cookies, no cross-site identifiers | To know which pages are read | Art. 6(1)(f) — legitimate interest, no individual profiling | As configured; no personal data retained |
3.1We do not process special categories of personal data under Article 9, and we do not carry out automated decision-making or profiling with legal or similarly significant effects under Article 22.
3.2The licence record sits on your machine. We hold a copy of what you supplied at activation so we can reissue a licence when a machine is lost or replaced.
4The diagnostics bundle
4.1The application can produce a support bundle containing the build version, your machine’s toolchain report, which optional modules failed to load, your project names, and recent log lines.
4.2Compound structures are filtered out of the log before it is written, and read-only activity is not logged at all. The bundle is plain JSON and you can read it before you send it. It is never transmitted automatically — sending it is an action you take.
5Who else sees it
5.1We use a small number of processors under Article 28 contracts: a transactional email provider, our website host, and a payment processor when you purchase. Each is engaged only for the purpose described and none is permitted to use your data for its own ends.
5.2We do not sell personal data and we do not share it for advertising.
5.3Where a processor operates outside the European Economic Area, transfers are made under an adequacy decision or the European Commission’s Standard Contractual Clauses. The current list of processors and their locations is available on request.
6Your rights
6.1You have the right to access your data (Art. 15), to correct it (Art. 16), to have it erased (Art. 17), to restrict processing (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on our legitimate interests (Art. 21).
6.2Where processing rests on consent, you may withdraw it at any time without affecting what was lawful before withdrawal.
6.3Write to info@discoverapharma.com to exercise any of these. We will respond within one month, as Article 12(3) requires.
6.4You may complain to the Italian supervisory authority — the Garante per la protezione dei dati personali, garanteprivacy.it — or to the authority where you live or work.
7This website
7.1This site sets no advertising or tracking cookies and uses no cross-site identifiers. Fonts are served from this domain, so visiting a page contacts no third party.
7.2Analytics, where enabled, are aggregate and cookieless: page counts and referrers, with no profile constructed and no individual identified.
7.3Our server keeps standard request logs, including IP addresses, for a short period for security and abuse prevention under Article 6(1)(f).
8Changes
8.1Material changes will be notified to customers by email before they take effect. We keep every published version of this policy, and on request we will send you the one that was in force on a given date.
8.2The technical statement in docs/PRIVACY.mdships with access → and this policy are intended to agree. If a future release adds an outbound call, both change together — clause 5.2 of the terms depends on it.