Privacy Policy

This Privacy Notice for Dr. Amr Kamel (“we,” “us,” or “our”) describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”), including when you:

• Visit our website at https://statula.app or any website of ours that links to this Privacy Notice.
• Use STATULA, an AI-guided lab companion that helps researchers plan experiments, log results, understand statistics and generate reports — with data that stays under the researcher's control.
• Subscribe to our newsletter, receive early access launch notifications, or engage with us in other related ways, including research surveys, marketing, and events.

1. What Information Do We Collect?

Personal information you disclose to us

In Short: We collect personal information that you voluntarily provide to us.

We collect personal information that you voluntarily provide when you express an interest in obtaining information about us or our products and Services (such as joining the early access newsletter or participating in market friction surveys), or otherwise contact us directly.

The personal information we collect depends on the context of your interactions with us, your choices, and the features you use. This may include:

• Names: Provided voluntarily when subscribing to updates or requesting correspondence.
• Email Addresses: Used to deliver newsletter dispatches, development milestones, and early access cohort invitations.
• Professional or Academic Context: Optional role information (e.g. undergraduate, doctoral candidate, PI, industry scientist) submitted in voluntary surveys to tailor product feedback.

Sensitive Information

We do not process sensitive personal information. We do not collect racial or ethnic origin, sexual orientation, religious or philosophical beliefs, biometric data, genetic data, or health-related metrics.

Information automatically collected

In Short: Basic technical telemetry—such as IP address, browser type, and device characteristics—is collected automatically when you visit our Services for security and caching.

When you navigate our website, our servers and infrastructure partners automatically log standard web data. This information does not reveal your specific identity (like your name or contact details) but includes:

• Log and Usage Data: Internet Protocol (IP) address, browser type, operating system, referring URLs, device name, country/location estimate, and timestamp records of site visits.
• Infrastructure Diagnostics: Performance telemetry, security events, and error logs collected via our delivery network (Cloudflare) to ensure fast, reliable, and DDOS-resilient operation.

Cookies & Similar Technologies

In Short: This website does not use first-party advertising, tracking, or analytics cookies. However, the embedded newsletter signup form and its anti-spam services place a small number of third-party cookies on your device as soon as the page loads.

Because the early-access signup form is embedded directly on the page, the following third-party technologies are active from the moment the page loads — before you interact with the form:

• Google reCAPTCHA (Google LLC): Sets the _GRECAPTCHA cookie (typical lifetime of approximately six months) in order to distinguish genuine signups from bots and protect the form from spam and abuse. In the process, technical data such as your IP address, browser type, and interactions with the form are transmitted to Google.
• MailerLite: May set cookies and equivalent local identifiers when the signup form loads and when you submit it, in order to remember that you subscribed, prevent duplicate subscriptions, and attribute the signup to this website. These identifiers are not used for cross-site advertising.
• Cloudflare: May set short-lived, strictly necessary technical cookies (such as __cf_bm) required for security, bot mitigation, and reliable delivery of the website.

These cookies are technically required for the operation and abuse protection of the signup form and this website; no consent-based marketing or profiling cookies are set by us. We are continuing to evaluate a consent-management mechanism for the embedded third-party form; in the meantime, the cookies described above are disclosed here in full and can be blocked or deleted at any time using your browser settings.

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, ensure security and fraud prevention, and comply with law.

We process personal data for distinct and transparent purposes:

• Notifying interested users about the STATULA launch & newsletter updates: We use the email address provided to deliver updates about the scientific development, validation benchmarks, and availability of the STATULA platform to researchers who explicitly requested notifications. (Retention period: Until you unsubscribe, or up to 24 months of continuous newsletter inactivity, whichever occurs first.)
• To request feedback: We may contact interested researchers to seek qualitative feedback regarding experimental workflow friction points and early design prototypes.
• To protect our Services: As part of our commitment to system integrity, we log technical telemetry for bot detection, spam mitigation (including Google reCAPTCHA on the newsletter signup form), and infrastructure security.
• To comply with legal obligations: Responding to legal process, regulatory inquiries, or asserting legal rights where required by applicable law.

3. What Legal Bases Do We Rely On To Process Your Information?

In Short: We only process personal information when we have a valid legal reason under applicable law (such as the GDPR, UK GDPR, and PIPEDA).

If you are located in the European Union (EU) or United Kingdom (UK):

• Consent (Art. 6(1)(a) GDPR): When you submit your email address to receive early access newsletters or benchmark reports, you grant explicit consent. You have the right to withdraw this consent at any time with immediate effect.
• Legitimate Interests (Art. 6(1)(f) GDPR): We process basic diagnostic telemetry where reasonably necessary to ensure platform security, prevent fraud, and deliver reliable technical performance, provided these interests do not override your fundamental rights.
• Legal Obligations (Art. 6(1)(c) GDPR): When necessary for compliance with European or German statutory requirements.
• Vital Interests (Art. 6(1)(d) GDPR): Where processing is necessary to protect someone’s physical safety or life.

If you are located in Canada: We process your information under express or implied consent in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), or under narrow statutory exemptions such as investigation of breaches, legal proceedings, or publicly available information specified by regulation.

4. When and With Whom Do We Share Your Personal Information?

In Short: We share data only with third-party service providers bound by contractual data processing commitments, or in connection with business transactions.

We partner with specialized infrastructure and communication vendors who assist in operating our Services. We maintain Data Processing Agreements (DPAs) requiring third parties to process personal data strictly pursuant to our instructions, safeguard its confidentiality, and never sell or repurpose your information:

• Website Hosting & Edge Security: Cloudflare, Inc. (Content delivery network, DDoS mitigation, and global edge hosting).
• Website Performance & Analytics: Cloudflare Web Analytics (Privacy-first, cookieless metrics without individual cross-site tracking).
• Mailing List Signup & Newsletter Delivery: MailerLite (Secure email list management and double opt-in subscriber management).
• Form Spam Prevention (reCAPTCHA): Google LLC (Bot detection for the newsletter signup form; reCAPTCHA receives technical data such as your IP address and browser characteristics and sets the _GRECAPTCHA cookie, processed under Google’s Privacy Policy).
• Business Transfers: In the event of a merger, acquisition, reorganization, or asset sale, subscriber information may be transferred subject to the commitments in this Privacy Notice.

5. How Long Do We Keep Your Information?

In Short: We retain information only as long as necessary to fulfill the purposes set out in this notice or as required by law.

For newsletter and early access subscribers, we retain your email address until you unsubscribe or request deletion, or after a maximum period of 24 months of inactive interaction. Server security logs are rotated and deleted automatically within standard operational cycles (typically 30–90 days).

When there is no ongoing legitimate purpose or legal requirement to retain data, we securely delete or anonymize it.

6. How Do We Keep Your Information Safe?

In Short: We deploy modern organizational and technical safeguards to protect your personal information.

Our site enforces Transport Layer Security (TLS 1.3 / HTTPS encryption), strict access controls, and EU-compliant data center storage. However, please remember that no electronic transmission or cloud storage system is guaranteed to be 100% impenetrable. While we strive to protect your data with industry best practices, accessing online services involves inherent risks.

7. Do We Collect Information From Minors?

In Short: We do not knowingly collect personal data from or market to children under 18 years of age.

STATULA is designed for academic, scientific, and professional researchers. By using our Services, you represent that you are at least 18 years of age. If we learn that personal data from individuals under 18 has been collected without parental consent, we will promptly delete it. If you suspect any minor has submitted data, contact us at privacy@statula.app.

8. What Are Your Privacy Rights?

In Short: In many jurisdictions (including the EEA, UK, Switzerland, and Canada), you possess enforceable legal rights regarding your personal data.

Under European, UK, and Swiss data protection laws, your rights include:

• Right of Access: Request confirmation and copies of your personal data.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data when no longer needed.
• Right to Restrict Processing: Request limitation of how your data is processed under specific circumstances.
• Right to Data Portability: Obtain your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Object at any time to processing based on legitimate interests or direct marketing.
• Automated Decision-Making: Right not to be subjected to decisions based solely on automated processing. STATULA does not utilize automated profiling producing legal effects.

Complaints to Supervisory Authorities

If you believe our data processing infringes applicable regulations, you have the right to lodge a complaint:

• Germany / EU: Contact your regional State Data Protection Commissioner (EU Member State Authorities Directory) or the Hessian Commissioner for Data Protection and Freedom of Information (HBDI).
• United Kingdom: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (ico.org.uk/make-a-complaint, Helpline: 0303 123 1113).
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC).

9. Controls for Do-Not-Track Features

Many web browsers and operating systems feature a “Do-Not-Track” (DNT) signal. Because no uniform technological standard for recognizing DNT signals has been established, our systems do not currently respond to automated browser DNT headers. If an agreed industry standard is established, we will incorporate it into this notice.

10. Do United States Residents Have Specific Privacy Rights?

In Short: Residents of states such as California, Virginia, Colorado, and others possess statutory rights regarding access, deletion, correction, and opting out of data sales.

The table below discloses the categories of personal information we have collected in the preceding twelve (12) months:

No Sale or Sharing for Behavioral Advertising: We have not sold or shared any personal information with third parties for commercial advertising or monetary consideration in the preceding twelve (12) months.

11. Do We Make Updates To This Notice?

In Short: Yes, we will update this notice as necessary to maintain compliance with applicable legal frameworks and operational changes.

The updated version will be indicated by the “Last updated” date at the top of this page. If material changes are made, we will notify subscribers either by a prominent notice on our website or by direct email notification. We encourage regular review of this policy.

12. How Can You Contact Us About This Notice?

If you have questions, comments, or data inquiries regarding this notice, you may contact us by email; postal details for legal correspondence are available on request.

13. How Can You Review, Update, or Delete Your Data?

Based on the applicable laws of your country or state of residence, you have the right to request access to the personal data we hold about you, obtain details on its processing, correct inaccuracies, or request complete deletion.

To exercise your rights, please submit a verified request through our formal compliance portal:

You may also email us directly at privacy@statula.app. We will process and respond to your request within statutory time limits (typically 30 days).