Privacy notice

Last updated 2026-11-02

This notice explains what personal data OrganMatch™ collects when you use the platform, why we hold it, how long we keep it, and what you can ask us to do with it. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

Who is responsible for your data

The controller is Organthis FlexCo, registered at Villefortgasse 11, 8010 Graz, Austria, company number FN 647245g at the Landesgericht für ZRS Graz, VAT ATU82878539.

For anything about your data, write to contact@organthis.com or support@organthis.com (both work), or call +43 680 55 00 909.

We have not appointed a data protection officer. The law does not require one for the kind and scale of processing we do.

What we collect, and why

For each kind of data below we say why we hold it and the legal basis we rely on. "Contract" means Article 6(1)(b) GDPR: we need the data to provide what you signed up for. "Legal obligation" means Article 6(1)(c). "Legitimate interests" means Article 6(1)(f), and we name the interest each time.

Your account

Created when you register, and required to give you an account at all. Legal basis: contract.

Email address, full name, and the organisation you give
Your role on the platform, and whether your email has been verified
A hashed password (we never store the password itself)
Optional profile details: biography, website, and a separate contact email
Your preferred display currency
The version of our Terms of service you accepted, and when you accepted it. You cannot create an account without accepting. When the terms change we ask you to accept again; your account keeps only your latest acceptance.

Free Academic access

If you apply for free Academic access, we hold what the application needs: whether your email address matched an academic institution and which rule matched, the institution you chose, your ORCID iD if you give it, a note for the reviewer if you write one, your confirmation that you will use the access for non-commercial research only, and the decision with its date. An application is granted automatically when your address belongs to a recognised institution. Every other application is decided by a person; we never refuse one automatically. Legal basis: contract.

Your research work

The substance of what you use the platform for. This can include experimental records that are commercially sensitive to you or your institution.

Who decides about it. Lab Book runs you record inside an organisation, and the member data of that organisation, we process for the organisation, as its processor, under our data processing agreement: the organisation decides about them. What you keep for yourself, outside an organisation, we process as controller, as this notice describes. Legal basis: contract.

Protocols you author or contribute
Lab book experiments, their steps, reagents, batch records and yields
Deviations you record against a protocol, including your stated reasons
Protocols you save, and your progress through SOP steps

We do not use it to train AI models, and we never send it to an outside AI service. If you choose to contribute a Lab Book run's outcome, its viability value can count towards the anonymised network median that Professional and Enterprise accounts see, as section 9 of our Terms of service describes. A run you keep private is never used for that.

How accounts with a plan use protocols

When a signed-in account with an active plan (paid, trial, granted, or free Academic access) opens a protocol page, downloads the watermarked SOP file, or starts a Lab Book run from a protocol, we record that it happened.

Your account, the protocol, and which of those three things happened
The plan it happened under
The calendar date in UTC. No time of day is kept: the time is the more revealing detail about a person, and nothing we do with these records needs it

Doing the same thing with the same protocol again on the same day records nothing further. We store no network address, no browser or device details and no session identifier with these records. If you are not signed in, or your account has no active plan, nothing is recorded here at all.

Why we keep it: to share part of subscription revenue with the laboratories that verified or co-developed the protocols people use, and to notice when a single account is inflating one protocol's figures. Use under free Academic access does not count towards that revenue share; we record it so that we can see which protocols free Academic accounts use.

Legal basis: legitimate interests: ours in paying laboratories fairly for the protocols that are used and in knowing how our free access is used, and the laboratories' interest in being paid correctly.

What we work out from it: daily totals for each protocol, which contain no account identifiers; and a yearly calculation naming laboratories and amounts, which includes how many different accounts used each protocol and the largest single account's share, but never which accounts those were.

Who sees it: no other member, laboratory or organisation administrator, and no screen or developer interface shows it. Only Organthis staff with database access, and our host as described below.

Billing and commercial records

Subscriptions and the plan you are on
Your organisation's billing details: legal name, address, country, VAT ID, the email address for invoices, and, if you give them, a billing contact name and a purchase order reference
The results of our VAT ID checks with the EU's VIES service
Payments: amount, status, the payment method type, and the details the VAT was worked out on; and the invoices and credit notes we issue
When you buy a plan: your confirmation that you may act for the organisation, with your user account, the organisation's name, the sentence you confirmed and the time
Commercial licences you hold, and quote requests you send
Revenue share records, where you contribute protocols

Card and bank details you enter at checkout go directly to our payment service provider, Mollie, and never reach our servers. Legal basis: contract, and legal obligation for invoices and the records tax law requires us to keep (Austrian Federal Fiscal Code, §132 BAO, and Commercial Code, §212 UGB). For your confirmation that you may act for the organisation, also legitimate interests: being able to show who agreed to the contract for the organisation.

Organisations and teams

Your membership of an organisation and your role within it
Invitations you send or receive

Where you join an organisation, administrators of that organisation can see your membership and activity within it. We process this, and the runs you record inside the organisation, for the organisation, as its processor under our data processing agreement. Your own account, described above, we process as controller. Legal basis for that: contract.

Activity and security records

An audit log of significant actions taken on your account
Record-level audit entries for changes to protocols and curation decisions
Counts of how often pages and SOPs are opened and Lab Book runs are started, per day and per protocol. They are not tied to an account and are used only as totals; they never show which person or laboratory did something. The per-account records are described under How accounts with a plan use protocols.
When a full SOP was downloaded and by whom, with a network address for the request. For downloads made through this website, that address is our own server's address. The downloaded file itself is marked with your name, email address, licence reference and the date.
A record each time you accept a version of our Terms of service: your account, the version you accepted, whether you accepted when registering or later, the version you had accepted before if it was later, and when. It holds no network address or browser details. Accepting a version you have already accepted adds nothing.
Notifications generated for you
Short-lived request counters, keyed on your account or on the network address a request came from, kept for between one minute and one day to limit abuse and repeated failed sign-ins

Audit records exist so that changes to scientific records are attributable and reversible. They are deliberately harder to erase than other data (see Your data). Legal basis: legitimate interests: keeping the platform and your account secure, and keeping changes to shared scientific records traceable; and contract for notifications and your record of accepted terms.

Developer access

API keys you create, and webhook endpoints you register
Delivery records for webhooks sent to those endpoints
When one of your organisation's API keys is used, we check whether the member who created it has accepted the current Terms of service. The check itself is not stored; we record when a key was last used only if the call is accepted.

Legal basis: contract.

Search

What you type into the catalogue search is turned into a search index query by a program running on our own server. It is not sent to any other company. We keep search results for up to ten minutes so that the same search is faster. To learn what the catalogue is missing, we also count which filters are chosen, which words are searched and whether a search found anything. These counts are stored without your account, network address, browser details or any cookie. Our staff see a search term only once it has been searched at least three times, and after 90 days we keep only monthly totals. Legal basis: legitimate interests: improving the catalogue.

If we emailed you about a published method

This section is for people who are not OrganMatch users. If you received an email from us about a protocol derived from your published work, we hold some information about you and did not get it from you. Under Article 14 GDPR we have to tell you what and why, so:

What we hold: your name, your email address, and the institutional affiliation printed on the publication; which protocols we link to you as corresponding author; and a record of each email we sent you (which message, its subject line, and when). When we email you a preview link, we also keep an invitation record: the address, the institution, when the link expires, and whether it was used or withdrawn. We keep this record even when the email could not be sent. Opening the link alone does nothing; if you then choose to accept the invitation, we create a preview account holding your address, the institution as your organisation, and when your access ends; from then on the account and activity records described above apply to you as well.
Where we got it: the public publication record (PubMed and PubMed Central). We take the corresponding author's address as the journal printed it. We do not buy contact lists, and we do not guess: where a publication does not identify a corresponding author, we hold nothing.
Why we hold it: to tell you that our catalogue contains a protocol derived from your published method, to let you see how it is presented, and to give you a way to correct it, have the attribution anonymised, or have the entry removed.
Our lawful basis: legitimate interests (Article 6(1)(f)), namely ours in describing published methods accurately, and yours in being told that your work is being described and being able to object. We have written down how we weighed these interests against yours, and you can ask us for it.
How long: if you unsubscribe, we mark your address as suppressed so that we never write to you again. We keep that record (including when and why the address was suppressed) together with your name as the publication printed it, where we found your address, and the record of the emails already sent, because deleting it is what would let us contact you again by mistake. Removing a protocol from the catalogue does not delete these records. If you ask us to erase your data, we remove your name and keep only the suppressed address and the record of what we sent, for the same reason.
Who else sees it: nobody. It is not published, not shown on any protocol page, and not shared with any other organisation. Our email provider processes the message in order to deliver it.

You can object at any time, and you do not have to give a reason. Every email we send about the catalogue carries an unsubscribe link. The message confirming that you have unsubscribed does not, because by then there is nothing left to unsubscribe from. The link opens a page with a single confirm button; we deliberately do not act on a link merely being fetched, because corporate mail scanners open links automatically and you would never know it had happened. Mail programs that support one-click unsubscribing show their own Unsubscribe button, which unsubscribes you straight away, because that button is something you press yourself. If your mail program's button only opens a web address instead, use the link in the email. You can also write to contact@organthis.com. You also have the rights listed under Your rights below, including access, correction and erasure.

Stopping the emails is not the same as changing how a protocol is attributed. Those are separate requests and we answer them separately. Use attribution and takedown for the second.

We do not use tracking pixels, and we do not record whether you opened a message or clicked a link.

If your published work is cited in the catalogue

This section is for the authors of the publications our protocols are based on, whether or not you have an OrganMatch account and whether or not we emailed you.

What we show: on a protocol page, the names of the authors and their institution as the publication prints them, the year, and a link to the publication. We also hold the corresponding author's name and email address where the publication prints them; we do not show those on any page.
Where we got it: the publication record (PubMed and PubMed Central) and the paper itself.
Why we hold it: to attribute each protocol correctly to the work it is based on, so that the original can be found and cited.
Our lawful basis: legitimate interests (Article 6(1)(f)), namely ours and the research community's in correct attribution, and yours in being credited for your work.
Who else sees it: everyone who opens the protocol page. To write SOP text we send the paper's text to Anthropic (see below), and that text can include your name and affiliation as printed.
How long: we show it for as long as the protocol is listed in the catalogue. If a protocol is withdrawn, we keep its record, with the citation, so that the withdrawal stays traceable.
How to object: use the attribution and takedown form or write to contact@organthis.com. We can correct the attribution, anonymise it, or remove the entry.

If you send us an attribution or takedown request

This section is for anyone who uses the attribution and takedown form, whether or not you have an OrganMatch account.

What we hold: what you type into the form (your name, your email address, your institution if you give it, the entries you name, your message, and whether you asked for the attribution to be anonymised or objected to the content), plus when you sent it, and a record of what we decided, who on our side handled it and when. For up to 24 hours we also keep a counter keyed on a hash of your address and, unless it is a shared webmail provider, of its domain. It is used only to limit how many automatic acknowledgements we send. Anyone who already knows your address could recompute that hash, so treat it as your address in coded form, not as anonymous.
Why we hold it: to answer you, to act on your request, and to be able to show later what was asked and what we did about it.
Our lawful basis: legal obligation, where your request is a notice about illegal content under the EU Digital Services Act; otherwise legitimate interests, namely ours and yours in a request being handled properly and in being able to show later how it was decided.
How long: we keep a request and what we decided for as long as the decision could still be questioned or a claim about it could still be made.
Who else sees it: the OrganMatch administrators who handle requests. When a request arrives, its details are emailed to our contact inbox, so they are also held there. Our email provider processes that notice, and the acknowledgement we send you when one is sent automatically. Nothing you send is shown on any protocol page, and we never say publicly who asked for an entry to be changed or removed.

How long we keep it

We do not keep personal data longer than we need it. Today that means:

Your account, profile and research work: for as long as your account exists. When you ask us to close your account, we erase it within one month, apart from the records listed on Your data that we have to keep. If something must be settled first, such as a payment, a protocol in review or the copy of your data you asked for, it can take up to two further months, and we tell you why.
Records of how accounts use protocols: we delete them when you close your account, or earlier if you ask.
Organisation memberships, invitations and notifications: until your account is closed. Webhook endpoints and their delivery records: until the organisation deletes the endpoint.
Invoices, credit notes, payment and billing records: seven years from the end of the calendar year they belong to, because Austrian tax and commercial law requires it (§132 BAO, §212 UGB), and longer only while a tax audit or a legal dispute that concerns them is still open. This includes your confirmation at checkout that you may act for the organisation. Closing your account does not remove your account reference from them.
Audit records and your record of accepted terms: for as long as the records they describe exist, because they are what makes those records traceable. When you close your account, we replace your identity in them wherever the record allows it.
Request counters and sign-in protection: between one minute and one day, after which they expire by themselves.
Search terms: 90 days, then monthly totals.
Backups: we make a backup of the database every night and keep each one for about two weeks, with a copy on a separate Hetzner storage box in the European Union. Data you had erased can stay in a backup until that backup expires.
Server logs: technical logs are limited in size and are overwritten as new entries arrive. They do not record network addresses of visitors, and email addresses in them are masked.

Who else sees it

We do not sell personal data. We share it only where we need to: with the service providers who help us run the platform, and where the law requires it, and only as far as each of them needs it. They are:

Hetzner Online GmbH (Gunzenhausen, Germany): hosting. The application, the database and the backups all run on servers we rent from Hetzner. Our mailboxes are hosted there too, and the emails the platform sends automatically (account verification, password resets, messages to authors, and notices about attribution and takedown requests) are sent through them.
Mollie B.V. (Amsterdam, Netherlands): payments. Card and bank details you enter at checkout go to Mollie directly; we never see or store them. We give Mollie your organisation's name and the email address for invoices, and receive the payment status and the payment method type.
Anthropic (United States): drafting SOP text from published papers. We send Anthropic only the text of published papers, which can include the authors' names and affiliations as printed. We never send data about OrganMatch users or anything you enter.
The European Commission's VIES service: when a business enters its billing details or buys a plan, we check its VAT ID there. We send the VAT ID and country; VIES answers whether it is valid and, where the country provides it, the registered name and address.
Our tax adviser, for bookkeeping and tax filings.

Mollie is a payment service provider. For its own legal duties, for example preventing fraud and money laundering, Mollie decides itself how it uses the payment data, as an independent controller. You can read Mollie's privacy notice.

We do not use any analytics or advertising service, and there is no third-party tracking on this site or in our email. Our pages load nothing from other companies' servers. Which small files we store in your browser is explained on the Cookies page.

Where your data is held

Our servers and backups are with Hetzner in the European Union, and Mollie is established in the European Union. Anthropic is based in the United States. Where a service provider processes personal data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework where the company receiving the data is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.

Whether you have to give us your data

You do not have to, but without your name, email address and organisation we cannot open an account for you, and without your organisation's billing details we cannot sell you a plan. Everything marked optional above is optional.

Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Two checks are automatic but never final against you: free Academic access is granted automatically when your address belongs to a recognised institution, and a person decides every other application; and online checkout needs an EU VAT ID that VIES does not reject. If VIES cannot be reached, Austrian VAT applies to that payment. If your VAT ID is rejected, or your business is outside the EU, you can write to us instead.

Children

OrganMatch is made for professional use and is not aimed at children. We do not knowingly collect data about anyone under 16.

Your rights

You have the right to ask for a copy of your data (access), to have it corrected (rectification), to have it deleted (erasure), to have its use restricted while a question is resolved (restriction), and to receive the data you gave us in a machine-readable format (portability). Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before.

Right to object: you can object at any time, on grounds relating to your particular situation, to any use of your data that we base on legitimate interests. We then stop, unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims.

How to make any of these requests, and what happens to scientific records when you do, is set out on Your data.

You also have the right to complain to a data protection authority. Ours is the Austrian data protection authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien, Austria
dsb@dsb.gv.at · www.dsb.gv.at

You can also complain to the authority in the EU country where you live or work.

Changes to this notice

If we change how we use your data in a way that affects you, we will tell you before the change takes effect rather than only updating this page.