Privacy
Last updated 2026-11-07 · 한국어: 개인정보처리방침
1. Who runs PlasmidLab
PlasmidLab is run by an individual developer in the Republic of Korea, who decides how the data described here is used (the data controller) and is the privacy officer. The operator's name is at the end of this page.
Privacy requests: [email protected]. General mail: [email protected].
2. The app on your computer
PlasmidLab runs on your computer and your sequence files stay on your disk. The editor and cloning tools send nothing anywhere, except NCBI lookups and BLAST searches, Ensembl or Addgene lookups that you start. There is no telemetry.
3. The AI agent with your own provider
You can connect Claude Code, Codex, Grok or your own API key. Your prompt and the sequences the agent reads then go to that provider, under your account and their terms. PlasmidLab does not see them.
4. The free trial
The trial gives 10 AI runs per account on Claude Haiku. After that, you connect your own provider. The trial is for people aged 18 or older. It is not offered in countries where Anthropic's API is not available (Anthropic's supported regions).
You sign in on this site or in the app with the same account, in either of two ways. With Google: Google gives us your Google account id, your name, your email address and, for a Google Workspace account, its domain. We never see your Google password. With an email address and password: we email you a link to prove the address, and we store only a salted hash of the password, never the password itself. An account with the same verified address uses both ways. You check and can edit your name, email, affiliation (lab or institution) and position (for example student, researcher or professor) at each sign-in in the app and at any time on your account page on the website. All four are required; without them you cannot use the trial.
Trial runs go through PlasmidLab's relay at api.plasmidlab.com to Anthropic. Each run is sent to Anthropic to be answered, even when transcript storage is off. Anthropic's Commercial Terms of Service say it may not train models on API inputs and outputs.
5. What we keep, why, and for how long
| What we keep | Why | How long |
|---|---|---|
| Account: Google account id if you use Google, password hash if you set a password, name, email, affiliation, position, sign-up time | To count your free runs, stop abuse and see which labs use the trial (in aggregate) | While the account is in use. Deleted 24 months after your last use, or when you delete the account. |
| Sign-ins: the app's install id and version, or a random id for a website sign-in, sign-in time, last seen | To keep you signed in, let you sign out and block misuse | Same as the account |
| Each run: timestamps, model, token counts, estimated cost, stop reason | To count runs, cap daily spend and stop abuse | Same as the account |
| Run transcripts, only if you tick the box: your prompt, the sequences the agent read, its tool calls and its answer | To find where the agent fails and improve the tools and walkthroughs | 12 months. Deleted sooner if you withdraw consent or delete the account. |
| Password links and failed sign-ins: the email address, the time and the number of failed tries | To send the link, make it work once and stop password guessing | 2 days for links, 1 day for failed tries |
| Site visits, only if you press Allow: random visitor id, pages and sections viewed, download links clicked, referring site name, country, kind of device, time | To see how the site is used and improve it | 12 months. Deleted sooner if you withdraw from Cookie settings |
Everything except transcripts and site visits is kept whether or not you tick the box or press Allow. The relay does not save your IP address; it uses it for a moment to limit sign-in attempts. The operator sees member details and these records on a private admin page. We do not see files you did not give to the agent.
6. The transcript box
The box is unticked by default and you can use the trial without it. If you tick it, PlasmidLab keeps the transcript of each trial run (your prompt, the sequences the agent read, its tool calls and its answer) for 12 months to improve the product. You can untick it at any time in the app's Settings or on your account page on the website. We then stop keeping new transcripts and delete the ones already kept.
We may publish aggregate numbers, such as success rates by task type. They never include your sequences or anything that identifies you.
7. Legal bases
- Account and run counting: to provide the trial you signed up for (contract).
- Abuse prevention and spend caps: our legitimate interest in keeping the free trial running.
- Run transcripts: your consent, which you can withdraw at any time.
- Site visits: your consent, which you can withdraw at any time from Cookie settings.
8. Who else handles the data
These companies process data for us as service providers. We do not sell your data or share it for advertising.
- Cloudflare runs the relay (Workers, D1, R2) and delivers this website. Data is stored in the US or EU regions Cloudflare picks.
- Anthropic answers each trial run (United States).
- Google handles sign-in with Google (United States).
- Resend sends the password emails. It receives your email address and the message (United States).
- GitHub hosts this website and the downloads (United States).
Using the trial means your data is sent to these companies outside Korea, over encrypted connections, at the time you sign in or start a run. If you do not want that, use your own provider instead of the trial. Site visits you allow go to Cloudflare the same way, as you view each page; Decline stops that record, though Cloudflare still delivers the page.
9. This website and cookies
plasmidlab.com is a static site on GitHub Pages, delivered through Cloudflare. Cloudflare and GitHub therefore handle your IP address and browser details for every page, whatever you choose below, and keep their standard logs. From Cloudflare we receive only totals per day (requests, data sent, page views, unique addresses), not anything about a person. The fonts are served from this site. The download buttons ask api.github.com for the latest release, so GitHub sees your IP address and browser details for that request.
On your first visit the site asks whether it may record your visit. If you press Allow, it sets two cookies for up to 12 months (some browsers, such as Safari, remove them sooner): plasmidlab_consent, which remembers your choice, and plasmidlab_visitor, a random id. It then records the pages and sections you view, the download links you click, the site you came from (its name only), your country and your kind of device (Mac, Windows, Linux or mobile), with the time. If you press Decline, only plasmidlab_consent is set, so we do not ask again, and nothing is recorded. The site works the same either way.
To change your mind, use Cookie settings at the bottom of any page. Declining removes plasmidlab_visitor and deletes what was recorded under it. If the deletion cannot finish at that moment, it is retried on your next visit. If that cookie is already gone, or you do not come back, those records are deleted after 12 months. You can also block or clear cookies in your browser settings.
If you pick the light or dark theme, that choice is kept in your browser's own storage under plasmidlab_theme. It stays on your device, is never sent anywhere, and needs no consent. Clearing your browser's site data removes it, and the site then follows your system setting again.
During sign-in the relay sets one cookie, plasmidlab_flow, on api.plasmidlab.com. It links the browser sign-in to your app, lasts 15 minutes and is cleared when sign-in finishes. Google sets its own cookies on Google's sites when you sign in there.
When you sign in on the website the relay sets two more, for up to 30 days, which sign-in needs and which do not depend on the choice above: plasmidlab_session on api.plasmidlab.com keeps you signed in, and plasmidlab_signed_in on plasmidlab.com only tells these pages to show Account instead of Log in. Signing out removes both.
10. Your rights
You can ask to see, correct or delete your data, and you can withdraw consent for transcripts and site visits. To delete your account and everything tied to it, use "Delete my account" in the app's Settings or on your account page, or email [email protected] from your signed-in address. Emailed requests are done within 30 days.
You can also complain to Korea's Personal Information Protection Commission (pipc.go.kr) or to the data protection authority where you live.
11. Age
The trial is for people aged 18 or older. If we learn that an account belongs to someone younger, we delete it.
Changes
- 2026-11-06: you can sign in on this site and with an email address and password; Resend sends the password emails; Cloudflare now delivers this website; added the cookies and records these need. The operator can see member details and these totals on a private admin page.
- 2026-11-06: the site now asks for consent to a cookie and a record of site visits; added them to the sections above.
- 2026-11-06: the account also keeps your position; you confirm your profile at each sign-in, and a Google Workspace domain can prefill the affiliation.
- 2026-11-06: named the operator and privacy officer; added the retention table, legal bases, service providers, transfers abroad, cookies, rights and the age rule; deletion requests now go to [email protected].
- 2026-11-06: the trial now needs a Google sign-in; added the account section.
Operator, data controller and privacy officer: Chanyoung Park.