This policy explains what personal data Posolix collects through posolix.com and your account, why, and what you can do about it.
Who we are
Posolix is operated by Nodeledger OÜ ("we", "us"), which is responsible for the personal data described here. You can reach us about anything in this policy at info@posolix.com.
- Company
- Nodeledger OÜ
- info@posolix.com
What we collect
Team members
If an admin of a Posolix account invites you, we receive your email address from them and send you the invitation. If you don't accept it, the admin can remove you, and we delete it.
Your account
When you create an account, we keep your email address, organization name, a hash of your password if you set one, saved searches, subscriptions, webhook endpoints and API keys (stored hashed), plus logs of API requests and webhook deliveries.
Why: to run the service, enforce plan limits, send the alerts you asked for, and keep the service secure. Legal basis: performing our contract with you.
Payments
If you choose a paid plan, Stripe handles the payment and your card details on our behalf. We don't see or store your full card number. We keep your billing name and address, VAT ID if you give one, plan, invoices and payment status, and Stripe keeps them too.
Why: to bill you and to meet tax and accounting rules. Legal basis: performing our contract with you, and our legal obligations.
Website analytics
We use Google Analytics to understand how visitors find and use the site, for example which pages are read and which lead to sign-ups. Google Analytics sets cookies (_ga and _ga_*) and collects information such as the pages you visit, how you arrived, your browser and device type, and an approximate location derived from your IP address. We don't use this data to identify you, and we don't use advertising features.
Legal basis: your consent. Google Analytics only loads after you accept it in the cookie banner, and you can change your choice at any time with "Cookie settings" at the bottom of every page. We remember your choice in a cookie called posolix_consent, which is needed for the site to respect it.
Hosting and fonts
The site and the service are hosted on Heroku, which may log visitors' IP addresses for security. Fonts are loaded from Google Fonts, so your browser sends your IP address to Google when a page loads. We don't receive these logs.
Emails you send us
If you email us, we keep the message and your address to reply and to follow up on your request.
Who we share it with
We don't sell your personal data or share it for advertising. We use these service providers, who process data on our behalf:
- Stripe (payments, invoices and billing details)
- Resend (sending email: sign-in links, alerts and billing notices)
- Heroku, a Salesforce company (hosting and database)
- Google (Analytics, only with your consent, and Fonts)
They may process data in the United States. Where data leaves the European Economic Area, transfers rely on the EU-US Data Privacy Framework or standard contractual clauses.
How long we keep it
- Account data: for as long as you have an account. Deleting it (on the Account page) removes it straight away; copies in our database backups are overwritten within 30 days.
- Invoices and payment records: as long as tax and accounting law requires, usually up to 10 years.
- Analytics data: for the retention period set in Google Analytics, 14 months at most.
- Emails: as long as needed to handle your request.
Your rights
Depending on where you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent at any time. Email info@posolix.com and we'll reply within 30 days. You can also delete your account yourself on the Account page in the dashboard. You also have the right to complain to your local data protection authority.
Data we process about others
The trial, drug approval and label records Posolix tracks come from public US government sources. They can include names of sponsors, companies and trial contacts as published in those sources. We don't combine them with data about website visitors.
Children
Posolix is not directed at children under 16, and we don't knowingly collect their personal data.
Changes to this policy
We'll update this page when our practices change, for example when we add a service provider. The date at the top shows the latest version. For significant changes, we'll also email account holders.