Privacy Policy

Last updated: September 22, 2026

Litmus Science ("Litmus," "we," "our," or "us") operates a lab execution platform that turns scientific requests — submitted by a person or by an AI agent through our MCP server — into scoped, priced experiments routed to a vetted network of laboratory partners. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. It applies to litmus.science, platform.litmus.science, and docs.litmus.science.

This policy covers personal information. It also explains, separately, how we treat the research data you submit — protocols, samples, results — which we handle differently from personal information and describe in Section 4.

1. Information We Collect

Information You Provide to Us

• Account & Company Information: Name, work email, company or institution, role, and account preferences
• Order & Experiment Information: The scientific request itself — assay type, target/sample details, acceptance criteria, budget and turnaround constraints, and any protocol or design information you provide when scoping or submitting an order
• Billing Information: Billing contact and payment details, processed by a third-party payment processor — we do not store full card numbers ourselves
• Communications: Messages, support requests, and feedback sent to us, including through contact forms
• Lab Partner Applications: If you apply to join the network as a lab partner, the company, capability, and contact information submitted with that application
• API & Agent Credentials: If you or a product you operate connects to the Litmus MCP server, the OAuth tokens and scopes used to authenticate, and the identity information returned by that connection (e.g. via the whoami tool)

Information Collected Automatically

• Usage Data: Pages viewed, features used, and general interaction patterns, collected through product analytics
• Device & Log Information: IP address, browser type, device type, and similar technical data
• Cookies: We use cookies and similar technologies for core site functionality and product analytics — see Section 6

2. How We Use Your Information

• Platform Operations: To scope, price, route, and track experiments submitted through the platform or the MCP server
• Fulfillment: To share the minimum information a lab partner needs to execute your specific order
• Payments: To process transactions, manage subscriptions, and handle billing
• Communication: To send order updates, respond to inquiries, and provide support
• Security: To detect abuse, secure API/agent access, and maintain platform integrity
• Analytics & Improvement: To understand usage patterns and improve the product
• Legal Compliance: To meet legal obligations and enforce our Terms of Service

3. Legal Basis for Processing (EU/UK/Switzerland)

If you're located in the EU, UK, or Switzerland, we rely on the following legal bases to process your personal information:

• Contract: Processing needed to provide the platform and fulfill an order you've placed
• Legitimate Interests: Securing the platform, preventing abuse, and improving the product — balanced against your rights and interests
• Consent: Where you've opted in, such as to marketing communications
• Legal Obligation: Where processing is required to comply with the law

4. Research Data: Protocols, Samples & Results

Research data submitted through Litmus — your protocols, sample or target descriptions, acceptance criteria, raw results, and derived data — belongs to you. We do not sell research data, and we do not publish it or make it public by default.

We share it only as needed to fulfill your order:

• With the specific qualified lab partner assigned to execute that order
• With the infrastructure and service providers described in Section 5, solely to operate the platform

We do not share your research data with other customers, and we do not use it to train models or share it with third parties for their own purposes.

Program-specific exception: Some programs we run — for example, the Hypothesis-to-Evidence Grant — require publishing the resulting work as a public case study. This only applies if you choose to apply for and accept that program, and the terms are disclosed at the time of application. It does not apply to standard orders placed through the platform or the MCP server.

5. How We Share Information

Lab Partners

To execute an order, we share the relevant order and sample details with the specific lab partner performing that work.

Service Providers

We use a small number of third-party services to operate Litmus:

• Product analytics (PostHog)
• Form and message handling for inquiries (Formspree)
• Cloud hosting and infrastructure
• A PCI-compliant payment processor for billing

These providers can access only the information needed to perform their function and are not permitted to use it for their own purposes. Our MCP server's integration code is open source on GitHub — this is the code that connects agents to Litmus, not a store of customer data.

Legal Reasons

We may disclose information when required by law or when we believe it's necessary to comply with legal process, enforce our Terms of Service, or protect the rights, property, or safety of Litmus, our customers, or the public.

Business Transfers

If Litmus is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy or a successor policy with materially equivalent protections.

6. Cookies & Analytics

We use cookies and similar technologies for essential site functionality and to understand product usage through PostHog (page views, feature usage, and device/browser information). You can control cookies through your browser settings; disabling them may affect some site functionality.

7. Data Retention

• Account Information: Retained while your account is active, and for a reasonable period after for support and legal purposes
• Order & Research Data: Retained for the duration of our relationship with you and a reasonable period after, so you can access your order history and results
• Payment Records: Retained as required by applicable tax and accounting law
• Communications: Retained as needed for support and legal purposes

You can request deletion of your account and personal information at any time, subject to Section 8.

8. Your Rights and Choices

We do not sell your personal information, and we have not sold personal information in the preceding 12 months.

If you're in the UK, EU, or Switzerland (GDPR)

• Access & Rectification: Request a copy of the personal information we hold about you, or ask us to correct it
• Erasure: Request deletion of your personal information, subject to legal retention requirements and active order obligations
• Restriction & Objection: Ask us to limit how we use your information, or object to processing based on legitimate interests
• Portability: Request your information in a portable format
• Withdraw Consent: Where processing is based on consent, withdraw it at any time

If you're in California (CCPA/CPRA)

• Know & Access: Request what personal information we've collected, used, and disclosed about you, and a copy of it
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Correction: Request correction of inaccurate personal information
• Non-Discrimination: We won't discriminate against you for exercising these rights

Everyone else

• Opt-Out: Unsubscribe from non-essential communications at any time
• Other Jurisdictions: If your local law grants rights not listed above, contact us and we'll address your request under the applicable framework

To exercise any of these rights, contact us at privacy@litmus.science. We aim to respond within 30 days.

9. Security

We use technical and organizational measures to protect your information, including encryption in transit, access controls, and vetting of the third-party services we rely on. No system is completely secure, and we cannot guarantee absolute security of your information.

10. International Data Transfers

Your information may be processed in countries other than your own, which may have different data protection laws than your jurisdiction. Where required, we use appropriate safeguards for these transfers.

11. Children's Privacy

Litmus is a business platform, not directed at children, and we do not knowingly collect personal information from children. If we learn we've collected such information, we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We'll update the "Last updated" date above, and for material changes we'll provide a more prominent notice.

13. Contact Us

Questions about this Privacy Policy or our privacy practices can be sent to:

Email: privacy@litmus.science