Privacy notice

The controller for data processing on the website oncera.ai and in the research portal app.oncera.ai is:

Oncera GbR Am Klopferspitz 19a 82152 Planegg-Martinsried Germany

Partners authorised to represent the partnership: Stefan Munker, Niklas Laasch Email: info@oncera.ai

Oncera is a research project set up as a partnership under German civil law (GbR). A GmbH is planned but does not exist yet. We will update this notice once it does.

We have not appointed a data protection officer. The conditions of Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG) are not met in our case. For any privacy question, use the contact details in the section "Controller".

The website and the portal are hosted by Vercel Inc., USA. The server functions that build the pages and process what you enter in the portal run in Vercel's Frankfurt am Main region, next to our database. Every request first reaches the Vercel location nearest to you. That location handles the encryption of the connection and checks whether you are signed in and which pages you may open; it delivers static files such as images itself and passes everything else on to Frankfurt. When a page is requested, Vercel processes technically necessary access data in server logs: your IP address, date and time, the address requested, the referring page, and details of your browser and operating system. In addition there are application logs, which can contain account data when an error occurs.

Purpose: secure and stable delivery of the pages, prevention of abuse, troubleshooting. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable operation). Recipient: Vercel Inc., USA, as processor. Third-country transfer: USA, because Vercel Inc. and its sub-processors can access the data from there, on the basis of the EU standard contractual clauses in the data processing agreement with Vercel, which applies as part of its terms of service since 5 May 2026 (version of 31 Mar 2026). Retention: Vercel keeps the logs for a short period only. We do not evaluate them systematically.

Access to your device is governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). We store only what is strictly necessary for the service you asked for. For that, Section 25(2) no. 2 TDDDG requires no consent:

• Language cookie oncera-site-locale: remembers whether you want to read the site in German or English. Lifetime one year, this website only, not readable by third parties. It controls the display only.
• Consent flag oncera-analytics-consent: kept in your browser's localStorage and records whether you accepted or declined analytics and error reports. Deliberately not a cookie, so that a No does not itself place an identifier on your device. On a No we also place the entry umami.disabled in localStorage, which tells the counting tool not to count you; on a Yes we remove it again.
• Sign-in cookies in the portal: a session cookie (signed token, lifetime eight hours or until you sign out, httpOnly), a cookie protecting against cross-site request forgery, and one for the return address after signing in. Without them, signing in is not possible.

Legal basis: Art. 6(1)(f) GDPR. No other storage access to your device takes place without your consent.

If you write to info@oncera.ai or to a personal address at oncera.ai, we process your details in order to answer your request. Our mailboxes are operated by Google Ireland Limited (Google Workspace) as processor.

Purpose: handling your enquiry. Data categories: email address, name and the content of your message. Legal basis: Art. 6(1)(b) GDPR where it concerns starting or carrying out a collaboration, otherwise Art. 6(1)(f) GDPR (legitimate interest in replying). Recipient: Google Ireland Limited as processor. Retention: until your enquiry is closed. Where a collaboration follows, for its duration and beyond that for as long as statutory retention periods require.

On the page "Request access" you can put yourself forward as a possible co-development partner. We store what you enter in the form: name, organisation, email address and what you say you are working on, plus the time of the request and the language you read the page in. To fend off automated entries the page checks a hidden form field and limits the number of requests per connection; for that the server counts your IP address in its working memory when you submit and writes it nowhere.

Purpose: reading and answering your request and, where there is a fit, preparing a conversation about a co-development project. Data categories: name, organisation, email address, free text about your work, time, language. Legal basis: Art. 6(1)(b) GDPR (steps at your request prior to a collaboration) where you are yourself a party to the possible collaboration; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests from organisations you act for). Recipient: Supabase Pte. Ltd., Singapore, as processor; the database runs in Frankfurt am Main. A notification of your request goes to our mailbox at Google Workspace (Google Ireland Limited), and we reply from there. Third-country transfer: Singapore, where Supabase Pte. Ltd. is based, on the basis of the EU standard contractual clauses in the data processing agreement with Supabase. Retention: until your request is dealt with. If a collaboration follows, for its duration and beyond that for as long as statutory retention periods require. If none follows, we delete the request no later than twelve months after our last message to you. On your request we delete it earlier.

The button for a call takes you to the booking service zcal (zcal, Inc.; hosted in the United States according to its own terms), which opens in a new tab. Only there do you enter details to pick a slot. The booking service is a separate controller; its own privacy notice applies. It receives no data about you from us. We receive from it the details you provide for the appointment and enter the appointment in our calendar at Google Workspace.

Purpose: arranging a call. Data categories: name, email address, chosen slot and anything you add voluntarily. Legal basis: Art. 6(1)(b) GDPR (steps at your request prior to a collaboration).

On the Token Audit page the button for a call takes you to the same booking service zcal, into a separate calendar for that offer. What the previous section says applies: the service is a separate controller, receives no data about you from us, and we take the details you provide there for the appointment into our calendar at Google Workspace.

Purpose: arranging a call. Data categories: name, email address, chosen slot and anything you add voluntarily. Legal basis: Art. 6(1)(b) GDPR (steps at your request prior to a collaboration).

This website contains links to external services, among them the booking service and LinkedIn. When you follow such a link you leave our website. We have no control over the processing carried out by the linked provider; its privacy notice applies.

The fonts we use (Raleway, Inter, JetBrains Mono) are bundled when the website is built and served from our own hosting. Loading a page sends no request to Google Fonts or any other font service.

The portal is an access-restricted research area. It is reachable only after signing in and only intended for invited people. The following sections describe the processing inside the portal. They are of no relevance to visitors of the public website.

If you were invited through your organisation, we may have received your email address from that organisation or from the person who arranged the invitation (Art. 14 GDPR). Name and email address are required to use the portal; without them no account can be created.

To use the portal we create an account for you. Registration is only possible with a valid invite code; the code determines your role, for example partner, coach or reviewer. Invite codes issued in the portal can be used once, expire, and can be tied to one email address. An account can have an end date, after which it can no longer sign in. An administrator can change your role, set or extend the end date, disable the account and end its sessions. Registration and every such change are recorded in the audit trail (section "Audit trail").

Purpose: providing the portal, sign-in and access management. Data categories: email address, name, role, the end date of the account if one is set, when it was disabled and when its sessions were last ended, and a bcrypt hash of your password. We do not store the password itself. Of an invite code we store only a SHA-256 hash, together with the role it grants, its expiry, the email address it is tied to if any, the end date it gives the account, an optional note by the administrator (for example your name), which administrator created it and when, and when and by which account it was redeemed. Legal basis: Art. 6(1)(b) GDPR where you are yourself a party to the collaboration; otherwise Art. 6(1)(f) GDPR (legitimate interest in providing the portal to the partner organisation, its staff, coaches and invited reviewers). Recipient: Supabase Pte. Ltd., Singapore, as processor; the database runs in Frankfurt am Main. Third-country transfer: Singapore, where Supabase Pte. Ltd. is based, on the basis of the EU standard contractual clauses in the data processing agreement with Supabase. Retention: for as long as the account exists, see the section "Retention and deletion".

You can protect your account with two-factor authentication (TOTP). We store the required secret encrypted with AES-256-GCM; the decryption key is not kept in the database. Recovery codes are stored only as a SHA-256 hash.

For a password reset we create a token and store only its hash. It is valid for one hour, can be used once, at most three tokens per account are valid at the same time, and on redemption every other outstanding token is invalidated. The link goes to the address of your account.

Purpose: account security and restoring access. Data categories: encrypted TOTP secret, hashed recovery and reset tokens. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in account security) and, where a contract with you exists, Art. 6(1)(b) GDPR.

In the portal you submit runs. A run includes a reference to a target structure (a PDB identifier or an AlphaFold model), an antibody sequence in one-letter code, and the run parameters. We store these inputs and the computed results. Molecular and sequence data are not personal data in themselves, but they are linked to your account.

As long as no external compute provider is connected, either the application itself produces the result, that is on the servers of our hosting provider Vercel in Frankfurt am Main, or a member of our team computes the run on an Oncera workstation and enters the result. A member of our team sees the inputs and results of your run in the process.

For the 3D view, your browser loads the coordinates of public structures directly from files.rcsb.org (RCSB Protein Data Bank, a non-profit institution in the USA). RCSB receives your IP address and the identifier of the requested structure, no account data. There is no contractual safeguard for this request; it does not happen if you do not open the structure view.

Purpose: running the requested analysis and displaying the results. Data categories: target-structure reference, antibody sequence, run parameters, results. Legal basis: Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR. Recipient: Supabase Pte. Ltd., Singapore (database in Frankfurt am Main); RCSB (USA) only for the structure display. Retention: see the section "Retention and deletion".

If you request synthesis for a variant, we store the request: your account address, the chosen variant and your note. A member of our team selects the synthesis partner, records it on the request, forwards the variant there and keeps the status of the request in the portal. The partner receives the sequence of the variant and our team as the ordering party, not your account address.

Purpose: handling your synthesis request. Data categories: account address, variant, notes, recorded synthesis partner, status history. Legal basis: Art. 6(1)(b) GDPR. Recipient: Supabase Pte. Ltd., Singapore (database in Frankfurt am Main); the synthesis partner we commission receives the variant, no data about you. Retention: see the section "Retention and deletion".

For a Token Audit, a member of our team records the client's details in the portal: company name, name of a contact person, industry, the workflows examined, models used and monthly spend. The contact person learns of this processing through this notice (Art. 14 GDPR); their details come from the engagement conversation.

Purpose: producing the audit. Data categories: company name, name of the contact person, details of workflows, models and spend. Legal basis: Art. 6(1)(b) GDPR towards the client, Art. 6(1)(f) GDPR towards the contact person. Recipient: Supabase Pte. Ltd., Singapore (database in Frankfurt am Main). Retention: until the audit is completed and beyond that for as long as statutory retention periods require; earlier on request.

The portal keeps an audit trail of who opened, created or exported which content and when, and whose material was affected, as well as of sign-in and security events: enabling and disabling two-factor authentication, failed codes, use of a recovery code, password resets and administrator access. It also records account and role management: the creation of an account, and every change an administrator makes to an account’s role, end date, lock or sessions, to a role or to an invite code, together with who made it. The application only adds entries; it neither changes nor deletes them. The trail never contains the content itself, only identifiers, timestamps, the type of action and additional details without content data.

Purpose: to show who viewed confidential material, as non-disclosure agreements with partners require, and for security and abuse prevention. Data categories: acting person (email address, role), action, the object affected and its owner, timestamp, additional details. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in accountability, in meeting confidentiality obligations towards partners and in the security of the portal). Retention: for the duration of the record-keeping duties under the respective agreements. Entries are kept even when the related account is deleted.

For your runs and requests the portal sends status emails, for example when a run has been received, started or finished. These messages contain no content from your runs, no structures, sequences or results, only a notice and a link into the portal. We log every send attempt with recipient address, template, subject, status and time.

Purpose: to inform you about the status of your matters. Data categories: email address, subject, notice text without content data, send log. Legal basis: Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR. Recipient: Supabase Pte. Ltd., Singapore (database in Frankfurt am Main) for the send log.

An email delivery service is not set up yet. Until it is, notifications and password-reset links are not sent by email; they are written to the application log of our hosting (Vercel) and passed on personally by an administrator. The same applies to the notification of a new request from the form "Request access": it sits in that log with what you entered in the form. Once the delivery service is set up, we will add its details to this notice.

For internal planning views we read feature toggles for the coach role and planning data (roadmap) from Notion and write changes back to them. No account data of portal users is transmitted to Notion for this.

Purpose: internal planning and controlling which portal areas are visible to the coach role. Data categories: planning and configuration data, no account data. Legal basis: Art. 6(1)(f) GDPR. Recipient: Notion Labs, Inc., USA. Third-country transfer: USA, on the basis of the EU standard contractual clauses in the data processing agreement with Notion, which is incorporated by reference into its terms of service and has applied since March 2025.

The portal produces its results with AI-based methods. The variants and scores it outputs are AI-generated predictions and have not been validated in a laboratory. Oncera is a research project, not a commercial service; the results are for research use only, not for diagnostic or therapeutic purposes. We give this notice regardless of whether Art. 50 of the AI Act, Regulation (EU) 2024/1689, applies to us.

No automated individual decision-making with legal effect on you within the meaning of Art. 22 GDPR takes place.

For our own writing and our own code we use AI assistants whose providers are based in the United States. We do not enter portal data, partner data or patient data there.

The data sits in data centres in the EU: the database with Supabase in Frankfurt am Main, the server functions with Vercel in Frankfurt am Main, and the email mailboxes and calendar with Google Ireland Limited, whose data region is set to Europe. Two of these processors are based outside the EU and can access the data from there: Vercel Inc. in the USA and Supabase Pte. Ltd. in Singapore. For both, the EU standard contractual clauses in the respective data processing agreement apply, and that agreement is part of the provider terms of service, for Vercel since 5 May 2026 and for Supabase since 8 Jul 2025. Notion Labs, Inc. (USA) processes only the planning data described in the section "Permissions", likewise on the basis of the standard contractual clauses. For the structure display your browser retrieves public data from the RCSB Protein Data Bank (USA) without a contractual safeguard. Where the optional services described above are active, what is said there applies to them. The booking service is a separate controller. We provide the records relating to the standard contractual clauses on request.

Until the company is formed, the contracts with Vercel, Supabase and Notion run in the name of Niklas Laasch personally, who works for Oncera. On formation the accounts pass to the company and we will update this section.

We keep personal data only as long as necessary for the purposes stated or as required by statutory retention periods. In detail:

• Server logs: for a short period at the hosting provider, without evaluation by us.
• Analytics: aggregated statistics without personal reference, for as long as the website is operated.
• Contact enquiries: until closed; where a collaboration follows, for its duration and the statutory retention periods.
• Requests through "Request access": until dealt with; where a collaboration follows, for its duration and the statutory retention periods; otherwise no later than twelve months after our last message.
• Account, runs, results, synthesis requests and send log in the portal: for the lifetime of the account. They are currently not deleted automatically. On your request we delete your account with all linked data.
• Audit trail: for the duration of the record-keeping duties under non-disclosure agreements. The entries carry the email address of the person acting and remain for that period after an account deletion; the deletion itself is recorded as an entry of its own.
• Status changes on the internal project backlog, which only accounts with the admin role can make: for as long as the backlog is kept. Each entry carries the email address of the admin who made the change and remains after that account is deleted.

We are setting fixed deletion periods per data type in writing and will add them here.

Under the GDPR you have the following rights regarding your personal data:

• access to the data we hold about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• withdrawal of a consent you have given, with effect for the future (Art. 7(3)).

You can change your consent to analytics and error reports at any time at the end of this page. For everything else, contact us at info@oncera.ai.

Where we process data on the basis of our legitimate interest under Art. 6(1)(f) GDPR, you may object to that processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

Send your objection to info@oncera.ai.

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach, Germany

Regardless of this, you may contact the supervisory authority of your habitual residence.

We protect your data with technical and organisational measures: encryption of all transmission over HTTPS, passwords stored only as a bcrypt hash, optional two-factor authentication with an encrypted secret, reset and recovery codes stored only as a hash, a database reachable only server-side through a secret key, role-based access rights in the application that separate external partners, and an audit trail to which the application only writes and in which nothing is changed or deleted. We keep developing these measures.

The date of this version is shown at the top of the page. We update the notice when the processing changes, for example when the planned GmbH is formed or another service is added. The current version is always available on this page.