Privacy Policy

1. Data Controller

The data controller under GDPR is:

YambaCode AB
Stockholm, Sweden
info@yambacode.com

2. What We Collect — and What We Don't

Data we do collect (via Stripe at checkout on dna2c.com):

• –Email address (for your purchase receipt)
• –Order id and purchase status (paid / refunded)

Mac App Store purchases:

• –Apple processes the payment. We never receive your name, email, or payment details.
• –The app sends Apple's signed, anonymous transaction record to our license server once, to issue your Pro license. We do not store it.

Data we never collect:

• ✓Genomic data — stays encrypted on your device, never transmitted
• ✓DNA sequences, SNP data, or health information
• ✓Chat messages or AI query history from the Mac app — its AI runs on your Mac
• ✓Usage analytics or behavioral tracking
• ✓IP addresses beyond what your internet connection naturally exposes

3. Legal Basis for Processing

We process your email address and purchase data on the legal basis of contract performance (GDPR Art. 6(1)(b)) — it is necessary to fulfil your purchase. Retention beyond that is based on legal obligation (Art. 6(1)(c)) under Swedish accounting law (Bokföringslagen), which requires us to retain transaction records for seven years.

4. Data Processors

We use Stripe as our payment processor. Stripe processes your payment information, email, and billing details on our behalf under its own Privacy Policy. Stripe acts as a data processor for the payment data it handles for us.

Mac App Store purchases are processed by Apple under Apple's Privacy Policy. Our license server runs on Google Cloud (EU region); its request logs (IP address and time, kept about 30 days) are used only for security and operations.

We do not use any third-party analytics, advertising, or tracking services.

5. AI Chat and Reference Lookups

Mac app: the AI model runs on your Mac. Your questions and genotypes are not sent to us or to any AI provider.

Reference lookups: to cite sources, the app looks up variant ids (rsIDs) and gene names in public databases — NCBI (PubMed, ClinVar, dbSNP, Gene) and EMBL-EBI (Ensembl, GWAS Catalog). Only the id or gene name is sent, never your genotype.

dna2c.com web preview: the preview uses a sample genome, not yours. Questions you type there are answered by Anthropic via our server and are not stored by us.

Your own cloud AI key (direct-download app only): if you connect your own Anthropic, OpenAI, or Gemini key, the key stays in your device's keychain, and your questions and the relevant genotypes go from your device to that provider under its terms.

6. Data Retention

Your email and purchase records are retained for seven years from your last transaction as required by Swedish accounting law. If you request deletion before that period, we will anonymise your record while retaining the transaction amounts required for accounting compliance.

7. Your Rights Under GDPR

You have the right to:

• –Access (Art. 15): request a copy of your personal data
• –Rectification (Art. 16): correct inaccurate data
• –Erasure (Art. 17): request deletion, subject to legal retention obligations
• –Portability (Art. 20): receive your data in a machine-readable format
• –Object (Art. 21): object to processing where legitimate interests are the basis

To exercise any right, email info@yambacode.com. We will respond within 30 days.

8. Supervisory Authority

If you believe your data has been processed unlawfully you have the right to lodge a complaint with the Swedish data protection authority:

Integritetsskyddsmyndigheten (IMY)
Box 8114, 104 20 Stockholm, Sweden
www.imy.se

9. Changes to This Policy

Material changes to this Privacy Policy will be communicated via the email address associated with your purchase at least 14 days before taking effect.