Privacy Policy | xPlant Pro

xPlant is committed to protecting your personal information and your right to privacy. This policy explains what information we collect, how we use it, and the choices you have regarding your data.

Information we collect

We collect information you provide directly and information needed to run your workspace safely. This may include:

Account details such as your name, email address, organization, and sign-in activity.
Workspace content such as plants, explants, contamination logs, SOPs, media recipes, tasks, files, imports, and labels that you choose to store in xPlant.
Plan, billing, and transaction status needed to manage subscriptions. Full payment card details are handled by the payment processor and are not stored by xPlant.
Support requests, feedback, and messages you send to us.
Anonymised workflow signals (search queries, stage events) when you have explicitly enabled AI training data collection in your account settings. This is off by default.

How we use your data

We use your information to:

Provide, secure, and maintain your xPlant workspace.
Respond to support requests and send important account or billing notices.
Detect abuse, protect accounts, and troubleshoot reliability issues.
Improve product quality, workflows, and performance when analytics are enabled.
Improve AI-powered search and suggestions using anonymised signals, only when you have opted in to data collection.

How we protect your data

We use access controls, encryption in transit, permission checks, and data minimization practices to protect your information. We do not sell your personal information.

Cookies

We use essential cookies for sign-in, security, and preferences. Whether optional analytics and marketing cookies are on when you arrive depends on the privacy law where you are. Where the law allows it, they are on until you turn them off. Where it requires your agreement first, including in the European Union and the United Kingdom, and anywhere we have not yet reviewed, they stay off until you accept. If your browser sends a Global Privacy Control signal, they are not turned on for you by default. You can change your choice at any time from Cookie Settings in the site footer. Read the cookie policy for more detail.

Measuring visits

We use Google Analytics to count visits to our public pages and to see which pages people read, so we know what is useful and what is not.

What this collects: The page visited, the page you came from, your browser and device type, and an approximate location. When analytics is on, a cookie lets repeat visits from the same browser be counted together.
Who processes it: Google, as our processor, under the Google Analytics terms.
When analytics is off: No Google Analytics cookie is set and nothing is stored on your device. Google may still receive a basic page-view signal that carries no cookie identifier.

Live page activity

When analytics is on, pages you visit report an anonymous “someone is here” signal while the page is open, so our editors can see how many people are reading a page in real time.

What this collects: A count, and a coarse indication of which part of the page is on screen. Nothing that identifies you: no name, no email, no account id, no IP address, no device fingerprint, and no record of the visit once you close the page.
What it does not collect: Visitors with analytics turned off send no signal at all and are not counted.

Session recording

When analytics is on, we use Microsoft Clarity to record how visitors use our public pages, and to replay those sessions and view them as heatmaps, so we can see where a page is confusing.

What this collects: Pointer movement, scrolling, clicks and taps, the pages visited and the size of the browser window. Text you type into a form is masked before it is recorded.
Who processes it: Microsoft Corporation, as our processor, under Microsoft Clarity's own privacy terms and retention period.
What it does not collect: Visitors with analytics turned off are never recorded, recording stops as soon as analytics is turned off, and signed-in workspace screens are never recorded.

Forms and signups

When you send us something through a form on our public pages — an enquiry, or joining our updates list — we keep what you wrote so we can answer it, and add you to the list if that is what the form was for.

What this collects: Only what you type into the form and choose to send, plus the page you sent it from. A form never reads what you type until you submit it.
Who processes it: SHMAPLEX, the company behind xPlant, as our processor, using its own tools to alert the team and to hold our updates list.
How long we keep it: The message itself is deleted after 90 days. If you joined our updates list, we keep your address on it until you ask to be taken off.
Your choice: Email support@xplantpro.com at any time to be taken off the list or to have what you sent deleted, and we will do it.

Data retention

We keep information for as long as needed to provide the service, meet legal obligations, resolve disputes, and maintain security. You can request deletion or export where applicable.

Your rights

You may request access, correction, export, or deletion of your personal information. Some records may need to be retained where required for security, billing, or legal reasons.

Children's privacy

xPlant is not intended for children under 13, and we do not knowingly collect personal information from children.

AI features and training data

xPlant uses AI-powered search and suggestions to help you find plants, protocols, and media recipes faster. You may optionally allow xPlant to use anonymised signals from your searches and lab workflows to improve suggestion quality over time.

This feature is opt-in only. It is off by default and can be enabled or disabled at any time from Settings → Account → AI & Data.
When enabled, anonymised activity such as search query patterns and successful workflow events may be converted into numerical representations and stored in a private index. No personally identifiable information — including your name, email, workspace identity, specific plant names, or the content of SOPs and recipes — is included in this index.
Data from users who have not opted in is never collected or used for AI training purposes.
Disabling the setting stops all new data collection immediately. Previously collected anonymous signals are retained in aggregate form but are not linked to your identity.

Changes to this policy

We may update this policy as the product, legal requirements, or data practices change. The latest version will be posted here.

Contact us

If you have questions about this policy or how we handle your data, contact us at team@shmaplex.com.