DE | EN
← Back to Home

Privacy Policy

Last updated: July 2026 | Applicable to the Phonos web application

1. Controller

FyreFly Systems GbR

Maximilian Scheinast-Peter, Janek Franz Fabian
Bergstraße 16
06366 Köthen
Germany

Email: service@fyreflysystems.com
Website: fyreflysystems.com

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is FyreFly Systems GbR, represented by Maximilian Scheinast-Peter and Janek Franz Fabian.

2. General Information on Data Processing

The protection of your personal data is very important to us. This privacy policy informs you about the nature, scope, and purpose of the processing of personal data when using our Phonos web application ("Service"). We process your data exclusively on the basis of the legal provisions (GDPR, TKG).

Key Principles:
  • We process data only for specified, explicit, and legitimate purposes
  • Data processing is limited to what is necessary
  • Your data is stored securely and protected against unauthorized access
  • You have the right to information, rectification, and erasure of your data at any time

3. Collection and Storage of Personal Data

3.1 When Visiting the Website

When you access our website, the browser on your device automatically sends information to our web server. This information is temporarily stored in a log file:

  • IP address of the requesting computer
  • Date and time of access
  • Name and URL of the retrieved file
  • Website from which the access is made (referrer URL)
  • Browser and, where applicable, the operating system of your computer, as well as the name of your access provider

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring system security and stability)

Retention period: The data is deleted as soon as it is no longer required for the purpose of its collection, and no later than after 90 days.

3.2 Registration and Use of the Service

Registration is required to use our Service. We collect the following personal data:

Data Type Purpose of Processing Legal Basis
Username Identification and authentication Art. 6(1)(b) GDPR (contract performance)
Email address Communication, two-factor authentication, password reset Art. 6(1)(b) GDPR (contract performance)
Password (hashed) Authentication and access protection Art. 6(1)(b) GDPR (contract performance)
Profile picture (optional) Personalization of the user profile Art. 6(1)(a) GDPR (consent)
Organization/team membership Project management and access control Art. 6(1)(b) GDPR (contract performance)

4. Processing of Usage and Research Data

4.1 Uploaded Files and Calculations

When using the Service, we process the following data:

  • Protein sequences and structural data: Scientific data uploaded or entered by you
  • Calculation results: Results generated by our AI models (ESMFold, AlphaFold2, DiffDock, ProteinMPNN, Metal3D, Boltz2, Evo2)
  • Job metadata: Timestamps, parameters used, calculation duration
  • Project and file management: Organizational structure of your research data

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in providing the services)

Retention period: Your research data is stored for as long as your account is active. You may delete individual files or projects at any time.

4.2 Usage Statistics and Analytics

In order to improve our Service, we collect anonymized usage statistics:

  • Number of calculations per model type
  • Average calculation times
  • Frequency of use of certain features
  • Storage usage (aggregated)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in optimizing our Service)

6. Sharing Data with Third Parties

6.1 General Principle

We do not share your personal data with third parties unless:

  • You have expressly consented (Art. 6(1)(a) GDPR)
  • Sharing is necessary for contract performance (Art. 6(1)(b) GDPR)
  • There is a legal obligation (Art. 6(1)(c) GDPR)

6.2 Data Processors and Third-Party Providers

We use the following data processors and third-party providers:

Service Provider Purpose Location
Amazon Web Services (AWS) Cloud infrastructure (compute, storage, networking) for the Phonos platform EU/Schengen Area (Frankfurt, Ireland, Stockholm, Paris)
Google Cloud Platform (GCP) Hosting of server infrastructure and databases EU/Schengen Area
Nebius AI GPU compute infrastructure for AI/ML model execution (Boltz2, Evo2, and other computational models) EU/Schengen Area
Cloudflare, Inc. Content Delivery Network (CDN), DDoS protection, SSL/TLS encryption EU/USA (Standard Contractual Clauses)
IONOS SE Email delivery (transactional emails, 2FA codes, notifications) Germany (GDPR compliant)
Stripe, Inc. Payment processing for premium subscriptions EU/USA (Standard Contractual Clauses, GDPR compliant)
NVIDIA DGX Cloud / NVIDIA NIM GPU inference for models offered in Research Preview mode. Inputs you submit to a Research Preview model (sequences, structures, ligands, parameters) are sent to NVIDIA NIM APIs for processing. USA (Standard Contractual Clauses + EU–US Data Privacy Framework)
Google LLC (Gemini AI) Optional conversational AI assistance, file analysis, and AI-powered search (activated when using @gemini mentions or search functionality) Worldwide / USA (Standard Contractual Clauses + EU–US Data Privacy Framework)
Google LLC / Google Ireland Ltd. (Google Analytics) Consent-based, IP-anonymized website analytics (only loaded after you accept analytics cookies) EU with onward transfer to USA (Standard Contractual Clauses + EU–US Data Privacy Framework)

Data processing agreements have been concluded with all processors in accordance with Art. 28 GDPR. For transfers to third countries outside the EU, EU Standard Contractual Clauses are used.

6.3 Special Notes on Third-Party Providers

Amazon Web Services (AWS)

Parts of the Phonos platform run on Amazon Web Services (AWS) cloud infrastructure within the European Union / Schengen Area (preferentially in the Frankfurt, Ireland, Stockholm, or Paris regions). AWS provides the underlying compute, storage, and networking resources required to operate the Service. Resources may be distributed across one or more EU/Schengen regions for resilience and performance; no data leaves the EU/Schengen Area.

Processed data: Technical data (IP addresses, access logs), application data (temporary compute data, cached assets)
Privacy policy: https://aws.amazon.com/privacy/
Data processing agreement: AWS GDPR Data Processing Addendum (https://aws.amazon.com/compliance/gdpr-center/)
Legal basis: Art. 6(1)(f) GDPR, Art. 28 GDPR

Google Cloud Platform (GCP)

Our server infrastructure runs on Google Cloud Platform within the European Union / Schengen Area. All your data is stored exclusively on servers within the EU/Schengen Area. Resources may be distributed across one or more regions for resilience and performance; no data leaves the EU/Schengen Area.

Processed data: Technical data (IP addresses, access logs), all application data (user accounts, project data, research data, database contents)
Privacy policy: https://policies.google.com/privacy
Legal basis: Art. 6(1)(f) GDPR, Art. 28 GDPR

On-Premise Infrastructure

Part of the Phonos platform runs on our own (on-premise) servers operated by FyreFly Systems GbR in Germany. These servers host application and database workloads and form part of our EU-based infrastructure together with AWS, Google Cloud Platform, and Nebius AI. On-premise infrastructure is operated under our own technical and organizational measures (see Section 8).

Nebius AI

Nebius AI provides GPU compute infrastructure within the European Union / Schengen Area that we use to run our self-hosted AI/ML worker models (e.g. Boltz2, Evo2, and other computational models that are not in Research Preview mode). Inputs and results processed on this infrastructure remain within the EU/Schengen Area.

Processed data: Protein sequences, structural data, job parameters, temporary compute data
Privacy policy: https://nebius.com/legal/privacy
Data processing agreement: Concluded in accordance with Art. 28 GDPR
Legal basis: Art. 6(1)(b) GDPR (contract performance), Art. 28 GDPR

Cloudflare (CDN and Security)

Cloudflare improves the performance and security of our website through caching, DDoS protection, and SSL encryption. IP addresses and technical information are processed.

Privacy policy: https://www.cloudflare.com/privacypolicy/
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and performance)

Stripe (Payment Processing)

When you subscribe to a paid plan, payment information is transmitted directly to Stripe. We do NOT store complete credit card data on our servers.

Processed data: name, email address, billing address, payment method (tokenized)
Privacy policy: https://stripe.com/privacy
Legal basis: Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(c) GDPR (legal obligations)

NVIDIA DGX Cloud / NVIDIA NIM (Research Preview models)

Some AI/ML models are offered in Research Preview mode. When you run such a model, the inference is performed through NVIDIA NIM APIs hosted on NVIDIA DGX Cloud. The input you submit for that model — including protein sequences, structural data, ligands, and job parameters — is transmitted to NVIDIA for processing and may be processed on servers located in the United States. Models that are not labeled "Research Preview" run on our EU/Schengen infrastructure (on-premise, AWS, Google Cloud Platform, or Nebius AI) and their inputs are not sent to NVIDIA DGX Cloud.

Because Research Preview inference involves a transfer to a third country, you should not submit confidential, proprietary, or personal data to Research Preview models that you are not comfortable sharing with NVIDIA under its terms.

Processed data: protein sequences, structural/molecular data, job parameters, and the resulting predictions
Privacy policy: https://www.nvidia.com/en-us/about-nvidia/privacy-policy/
Third-country transfer: EU Standard Contractual Clauses and the EU–US Data Privacy Framework
Legal basis: Art. 6(1)(b) GDPR (performance of the requested computation) and Art. 6(1)(f) GDPR (legitimate interest in operating the Research Preview)

Google Analytics (Web Analytics)

Consent-based, IP-anonymized website analytics. Google Analytics is loaded only after you accept analytics cookies via the cookie banner and is described in detail in Section 5.4 above.

Processed data: anonymized IP address, page views, device/browser information, interaction events
Provider: Google Ireland Limited (EU), with onward processing by Google LLC, USA
Privacy policy: https://policies.google.com/privacy
Third-country transfer: EU Standard Contractual Clauses and the EU–US Data Privacy Framework
Legal basis: Art. 6(1)(a) GDPR (consent), § 25(1) TTDSG

Google Gemini AI (Optional AI Assistance)

When you explicitly use Gemini features by @mentioning gemini in project chats or requesting file analysis, your queries and context are sent to Google's Gemini API.

Processed data: user queries, project context, file content (optional, limited to 10,000 characters)
Privacy policy: https://policies.google.com/privacy
Legal basis: Art. 6(1)(a) GDPR (consent through active usage), Art. 6(1)(b) GDPR (contract performance)
Note: This is an optional feature. You can use all core features without activating Gemini integration.

6.4 Data Location and Transfer

Your account data, project data, stored files, and the results of your scientific calculations are stored on infrastructure within the European Union / Schengen Area — namely our own on-premise servers in Germany together with AWS, Google Cloud Platform, and Nebius AI. Models that are not labeled "Research Preview" are also executed on this EU/Schengen infrastructure.

Exception 1 — Research Preview models (NVIDIA DGX Cloud / NVIDIA NIM): When you run a model that is offered in Research Preview mode, the input you submit for that computation is transmitted to NVIDIA NIM APIs on NVIDIA DGX Cloud and may be processed in the United States. The Research Preview status is indicated in the interface, and you control which models you run.

Exception 2 — Optional Gemini feature: If you choose to use the optional Gemini AI features by @mentioning gemini, the data you send in those specific queries may be processed by Google on servers worldwide, including the USA. This is clearly communicated when you use the feature, and you have full control over what data you share with Gemini.

Exception 3 — Consent-based Google Analytics: If you accept analytics cookies, anonymized analytics data may be transferred to Google in the USA (see Section 5.4).

In addition, Cloudflare and Stripe may transfer technical data (IP addresses, metadata) to the USA as part of their services. All transfers to the USA described above are based on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework, together with additional safeguards in accordance with the GDPR.

7. Use of AI Models and Scientific Data

7.1 AI Model Execution and Location

AI/ML models are executed in one of two ways depending on the model:

  • EU-hosted models: Models that are not in Research Preview mode are run on our EU/Schengen infrastructure (our own on-premise servers, AWS, Google Cloud Platform, or Nebius AI). Your input data and results for these models remain within the EU/Schengen Area.
  • Research Preview models (NVIDIA DGX Cloud / NVIDIA NIM): Models offered in Research Preview mode are run through NVIDIA NIM APIs on NVIDIA DGX Cloud. The input you submit for such a model (sequences, structures, ligands, parameters) is transmitted to NVIDIA and may be processed in the United States under EU Standard Contractual Clauses and the EU–US Data Privacy Framework. See Sections 6.3 and 6.4.

Whether a given model runs in Research Preview mode is indicated in the interface, so you can decide which data to submit to which model.

7.2 Google Gemini AI Integration (Optional Feature)

The Service offers optional AI-powered features through Google Gemini AI, including conversational assistance, file analysis, and intelligent search. These features are only activated when you explicitly use them by mentioning @gemini in project chats, requesting file analysis, or using the search functionality.

Data transmitted to Google: When you use Gemini-powered features, the following data may be sent to Google's Gemini API:

  • Your query text and conversation context
  • Search queries and result context (when using search)
  • Project names and descriptions (if mentioned in the query)
  • File content (if you request file analysis, limited to the first 10,000 characters)

Data processing by Google: Google processes this data to generate AI responses. Google's data processing practices are governed by their privacy policy. Google may use API data to improve their services in accordance with their terms. We recommend reviewing Google's privacy policy at https://policies.google.com/privacy and their AI data usage policies.

Data location: Google Gemini API requests may be processed on Google's servers worldwide, including outside the European Union. Data transfers to the USA are based on Google's compliance with applicable data protection frameworks.

Legal basis: Art. 6(1)(a) GDPR (consent through active usage of the feature) and Art. 6(1)(b) GDPR (contract performance)

Your control: You have full control over this feature. Simply avoid using @gemini mentions or AI assistance features if you prefer to keep your data entirely within our infrastructure. You can use all core protein analysis features without ever triggering Gemini integration.

7.3 Confidentiality of Scientific Data

Important Note for Researchers:
  • Your protein sequences and structure data are treated confidentially and are not sold.
  • We do not use your research data to train our own foundation AI models. During the Research Preview, anonymized or aggregated data may be used to evaluate and improve the Service, as described in our Terms of Service (§ 2.4).
  • Inputs you submit are transmitted to the relevant inference provider to run the computation you requested — our EU-hosted infrastructure (on-premise, AWS, Google Cloud Platform, Nebius AI) for standard models, NVIDIA NIM for Research Preview models, and Google for optional Gemini features. These providers process the data under their own terms; we do not authorize them to use it to train their models where opt-out controls are available to us.
  • Your research results remain your intellectual property.
  • We do not share your data with competitors, other researchers, or unrelated commercial entities.

8. Data Security

We implement technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons:

  • Encryption: HTTPS/TLS for all data transmissions
  • Password protection: Secure hash algorithms (bcrypt) for passwords
  • Two-factor authentication (2FA): Additional protection for user accounts
  • Access control: Role-based access control for projects and data
  • Regular backups: Secure data backup to prevent data loss
  • Firewall and monitoring: Protection against unauthorized access
  • Data encryption: Encryption of sensitive data in the database

9. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

9.1 Right of Access (Art. 15 GDPR)

You have the right to obtain information about the personal data we process. You can request an overview of your data in your account settings at any time.

9.2 Right to Rectification and Erasure (Art. 16, 17 GDPR)

You have the right to rectify inaccurate or incomplete data and to erase your data ("right to be forgotten"). You can delete your account and all associated data in the settings at any time.

9.3 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request restriction of processing of your data if accuracy is disputed, processing is unlawful, or data is no longer needed.

9.4 Right to Data Portability (Art. 20 GDPR)

You have the right to receive the data concerning you in a structured, commonly used, and machine-readable format. You can export your research data in the dashboard at any time.

9.5 Right to Object (Art. 21 GDPR)

You have the right to object to the processing of your personal data if it is based on legitimate interests.

9.6 Right to Withdraw Consent (Art. 7(3) GDPR)

If processing is based on your consent, you can withdraw it at any time. The lawfulness of processing carried out until withdrawal remains unaffected.

9.7 Right to Lodge a Complaint (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The authority competent for us is the State Commissioner for Data Protection of Saxony-Anhalt (Landesbeauftragter für den Datenschutz Sachsen-Anhalt), as FyreFly Systems GbR is based in Köthen, Saxony-Anhalt. Alternatively, you may also contact the data protection supervisory authority of your habitual residence or place of work.

10. Retention Period

We store your personal data only as long as necessary for the fulfillment of purposes or legal retention requirements exist:

Data Type Retention Period
Account data (username, email) Until account deletion
Research data (sequences, structures, jobs) Until manual deletion or account deletion
Server log files Maximum 90 days
Consent records (proof of consent) For as long as necessary to prove that consent was obtained, in line with applicable limitation periods
Billing data (for paid features) 10 years (legal retention requirement)
Email communication Until account deletion + 6 months

11. Automated Decision-Making and Profiling

We do not use automated decision-making in accordance with Art. 22 GDPR. AI models are used exclusively for scientific calculation of protein structures and properties, not for evaluation or profiling of individuals.

12. Data Protection for Minors

Our service is intended for persons who have reached the age of 16. Persons under 16 may only use the service with the consent of their legal guardians. We do not knowingly collect personal data from persons under 16 without appropriate consent.

13. Changes to this Privacy Policy

We reserve the right to amend this privacy policy to adapt it to changed legal situations or changes to the service. The current version can always be found on this page. We will notify you of significant changes by email.

14. Privacy Contact

If you have questions about data protection, to exercise your rights, or for complaints, you can contact us at any time:

Data Protection Contact Point:

FyreFly Systems GbR
Maximilian Scheinast-Peter, Janek Franz Fabian
Email: service@fyreflysystems.com
Subject: "Data Protection - Phonos"

Due to our size and structure as a GbR, we are not legally required to appoint a Data Protection Officer (Art. 37 GDPR, § 38 BDSG). The controller within the meaning of the GDPR is the provider named in Section 1 above; please direct all data protection matters to the email address above.

We strive to respond to your inquiries within 30 days.

For technical platform issues, you can use the in-app Report Bug button after login. Submitted bug reports may include your issue description plus diagnostic metadata such as current URL/view, browser user agent, platform, language, viewport/screen size, timezone, and IP address to enable troubleshooting.

Imprint | Terms of Service | Licenses | Home