Privacy Policy

SafetyDataSheetAPI is a product of Dscvry and is operated by Discovery AI Limited, 167-169 Great Portland Street, London W1W 5PF, United Kingdom, which is the controller of the personal data described here. This Privacy Policy describes how we collect, use, disclose, and retain information when you use safetydatasheetapi.com, including sample SDS uploads, API-related requests, and contact submissions.

1. Data We Collect

We may collect the following categories of data:

• Contact data: full name, work email, company, role title, and message content submitted through contact forms and sample output access actions.
• Account and payment data: email address, optional company name and VAT number, billing name and address entered at checkout, payment records (amount, currency, tax, invoice links) and API key hashes. Card details are handled by Stripe and never reach us.
• Document metadata: file name, size, language hint, schema version, and extraction processing metadata.
• Technical data: IP address, user agent, request path, country/region/city, and related request metadata provided by Cloudflare.
• Website analytics data: page path, referring address, screen width, campaign (UTM) parameters, time on page, and clicks on outbound links and file downloads on our public pages, recorded without cookies (see section 9).
• Security and abuse-prevention data: Cloudflare Turnstile verification outcomes and anti-abuse telemetry.

2. How We Use Data

• Operate and secure the website and API endpoints.
• Process sample uploads and return structured extraction outputs.
• Respond to contact requests and implementation inquiries.
• Detect abuse, fraud, and unauthorized access attempts.
• Monitor system reliability and improve service performance.
• Understand which public pages are used, so we can improve the website and documentation.
• Comply with legal and regulatory obligations.

3. Legal Bases (Where Applicable)

For EEA/UK users, processing may rely on one or more of the following legal bases: legitimate interests, performance of a contract (your account and purchases), legal obligation compliance, and consent (where required).

Our privacy operations are designed to support compliance with applicable frameworks, including EU GDPR (Regulation (EU) 2016/679), UK GDPR and UK data protection law, and California privacy law (CCPA as amended by CPRA), where those laws apply.

4. SDS Sample Content and Retention

Sample uploads are intended for evaluation and abuse-controlled processing. We do not use customer-submitted SDS documents to train public foundation models. Data retention periods may vary by deployment and contract terms. For enterprise deployments, retention windows can be configured.

Customer accounts and the dashboard. To sign in we use Firebase Authentication (Google); it processes your email address and sign-in credentials. We store your account (email, optional company and VAT number), API key hashes, a credit ledger and a usage log (time, page count, status and cost per request; no document content). Documents you extract in the dashboard are not stored; only the extraction result is kept in your history for 30 days by default, after which it is deleted automatically, and you can delete any result or all results at any time. Results of synchronous API extractions are not kept. Bulk jobs keep their per-file results for 7 days so you can collect them; after that they can no longer be retrieved and are deleted automatically. Payments are processed by Stripe: we receive the payment record (amount, currency, tax, invoice links and your Stripe customer ID) and, for businesses, the name, billing address and VAT number you enter at checkout, but never your card details. Accounts, ledger and usage records are kept for as long as the account exists and, for invoices and payment records, for at least six years as UK accounting and tax law requires. You can ask us to delete your account; we then remove personal data we are not required to keep.

5. Processors and Infrastructure

We use infrastructure and security service providers, including Cloudflare for hosting, edge security, and bot mitigation controls, Google (Firebase Authentication) for customer sign-in, and Stripe for payments (Stripe's privacy policy). For extraction processing, configured model providers may receive uploaded document content solely to return extraction results.

6. International Data Transfers

Our providers (Cloudflare, Google, Stripe) may process data in the United Kingdom, the European Economic Area, the United States and other countries; data may be processed in countries other than your own depending on chosen deployment model. Where required, we implement appropriate safeguards for cross-border data transfers.

7. Your Rights

Depending on jurisdiction, you may have rights to request access, correction, deletion, portability, restriction, objection, or appeal related to your personal data. To exercise rights, email [email protected].

8. U.S. State Privacy Notice

If you are covered by applicable U.S. state privacy laws (including laws effective in states such as California and other U.S. states with comprehensive privacy statutes), you may have rights to know, delete, correct, and opt out of certain data uses. We do not sell personal information in exchange for monetary consideration.

Because U.S. state privacy law requirements continue to expand, we review this policy periodically and update notice language to reflect newly effective state-level requirements.

9. Cookies and Similar Technologies

We use strictly necessary technologies for security, session handling, and anti-abuse controls.

For visit statistics on our public pages we use Traks, a privacy-focused analytics tool that we run ourselves on our own Cloudflare account (analytics-collect.safetydatasheetapi.com), so this data is not sent to an outside analytics provider. Traks sets no cookies. It keeps a random identifier in your browser's session storage, which goes away when you close the tab and is replaced after 30 minutes of inactivity, and it records the page path, referring address, screen width, campaign (UTM) parameters, time on page, and clicks on outbound links and file downloads. It is not loaded in the dashboard or the API documentation. We rely on legitimate interests for this processing. The technical request data described in section 1 is separate and is kept by our hosting provider and our own request logs.

10. Security

We maintain administrative, technical, and organizational safeguards designed to reduce unauthorized access, alteration, disclosure, and destruction risk. No internet transmission or storage system can be guaranteed as 100% secure.

11. Children

The service is intended for business users and is not directed to children under 16.

12. Policy Updates

We may update this Privacy Policy to reflect operational, legal, and regulatory changes. Updates become effective on publication unless a different date is stated.

13. Contact

Privacy or data-rights requests: [email protected].

Notice: This policy is informational and does not constitute legal advice.