Privacy Policy

Draft — subject to final review by counsel. Effective 3 June 2026.

1. Who we are Mishale ("Mishale", "we", "us") provides a computational gene-therapy design service at mishale.bio. The data controller is Mishale and its Delaware subsidiary; our UK holding company is the controller for users in the UK and EEA. You can reach us at jambo@mishale.bio.

2. Information we collect - Account data — your name, email address, and basic profile information provided when you sign in with Google (via Google OAuth), plus your assigned plan and role. - Design inputs — the target, gene, indication, and free-text queries you submit to generate a Computational Feasibility Memo, and the reports we generate for you. - Billing data — records of credit purchases (pack, amount, date). Card details are handled directly by Stripe; we do not see or store full payment-card numbers. - Technical data — IP address, device/browser information, timestamps, and product analytics events (see our Cookie Notice). - Communications — messages you send us and emails we send you.

3. How we use your information - To provide, operate, and secure the service and generate your reports. - To process purchases, grant report credits, and send transactional emails (e.g. sign-in links and purchase confirmations). - To improve and calibrate the platform. We may retain and use de-identified design inputs, outputs, and any outcome data you choose to share; aggregated, de-identified data may be used without restriction. Your confidential program details are not. - To comply with legal obligations and enforce our terms.

4. Legal bases (UK/EU GDPR) We rely on: performance of a contract (to deliver the service you request); legitimate interests (to secure, maintain, and improve the platform, balanced against your rights); consent (for non-essential analytics cookies, which you may withdraw); and legal obligation (e.g. tax and accounting records).

5. Who we share it with We share data with vetted sub-processors who act on our instructions — including cloud hosting, authentication and analytics (Google), payments (Stripe), email (Resend), and AI inference providers (Anthropic, OpenAI) used to interpret your design query and run advisory review. See the Sub-processor List for the current set. We do not sell your personal information. We may disclose data if required by law or to protect rights and safety.

6. International transfers We operate from the UK, the United States, and Kenya, and our providers are primarily in the US and EU. Where personal data is transferred out of the UK/EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses.

7. Retention We keep account and billing records for as long as your account is active and as required for tax, accounting, and legal purposes. Design inputs and reports are retained to provide the service and may be retained in de-identified form thereafter. You may request deletion (§9).

8. Security We use access controls, encryption in transit, network isolation of our databases, and least-privilege internal access. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

9. Your rights Subject to applicable law you may request to access, correct, delete, restrict, port, or object to processing of your personal data, and withdraw consent at any time. California residents may request to know and delete personal information and to opt out of any "sale" (we do not sell); we will not discriminate against you for exercising these rights. To exercise any right, email jambo@mishale.bio. UK/EEA users may also complain to their data-protection authority (in the UK, the ICO).

10. Cookies We use strictly-necessary cookies for sign-in and, with your consent, analytics cookies. See the Cookie Notice.

11. Children The service is for professional and research use and is not directed to children. We do not knowingly collect data from anyone under 16.

12. Changes We may update this policy; material changes will be posted here with a new effective date.

13. Contact Questions or requests: jambo@mishale.bio.