Privacy Policy

Arroway Sciences ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, how we protect it, and your rights regarding your data when you use ChiralCall.

Our design philosophy prioritizes data minimization: we collect only what is necessary to provide the service, and we delete data as soon as it is no longer needed.

Account Creation (all tiers)

• Email address
• Full name
• Organization name (optional)
• Academic status (for free/academic tier verification)

Prediction Input (depends on storage mode)

• Stateless mode: SMILES strings are never retained
• Store/Contribute modes: SMILES strings and prediction results

Usage Analytics

• Aggregate API request counts (per account, not per SMILES)
• HTTP access logs (IP, timestamp, endpoint, response code)
• No behavioral tracking or session replay

Payment Information

• Payment data is processed by Stripe and is not stored by Arroway Sciences. See Stripe's privacy policy at https://stripe.com/privacy

Data retention depends entirely on which storage mode you select at prediction time:

SMILES (Simplified Molecular Input Line Entry System) strings are the primary input to ChiralCall. We treat SMILES very carefully:

• In Stateless mode: SMILES is never logged, stored, or retained in any form
• In Store/Contribute modes: SMILES is encrypted at rest (Store) or anonymized and contributed to validation sets (Contribute)
• SMILES is never transmitted to third parties (except Stripe for payments, which receives no SMILES data)
• SMILES data in Contribute mode is fully anonymized (no associated metadata, account info, or timestamp)

ChiralCall uses session cookies strictly for authentication and session management. These are transient cookies that are deleted when you log out or when your session expires.

We do not use tracking cookies, third-party analytics cookies, or any form of behavioral tracking. Browser-local storage is used only to store your authentication token and preference settings (e.g., theme).

We do not sell, rent, or share personal data with third parties. However, the following service providers may access limited data:

If you are located in the European Union, the following applies:

Export Your Data: You can export all stored predictions and account data from your account settings at any time. Exports are available in CSV and JSON formats.

Delete Your Account: You can permanently delete your account from your account settings. This will:

• Permanently delete all stored predictions from your dashboard
• Revoke your API key
• Delete your email, name, and organization data
• Revoke consent for the Contribute mode (if enabled)

Deletions are processed within 30 days. Once deleted, data cannot be recovered.

We implement industry-standard security measures to protect your data:

• TLS 1.2/1.3 encryption for all data in transit
• AES-256 encryption for stored data (Store/Contribute modes)
• API keys are hashed and never stored in plaintext
• Periodic security review; third-party penetration testing available for enterprise engagements
• AWS Security Group firewalls and DDoS protection

However, no security system is 100% secure. If you believe your account has been compromised, contact us immediately at security@arrowaysci.com.

ChiralCall is not directed at users under 13 years of age, and we do not knowingly collect personal information from children under 13. If we learn that a user is under 13, we will delete their account and data immediately.

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising CCPA rights

We do not sell personal information. To exercise your rights, contact privacy@arrowaysci.com.

Contract Research Organizations (CROs) and pharmaceutical companies with strict data handling requirements should contact us before using ChiralCall. We offer:

• Custom Data Processing Agreements (DPA)
• Non-Disclosure Agreements (NDA)
• Business Associate Agreements (BAA) if required

ChiralCall is a hosted-only service. We do not offer on-premises or private cloud deployment. The prediction engine is protected as proprietary trade-secret logic, and hosted-only delivery preserves the integrity of the prediction method while enabling confidential stateless evaluation. For CROs whose client contracts prohibit any external hosted processing, ChiralCall may be best suited for internal historical datasets or non-client validation sets.

Contact legal@arrowaysci.com to discuss your data handling needs.

We may update this Privacy Policy from time to time. Material changes will be communicated to you via email at least 30 days before they take effect. Your continued use of ChiralCall after the effective date of changes indicates your acceptance of the updated policy.

For privacy-related questions, concerns, or requests, please contact:

Arroway Sciences - Privacy Team
Email: privacy@arrowaysci.com
Security Incidents: security@arrowaysci.com
Legal Requests: legal@arrowaysci.com