On this page
Who operates the serviceInformation processed and whyLegal basesWho can access your informationEmail codes, personal links and admin verificationHosting, email delivery and identity providersEssential cookies and browser storageAIRetention, deletion and exportsYour rightsThis English notice applies to the signed-in Ongoing Science Drawings pilot at fli-drawings-backend.onrender.com, initially for approved FLI participants. The browser-only demo and marketing website have a separate privacy notice.
Who operates the service
Dr. Philipp Münch, c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany. Contact for privacy requests: support@ongoingscience.com. Ongoing Science is a project in preparation, not a registered company. Use of an HZI email address does not make HZI the operator of this pilot.
The operator is responsible for pilot account administration and service operation. If your institute supplies personal data in drawings, its responsibilities and any processing on its behalf must be covered by the applicable institutional agreement before those data are uploaded. This pilot is intended for non-sensitive scientific illustrations.
Information processed and why
| What | Why | How long |
|---|---|---|
| Email-code sign-in, where enabled: | we process the institute email address you enter, its domain, a verification challenge and account identifiers to send a code, check mailbox access and open the correct account. Institute admins configure the exact domains permitted to join. Successful verification normally creates an ordinary member account; it does not automatically grant admin access. We do not ask for your mailbox password. | See Retention, deletion and exports |
| Institute single sign-on, where configured: | Life Science Login or your institute’s identity provider supplies an identity identifier and issuer, and may supply profile information and an email address with its verification status. These identify your account and match approved access. We do not receive your institutional password. | See Retention, deletion and exports |
| Accounts and sharing: | workspace membership, verified email-to-account mappings, member display information, permissions, session records and invitation details are used to control access and identify collaborators. | See Retention, deletion and exports |
| Drawings: | titles, text, imported images or vector content, drawing objects, sharing settings and collaboration updates are transmitted to and stored on the service so you can save, reopen and collaborate. Connected collaborators receive updates and presence information. | See Retention, deletion and exports |
| Operations: | hosting providers process connection and request information such as IP addresses, request times, paths, browser information and errors to deliver and protect the service. The app also uses temporary request limits to reduce code guessing and unwanted email, and records security-related admin actions such as verification, email linking and access-setting changes. Session records include account and workspace identifiers, creation and expiry times, and browser information. Support messages contain whatever you choose to send. | See Retention, deletion and exports |
Legal bases
Account administration, access control, security and support are based on legitimate interests under Article 6(1)(f) GDPR: providing a secure, functioning research-software pilot to approved participants. Where processing is necessary to provide a service you contract for personally or take steps at your request before a contract, Article 6(1)(b) applies. Legal obligations may require processing under Article 6(1)(c). Any processing of institute-controlled content needs the institute’s own lawful basis and applicable agreement.
Sign-in information is necessary to use the hosted app. Without it, we cannot provide a signed-in account. We do not use pilot data for advertising or automated decisions with legal or similarly significant effects.
Who can access your information
Drawings start private to their owner in the application. Owners can share with selected workspace members as viewers or editors. Institute admins can see membership and email information needed to manage access. Other members can see directory information needed to choose sharing recipients; this may include an email address used as the account’s display name. A link to a private drawing does not grant access by itself. If public-link sharing is enabled and an owner creates a public viewing link, anyone holding that link can view the shared drawing until the link is revoked. People with access can make exports; revoking access cannot recall copies already downloaded.
Authorised service operators and hosting providers may access stored data where necessary for support, maintenance, recovery or security. Application privacy is access control, not end-to-end encryption. We may disclose information when required by law.
Email codes, personal links and admin verification
Email codes are valid for ten minutes, can be used successfully only once and allow up to five verification attempts. Requests are limited by address or admin account and connection information. The app keeps hashes of codes with temporary verification records in server memory; pending codes become invalid after a server restart. Expired records are cleaned up during subsequent requests or when the process ends. A code expiring in Drawings does not delete the email from your inbox or the delivery provider’s records.
An operator may instead provide a private personal sign-in link for an approved participant. Link tokens are stored as hashes in the pilot database. These links can be reused for up to twelve days from creation, unless replaced or revoked, and create a session lasting up to eight hours on each successful sign-in. Possession of the link grants access as that participant; it does not verify an email address. Valid personal links and email/personal-link sessions can survive a service restart until their original expiry. Keep these links private.
Sensitive admin changes require fresh verification tied to the current session and institute, valid for five minutes. Verification uses the admin’s already-linked email address or their current personal invitation link. Linking an email to an existing admin account additionally requires a separate code sent to that mailbox. These checks preserve the existing account and permissions; they do not merge accounts merely because profile email addresses match. Restarting the service clears fresh-admin verification, so it must be repeated for the next protected change.
Removing an approved email domain or disabling email admission prevents new email sign-ins; it does not automatically end existing sessions. Institute admins or the operator must revoke a participant’s access when it should end immediately. Signing out ends the current session.
Hosting, email delivery and identity providers
The pilot app and database run on Render in its Frankfurt, Germany region. Render is a US provider; choosing Frankfurt does not mean that all support, platform metadata or subprocessors are confined to Germany. Render’s Data Processing Addendum describes its processing and international-transfer safeguards, including applicable standard contractual clauses. Contact us for information about safeguards relevant to your data.
These public information pages are hosted on Vercel, which processes website request metadata. See our website privacy notice. The pilot’s drawing content is stored by the Render service, not by these static policy pages.
Email delivery depends on the institute’s configuration. The supported options are Resend or an institute-operated mail server. The configured sender and the recipient’s mail system process the recipient address, message content including the code, and delivery information. Drawings content is not included in sign-in, verification or delivery-test emails. These are service messages, not mailing-list subscriptions. Your institute admin or the operator can tell you which delivery service is active.
If Resend is configured, it processes these messages as an external email provider. Its privacy policy describes processing in the United States, and its Data Processing Addendum sets out its processing and international-transfer terms. Hosting the app in Germany does not restrict email-provider processing to Germany. If the institute’s own mail server is configured instead, messages are sent through that server and its applicable mail-service arrangements. Changing the delivery service does not change your account or drawing ownership.
Email delivery remains disabled until a sender has been configured and tested. The applicable processor arrangements and transfer safeguards must be established before a provider is used. The operator can provide details of the active provider, relevant safeguards and delivery-record retention. The options described here do not mean that both services receive your messages.
Life Science Login and your chosen identity provider process authentication under their own notices. See the Life Science Login privacy notice. LS Login authenticates users; it does not approve our service or grant drawing access by itself.
Essential cookies and browser storage
After successful sign-in, the hosted app sets a first-party session cookie named __Host-fli-session on the app’s own host. It contains a random session credential, not your email address or drawing content. The cookie is necessary to maintain the signed-in session you request and is not used for advertising or optional usage analytics.
- Lifetime: up to eight hours from sign-in. Closing a tab or restarting the browser does not by itself end this session. Signing out clears the cookie and revokes that session on the server.
- Protection: the production cookie is Secure, HttpOnly and SameSite=Strict. It is sent over HTTPS, cannot be read by page scripts and is restricted to its own host. The app no longer keeps the session credential in local storage or session storage.
- Your choice: you can block or remove cookies in your browser, but signed-in features will then stop working. Deleting a cookie locally does not itself send a sign-out or account-deletion request to the server; use Sign out to revoke the current session.
The necessary storage and access for authentication rely on section 25(2), no. 2 TDDDG; they are not offered as optional cookie consent. The GDPR bases for associated personal-data processing are described above. No advertising trackers or optional usage analytics are enabled in this hosted pilot.
Temporary sign-in state and return navigation may use browser session storage. If institute SSO is configured, its authentication flow may also use a short-lived security cookie. The app holds working drawing data in memory and may store local interface preferences. These are distinct from the server-saved drawings. Sign out on a shared device; signing out of Drawings does not necessarily sign you out of your institute identity provider.
Local development preview: a real sign-in on a loopback development server uses the separate cookie name fli-session-local. The simulated email-sign-in preview does not send email, create an account or set a sign-in cookie; entered addresses and demo codes are used only to demonstrate the form.
AI
AI features are not enabled in this pilot; drawing content is not sent to an AI model by this service.
Retention, deletion and exports
Drawings and associated account information are retained to provide the agreed pilot and any agreed continuation, until deletion is requested or the service no longer needs them. A 90-day pilot is not an automatic deletion timer. Contact us to arrange account deletion, removal of stored content or an export before leaving the pilot. Removing an item from the interface or revoking access does not necessarily erase historical collaboration records immediately.
Verified email-to-account mappings remain with the account so future sign-ins open the same membership and drawings. Cookie or code expiry ends its use for authentication; it does not automatically erase the account, drawings or historical security records. Email providers and the recipient’s mailbox may retain delivered messages and delivery records under their own applicable arrangements. Contact us about deletion of account or operational records.
Operational records are retained as needed to investigate errors, prevent abuse and meet legal obligations. Recovery copies can temporarily retain deleted information until they are replaced or removed; they are not used as active drawings. The current app backup job keeps the latest two local snapshots. Any separately configured provider snapshots or external backups have their own retention. We will update this notice when the pilot’s backup arrangements change.
Support correspondence is kept while resolving the request and for any necessary follow-up or legal retention. Messages to the contact address are handled through HZI’s email system.
Your rights
Subject to the conditions in the GDPR, you can request access, correction, erasure, restriction and data portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it for the future. Contact support@ongoingscience.com; we may need to verify your identity. You can complain to a supervisory authority, including the Bavarian State Office for Data Protection Supervision (BayLDA), or the authority where you live or work.