Privacy notice · effective 19 September 2026
Your research data stays with you.
This notice explains how the Spatial Biology website and RCC Explorer handle personal data. Spatial Biology is the controller for website and account information. Privacy enquiries may be sent to [email protected].
Research files stay local
RCC contents, filenames, local project details, labels, counts, QC results, plots and exports are read and processed on your device. They are not uploaded to Spatial Biology, Firebase, DigitalOcean or Google Analytics. Folder access is read-only and source files are never edited.
Account information
If you create an account, Firebase processes your name, email address, institution, verification status, accepted terms version and minimal access events. We use this information to provide and secure the service. Do not enter sample, patient or other research-subject information in account fields.
Hosting and security logs
DigitalOcean serves the site and may process ordinary request information such as IP address, time, requested page, device headers and security events. These records support delivery, abuse prevention and troubleshooting.
Google Analytics and cookies
Google Analytics is optional. Its tag is not loaded and no analytics data is sent to Google until you select “Allow analytics”. If enabled, it helps us understand aggregate page use and may store analytics cookies or similar identifiers. Advertising storage, advertising user data and ad personalisation remain disabled. You can withdraw consent at any time using “Cookie settings” in the footer.
Legal bases
We process account and service data as necessary to provide the service and for legitimate interests in security and reliability. Optional analytics relies on consent. Where law requires a different basis, we will explain it at collection.
Retention
Local projects remain in your browser until you remove them or clear site data. Account, hosting and analytics records are kept only for as long as needed to provide and secure the service, meet legal obligations and resolve disputes. Provider backups and security records may persist for a limited period after deletion.
Sharing and international transfers
We use DigitalOcean for hosting, Google Firebase for identity and account records, and Google Analytics only after consent. These providers may process data outside the United Kingdom using their contractual transfer safeguards. We do not sell personal data.
Your rights
Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw analytics consent at any time. Contact the address above. You may also complain to the UK Information Commissioner’s Office.
Children and changes
The service is intended for professional and academic research, not for children. Material changes will be dated on this page. Continued use does not replace any consent required by law.
Back to home