Privacy Policy

This Privacy Policy explains what personal information Bramante Biologics Corporation(“Bramante,” “we,” “our,” or “us”) collects, why, and what we do with it. It covers three things together: this website (bramantebio.com), the reagent store you order from through it, and LabKick, our laboratory-operations software at app.bramantebio.com (together, the “Service”). Where something applies only to LabKick, we say so.

This Policy applies to visitors, waitlist signups, customers who order reagents, and organizations and Authorized Users who use LabKick. It does not cover third-party sites we link to, or services you connect to LabKick that we don’t operate, see Section IV for how third parties fit in.

If you use LabKick on behalf of an organization, that organization is usually the “controller” or “business” for the Customer Data its Authorized Users put into LabKick, and we act as its processor or service provider for that data, under a separate data processing agreement where one is in place. This Policy still governs the account, billing, and usage information we collect about you directly as an Authorized User.

Information you give us

• Account and contact details, name, work email, phone number, organization, job title, and shipping and billing addresses, when you create an account, request access, place an order, join a waitlist, or set up purchase-order terms.
• Order and shipping details, the products, catalog numbers, lots, quantities, and pricing on any order or quote request; purchase-order numbers; and any notes you attach (special handling instructions, project or PO references, delivery windows).
• Payment information, if you pay by card, our payment processor, Stripe, collects and stores your card number, expiration date, and CVC directly on its own systems. We never see or store the full card number. We receive back only a transaction reference, the payment status, the card brand, and the last four digits.
• Support correspondence, anything you send us by email, contact form, waitlist form, support ticket, or CoA/document request, including attachments, and the product interest, quantity, or timeline you tell us about.
• LabKick account and Customer Data, when you sign up for LabKick, we collect your name, work email, and organization to create your account. Once you use LabKick, you and your Authorized Users may enter or upload Customer Data, inventory records, protocols, notebook entries, files, and any prompts or documents submitted to an AI feature. Customer Data is addressed separately in Section V; it is not used the way this Policy describes for other information.

Information collected automatically

• Usage and device data, pages viewed, referring page, links clicked, search terms, approximate location (derived from IP address), device type, browser type and version, operating system, and timestamps, for both the Site and LabKick. In LabKick, this also includes which features and modules you use and how often.
• Server and security logs. Our hosting provider logs request metadata (IP address, user agent, requested URL, response status) for security, abuse prevention, rate-limiting, and uptime diagnostics.
• Cookies and similar technologies, described in Section X.

Information from our processors and partners

• Stripe gives us order and payment status (authorized, captured, refunded, disputed) for orders paid by card, and subscription and invoice status for LabKick billing.
• Shipping carriers give us delivery and exception status (in transit, delivered, temperature excursion flagged) for orders we ship.
• If you sign up through a referral, integration, or single sign-on provider you choose to connect, that provider gives us the account details needed to create or link your account.

We use personal information to:

• Take, fulfill, ship, and invoice orders, and issue CoAs, SDS, and datasheets on request.
• Set up and administer purchase-order and Net-30 terms, including basic credit review.
• Create and administer LabKick accounts, provision seats, and enforce Subscription limits.
• Operate the Service, search, cart, checkout, catalog browsing, and LabKick’s features.
• Respond to inquiries, waitlist requests, and support tickets.
• Send order and shipping updates and LabKick account and billing notices (transactional) and, if you opt in, product and restock notices (marketing), kept separate, and you can unsubscribe from the latter at any time.
• Detect fraud, secure the Service, enforce our terms, and comply with tax, export-control, and other legal obligations.
• Decide what to manufacture next and what to build next, aggregated, de-identified waitlist, order-volume, and product-usage signal, not your individual identity, drives what we prioritize.

If you’re in the European Economic Area, the UK, or another jurisdiction that requires a stated legal basis, we rely on: performance of a contract (taking your order, running your LabKick Subscription); our legitimate interests (securing the Service, improving it, and understanding aggregate usage, balanced against your rights); legal obligation (tax, accounting, export control); and consent, where we ask for it specifically (marketing email, certain cookies). You can withdraw consent at any time without affecting anything we did before you withdrew it.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only with the vendors and partners who need it to run the Service, under contracts that limit their use of it to that purpose. Our current sub-processors:

We keep this list current; if a change materially affects how your data is handled, we’ll update this Policy and, for material changes, give more prominent notice per Section XV. We also disclose personal information if required by law, subpoena, or valid legal process; to protect the rights, property, or safety of Bramante, our customers, or the public; or in connection with a merger, financing, or sale of some or all of our assets, in which case we will require the successor to honor the commitments in this Policy.

Customer Data, the inventory records, protocols, notebook entries, files, and other content you or your Authorized Users put into LabKick, including anything submitted to an AI feature, is not “personal information we collect about you” in the usual sense. It’s your organization’s content, and we process it as a service provider or processor on your organization’s instructions, under our Terms of Service and, where one is in place, a signed data processing agreement.

We use Customer Data to provide and support LabKick for you, which covers running the features you use, maintaining backups, and troubleshooting issues you report. We may use it in aggregated, de-identified form, not attributable to you, your organization, or any individual, to monitor performance and improve LabKick. Organizations that need specific written commitments about how their data is handled should ask us for an enterprise agreement. See our Terms of Servicefor the full license terms and the “bring your own key” option for AI features.

If Customer Data includes personal information about someone other than you, a colleague’s name in a protocol, for example, your organization is responsible for having a lawful basis to put it into LabKick. We process it only as instructed by the organization that controls the account.

You can sign in to Bramante and LabKick with your Google account. When you do, Google shows you exactly what you are granting and, if you approve, sends us a limited set of information about you: your name, your email address, your profile picture, and the unique account identifierGoogle assigns you. We also receive whether Google has verified that email address.

That is the whole list. We ask Google only for basic sign-in and profile information. We do not request access to your Gmail, your Drive, your Calendar, your contacts, or anything else in your Google account, and we cannot read any of it.

We use what we receive for one purpose: to create your account, to sign you in, and to reach you about your account and your orders. We do not sell it, we do not share it with advertisers, we do not use it for advertising, and we do not use it to train our own models or any third-party AI model.

Bramante’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can revoke our access at any time from your Google account permissions page. Revoking access stops future sign-ins with Google; it does not by itself delete the Bramante account or the order records we are required to keep. To delete those, see Your rights below, or email support@bramantebio.com.

Signing in with Google is optional. You can create an account with an email address instead, and nothing about your access to the catalog, the published prices, or the specifications depends on which you choose.

Bramante is based in the United States, and the infrastructure and sub-processors listed in Section IV process information primarily in the United States. If you access the Service or place an order from outside the U.S. your information will be transferred to and processed in the United States, which may have different data-protection rules than your home jurisdiction. Where required, we use appropriate safeguards for these transfers, such as standard contractual clauses with a sub-processor, and we take reasonable steps to protect information consistent with this Policy wherever it is processed.

We keep information only as long as we need it for the purposes above:

• Order, invoice, and CoA-request records, kept for as long as needed to support the products we sold you (lot traceability, warranty, returns) and as required by tax, accounting, and export-control recordkeeping obligations, typically seven years after the transaction.
• Payment information. We never hold full card numbers; Stripe retains payment records under its own retention policy and applicable card-network rules.
• Account and correspondence information, kept while your account or relationship is active and for a reasonable period after (typically up to 3 years), then deleted or anonymized, unless a longer period is needed for the reasons above.
• Waitlist submissions, kept until the product ships or the signal is no longer useful for planning production, then deleted.
• LabKick Customer Data, kept for the life of your Subscription, plus the 30-day export window described in our Terms of Serviceafter it ends, unless we’re required to retain it longer for legal, tax, or audit purposes.
• Server and security logs, kept for a limited operational window, typically 90 days, then deleted or aggregated.

We use administrative, technical, and physical safeguards designed to protect personal information and Customer Data, including encryption in transit and at rest, access controls that limit who inside Bramante can see what, and vendor agreements that require our sub-processors to protect data appropriately. No system is perfectly secure, and we can’t guarantee that information will never be accessed, disclosed, altered, or destroyed by a breach of any of our physical, technical, or managerial safeguards. See Section XIV for what happens if that occurs.

We use a small number of cookies and similar local-storage mechanisms:

• Strictly necessary, keeping your cart contents between pages and keeping you signed in to your account or LabKick session. The Service does not function without these.
• Analytics, aggregate, privacy-respecting usage measurement for the Site and LabKick, described in Section II.

We do not use third-party advertising cookies or cross-site trackers. Most browsers let you block or delete cookies through their settings; blocking the strictly-necessary ones will break cart, checkout, and sign-in functionality. Where we’re required to ask for consent before setting non-essential cookies, we will.

LabKick’s AI features can summarize, extract, or suggest content from Customer Data, and our systems may flag orders for manual fraud or credit review. These tools support a decision; they don’t make a final decision about you or your organization without a person able to review it on request. We do not use automated processing to make decisions that produce legal or similarly significant effects about you without an opportunity for human review.

Wherever you are, you can ask us to confirm what personal information we hold about you, to correct it, or to delete it. To exercise any of these, email support@bramantebio.com, or write to us at 160 Alewife Brook Parkway, STE 1316, Cambridge, MA 02138, USA. We will verify your request and respond within a reasonable time, and in any case within the period required by applicable law. Some information we may have to keep or redirect rather than delete, an order and invoice record tied to a completed sale, or Customer Data your organization controls in LabKick, and we will tell you when that applies.

If you’re in the EEA or UK (GDPR)

For the account, billing, and usage information described in this Policy, the controller is Bramante Biologics Corporation, 160 Alewife Brook Parkway, STE 1316, Cambridge, MA 02138, USA, reachable at support@bramantebio.com. In addition to the rights above, you have the right to receive a copy of your data in a portable format, to object to processing based on our legitimate interests, to restrict processing in certain circumstances, and to withdraw consent at any time where we rely on it. You also have the right to lodge a complaint with your local data protection authority.

If you’re a California resident (CCPA/CPRA)

California law gives you the right to know what personal information we’ve collected about you and why, to delete it, to correct inaccurate information, and to receive it in a portable format. We do not sell or share personal information as those terms are defined under California law, so there is nothing to opt out of today; if that changes, we will post a clear opt-out mechanism here and honor recognized opt-out preference signals. We will not discriminate against you for exercising any of these rights. To exercise a California right, email support@bramantebio.com or write to us at the postal address in Section XVI; we may need to verify your identity before acting on certain requests. You may also designate an authorized agent to submit a request on your behalf.

The Service is intended for laboratory professionals and organizations, not children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us at support@bramantebio.com and we will delete it.

If a breach of security compromises personal information in a way that triggers a legal notification obligation, we will notify affected individuals and, where required, the relevant regulator or supervisory authority, without undue delay and consistent with applicable law. For LabKick customers, we will also notify the organization’s account administrator so it can meet its own notification obligations for Customer Data.

We may update this Policy as our products, sub-processors, or legal obligations change. We will post the revised version here with a new “last updated” date, and for material changes we will provide more prominent notice, a site banner or an email to account holders.

Questions about this Policy, or a request regarding your personal information, including a GDPR or CCPA request: email support@bramantebio.com, or write to us at the address below. See also our contact page.