Usage & Privacy Policy

This policy describes what SFDA Copilot collects about you, why, and what control you have over it. It covers your account, your profile, and the questions you ask — not the regulatory documents themselves, which are public source material.

Depending on how you use the product, we collect:

• Your email address and password, used to sign you in. Your password is never stored in a form we can read — GoTrue, our authentication provider, stores only a salted hash.
• The profile details you choose to add — first name, family name, organization, specialization — and, only if you opt in separately, your age.
• The questions you ask and the answers you receive, stored so you can return to a conversation later. Do not enter patient identifiers, clinical-trial subject data, or other confidential material into the chat box — see the notice shown in the app itself.
• Ordinary technical data every web service collects — request logs, error reports — used only to keep the product running and secure.

We use what we collect to:

• Operate the product: authenticate you, answer your questions, show you your own conversation history.
• Understand and improve the product, in aggregate — never to single out one person's activity for a purpose you have not agreed to.
• Contact you about the product or tell you how your information helps us understand who uses it — only if you have separately opted in.

Marketing use of your profile information and your age, specifically, requires your explicit, separate consent — an unticked checkbox at signup or on your account page. Declining it does not affect your ability to use the product.

We do not sell your personal data. We use infrastructure providers (Supabase for authentication and storage, an AI model provider to generate answers) who process data on our behalf, under their own security commitments, and never for their own purposes.

Your account and conversations are kept for as long as your account exists. You can delete individual conversations or all of them at any time from your account page, and you can delete your entire account yourself: requesting deletion starts a 30-day grace period during which your account stays fully usable — sign in, chat, read and export your conversations, change your profile, and cancel at any time — except granting new marketing consent, which stays off while deletion is pending. When the 30 days end, your conversations are permanently purged and your login identity and profile are deleted.

What remains after deletion

Even after your account is deleted, some traces remain. Administrative records written before the deletion are kept — an operator email change, for example, records the old and new email address beside the account identifier in the append-only audit log; a deletion ledger entry holding only an account identifier and timestamps is kept; notification records keep a bare account identifier beside an operator's message; backup copies are not reached by this deletion, and no retention period is stated for them; the AI model provider retains prompts sent to it under its own policy; and server logs persist, including conversation access paths. The in-memory conversation window clears when the server worker restarts, not at the moment of deletion. The dormant research archive collects nothing while its salts are unset.

From your account page, you can:

• See and correct your own profile information at any time.
• Download a complete copy of your conversation history as a file.
• Delete individual conversations, all of them at once, or your entire account — account deletion carries a 30-day grace period during which you can still cancel.
• Withdraw marketing consent as easily as you gave it — never rate-limited, never asked to justify it.

We use encryption in transit, hashed passwords, and role-based access controls that limit who inside the organization can see what. No system is perfectly secure; if you believe your account has been compromised, change your password and sign out of every other session from your account page.

Questions about this policy, or a request to exercise a right not yet self-service, can be sent through the product's usual support channel.