Privacy notice

If you create an account: your email address, your name as you give it, and anything you choose to add to your profile — affiliation, ORCID iD, a biography. If you deposit data: the dataset and the terms you record with it. If you apply for access: your stated purpose and institution, which the depositor sees.

We do not ask for anything we do not need, and there is no requirement to give a real name beyond what your institution expects.

We use it to run the exchange: to show depositors who is asking for their data and why, to enforce the terms they set, and to keep the access record that makes controlled sharing defensible. We do not sell it, we do not use it for advertising, and we do not use deposited data to train machine learning models.

Depositors see the applications made for their datasets, including the applicant's name, institution and stated purpose. Administrators can see account records and the audit trail. Your deposited data is not browsed by us.

The platform runs on Google Cloud and Firebase, and the site is served by Cloudflare. Both process data on our behalf as infrastructure providers.

Account and dataset records last as long as your account does. The access record — who applied, what was decided — is kept permanently and cannot be edited, because a record that can be quietly amended is not a record. If you close your account we remove your profile and your deposited data; the audit entries remain, without the personal detail where that is possible.

You can ask for a copy of what we hold, ask us to correct it, or ask us to delete your account and data. Email [email protected] and we will act within thirty days. If we cannot delete something — an audit entry, for example — we will tell you why rather than quietly not doing it.

The marketing site sets no cookies and carries no tracking. The platform sets what is needed to keep you signed in, and nothing else.

If this notice changes materially we will say so on the site rather than updating it silently.