Ryniant Privacy Policy

1. Who we are

Ryniant Industries, Inc., a Delaware corporation ("Ryniant", "we", "us"), makes SynthPlanner, an AI retrosynthesis planning platform for pharmaceutical contract research organizations (CROs) and chemistry labs. The app runs at https://ryniantclient.us (the "Service"). Our website is https://ryniant.ai. Our security overview is at https://ryniant.ai/security.

This policy explains what information we collect, how we use it, who receives it, how long we keep it, and what rights you have.

SynthPlanner is sold to businesses. The business that signs up (the "Customer") decides who in its organization gets an account and what data goes into the Service.

We hold information in two roles:

• For the Customer. We process customer scientific data (section 2.2) on the Customer's behalf and under the Customer's agreement with us. For this data we are the Customer's processor or service provider.
• For ourselves. We decide how to use account data, usage and log data, billing data, website data and business contact data (sections 2.1, 2.3, 2.4 and 2.5). For this data we are the controller.

2. What we collect

2.1 Account data

• Name and work email address.
• The organization (lab) the account belongs to, and the account's role: Ryniant administrator, lab administrator or regular user.
• Login credentials and multi-factor authentication (MFA) enrollment data. MFA is required for administrator accounts.
• API keys issued to your organization.
• Messages you send us, and the contact details in them.
• Billing contact details, invoices and payment records.

2.2 Customer scientific data

This is the content a Customer and its users put into the Service, and what the Service produces from it:

• Molecules and chemical structures (for example SMILES strings, InChI identifiers and names) for target molecules, intermediates and reagents.
• Synthesis routes, route steps, reaction conditions, expected yields, hazard flags, bench outcomes you report and condition overrides you record.
• Planning briefs, strategies, constraints, routes you paste in, and the messages you send to the planning assistant, with the conversation history.
• Lab profile data: inventory, equipment, lab supplies, labor calibration and rate cards.
• Client and request records you keep in the Service, quotes and quote documents.
• Documents you upload (for example PDFs) and electronic lab notebook (ELN) records.
• Outputs: routes, conditions, quotes, reports and exports.

Customer scientific data can contain personal data, for example a chemist's name in a notebook record or a client contact in a request record. We protect it the same way as the rest of the Customer's data.

The Service is not designed for health information or other special categories of personal data. Please do not upload them.

2.3 Usage and log data

• Request logs. IP address, browser user agent, time and the request made.
• Audit records. Security-relevant actions, such as logins, MFA events, user management, exports, route actions and planning-assistant tool calls. Each record holds the user ID, role, action, outcome, IP address and user agent. Audit records hold IDs and outcomes, not chemical structures.
• Cloud administration logs. Google Cloud records administrative activity on our cloud project.
• Browser storage in the app. The app sets no cookies and runs no analytics or advertising scripts. It keeps your sign-in token and display preferences (for example theme, sidebar and chemical editor settings) in your browser's local storage.

2.4 Website data

Our website, ryniant.ai, is built and hosted on Base44. When you visit it:

• Base44 records how you use the site (pages viewed, clicks, scrolling and mouse movement) so we can see how the site is used and fix problems. Text you type into forms is masked in these recordings.
• Base44 stores an analytics session ID and site settings in your browser's local storage. The site sets no cookies.
• Your browser loads fonts from Google Fonts and code libraries from unpkg.com. Those services receive your IP address.
• The booking link on our website opens Calendly, which collects the details you enter when you book a call.

2.5 Business contacts and prospects

If you talk to us about SynthPlanner, we collect your name, work email, employer and role, and notes from our conversations. If we want to record or transcribe a call, we ask you first.

We also find potential customers through lead-generation tools that use public professional profiles, such as LinkedIn. From these we collect names, job titles, employers and work contact details.

We use these tools for this data:

• Google Workspace for email and documents.
• Notion for customer relationship records and meeting notes.
• Origami to find leads and send outreach.
• Clean for LinkedIn outreach and lead generation.
• Calendly for booking calls.

3. How we use information

We use the information in section 2 to:

• Provide the Service. Run planning jobs, show and export results, generate quotes, look up supplier prices and lead times, and keep you signed in.
• Secure the Service. Authenticate users, enforce MFA, keep each Customer's data separate, keep audit records, detect misuse, and screen submitted structures against reference lists of controlled and hazardous substances and sanctions lists. The Service can block or flag a request that matches a list.
• Support you. Answer questions and fix problems.
• Bill Customers. Send invoices and keep payment records.
• Meet legal obligations.
• Improve the Service and the website. We use usage, log and website data to find faults and improve performance. We do not use customer scientific data to train models (section 5).
• Talk to business contacts. Contact prospects about SynthPlanner and schedule calls.

4. We do not sell personal data

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not use customer scientific data for advertising.

5. No model training on customer data

We do not use customer scientific data to train our models, or any model shared with other customers. If a Customer agrees in writing, we may train a model that is used only for that Customer.

Our retrosynthesis, forward-reaction and yield models run on our own cloud infrastructure. Our yield model is trained on licensed reaction data, not on customer data.

Some features send parts of customer scientific data to the AI model providers listed in section 6.2. We use them through their commercial APIs, under terms that bar them from training on our data:

• Anthropic. Anthropic's Commercial Terms of Service bar it from training on our inputs and outputs. Anthropic deletes API inputs and outputs within 30 days. Content its safety systems flag can be kept up to 2 years.
• Google Vertex AI. Google's Service Specific Terms bar it from training on our data. Google keeps a prompt only if its abuse systems flag it, for up to 90 days.

We do not have zero-retention agreements with these providers.

6. Who receives data (subprocessors)

We share data with the third parties below only to provide the Service. The chemical structures and text we send to the providers in sections 6.2 and 6.3 do not include your name, email address, organization name or account ID.

6.1 Hosting and infrastructure

6.2 AI model providers

6.3 Chemistry data and supplier lookups

6.4 Not used in the production Service today

The following are used only by pre-release features that are not in the production Service. We will update this list before any of them receives data from the production Service.

• OpenAI: text embeddings for notebook (ELN) search.
• Mistral AI: text extraction from uploaded documents.
• PubMed, Europe PMC, Crossref and OpenAlex: literature search.

Three more integrations are built into the software but switched off: molecule naming through Google Vertex AI; IBM RXN for Chemistry (reaction prediction); and the US International Trade Administration's Consolidated Screening List, which would receive a Customer's organization name and country for sanctions screening. We will update this policy before switching any of them on.

6.5 Website and business tools

These receive website and business contact data (sections 2.4 and 2.5), not customer scientific data: Base44, Google Fonts, unpkg.com, Calendly, Google Workspace, Notion, Origami and Clean.

6.6 What stays inside Ryniant

Our retrosynthesis, forward-reaction, yield and condition models, and our reaction databases, run on Ryniant's own cloud infrastructure. NextMove Software licenses reaction data to us that we host ourselves. No customer data goes to NextMove.

6.7 Ryniant personnel

Authorized Ryniant administrators can access Customer workspaces to operate, support and secure the Service. When a Ryniant administrator reads data in a Customer's workspace, the read is recorded in an audit log and raises an internal alert. Ryniant administrators also manage accounts, feature access and API keys.

6.8 Other disclosures

We may disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger, acquisition or sale of assets, subject to this policy. We may also share information with your consent.

7. Where data is stored and international transfers

We store data in the United States, in Google Cloud region us-central1, with some file storage and backups in Google's US multi-region. We do not offer a choice of data region today.

If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States. For data we process for a Customer, the transfer is covered by the EU Standard Contractual Clauses and the UK Addendum in our Data Processing Addendum with that Customer. For data we control, we rely on the same clauses or on another mechanism the law allows.

8. How long we keep data

Data we have already sent to a provider in section 6 is kept by that provider under its own terms, as described in section 5 for the AI model providers.

9. How we protect data

• Encryption in transit. The Service accepts only TLS 1.2 or higher, and redirects plain HTTP to HTTPS.
• Encryption at rest. All stored data is encrypted with AES-256 using Google Cloud's default encryption and Google-managed keys.
• Login security. MFA is required for administrator accounts. Administrators can sign a user out of every session.
• Role-based access. Lab administrators manage users in their own lab only.
• Separation between Customers. Each Customer's data belongs to its own workspace. The application limits every request to the signed-in user's workspace, and database row-level security enforces the same boundary on the main data tables. Customers share our cloud infrastructure; separation is enforced in software, not by giving each Customer separate servers.
• Audit records and alerts. Security-relevant actions are recorded, and administrator access across workspaces raises an alert.
• Separate service identities. Each backend service runs under its own cloud service account.
• Backups. Automated daily database backups, with point-in-time recovery.
• Compliance program. We are working toward a SOC 2 Type II report. We do not hold a SOC 2 report today.

No system is perfectly secure. If a security incident affects personal data we hold for a Customer, we will notify the Customer within 72 hours after we become aware of it. We will notify you directly where the law requires.

10. Your rights

You can ask us to:

• Access the personal data we hold about you.
• Correct personal data that is wrong.
• Delete your personal data.
• Export your data. The Service exports routes as PDF, DOCX and PPTX files. On request, we provide your personal data in a structured, machine-readable format.

To make a request, email [email protected]. We will verify your identity before acting. If we hold your data for a Customer, for example your employer, we may refer your request to the Customer or act on its instructions. We aim to respond within 30 days. We will not treat you differently for using these rights.

10.1 European Economic Area, United Kingdom and Switzerland

Where the GDPR or the UK GDPR applies to us as controller, we rely on these legal bases:

• Contract: to provide the Service under the Customer's agreement.
• Legitimate interests: to secure and improve the Service and the website, and to contact business contacts and prospects about SynthPlanner.
• Legal obligation: where the law requires us to process or keep data.
• Consent: where the law requires it, for example call recordings. You can withdraw consent at any time.

You also have the right to restrict or object to processing, including direct marketing, and to complain to your data protection supervisory authority. We will appoint a representative in the EU and in the UK when our Service begins serving users there, and list them here.

10.2 California

Ryniant does not currently meet the thresholds of the California Consumer Privacy Act (CCPA). We offer the rights in section 10 to everyone, and we do not sell personal information or share it for cross-context behavioral advertising.

11. Children

The Service is for business use by adults. It is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We will post changes on this page and update the effective date. For material changes, we will notify Customers by email or in the Service at least 30 days before the change takes effect.

13. Contact

Ryniant Industries, Inc., c/o DLA Piper LLP (US), 3203 Hanover Street, Suite 100, Palo Alto, California 94304-1123

Privacy questions and requests: [email protected]

Security overview: https://ryniant.ai/security