Privacy policy.

WHO WE ARE

BioForge Living Systems is a sole-proprietor reef chemistry brand operated by Carlos Mendiluze in Hialeah, Florida. This privacy policy applies to bioforgesystems.com and any communications you receive from us.

WHAT WE COLLECT

We collect information you provide, information required to fulfill purchases, and measurement data collected automatically when you visit the site.

Waitlist signup. Email address. Submitted voluntarily through the waitlist form. Used only to notify you when BioForge launches and to share occasional launch-related updates.

Beta application. Name, email, tank size, tank type, current dosing method, current chemistry brand, and any narrative answers you provide. Used only to evaluate beta program fit and contact selected applicants.

Direct correspondence. If you email hello@bioforgesystems.com, qc@bioforgesystems.com, or partnerships@bioforgesystems.com, we keep your message and reply so we can continue the conversation.

ICP Decode. Email address, Shopify order information, aquarium chemistry, tank and husbandry details, notes, uploaded reports, and any photographs you choose to provide. We use this information to save your session, verify payment, generate and deliver your report, provide account history, and support follow-up service.

Purchases. Shopify processes checkout and payment. We receive order and fulfillment details such as order number, purchased item, amount, currency, payment status, and contact information. We do not receive your full payment-card number.

Analytics and advertising measurement. When you visit, Google Analytics, Meta Pixel, Microsoft Clarity, and OpenAI Ads Measurement may load automatically to help us understand site use and whether our own campaigns lead to actions such as a saved Decode session, checkout, or purchase. These services may receive page and event information, browser or device information, cookies or similar identifiers, and referral or conversion identifiers. For certain Decode conversions, an email address may be normalized and sent only as a one-way SHA-256 hash for conversion matching; the OpenAI Ads browser and server integrations do not send the raw email address.

WHAT WE DON'T DO

We do not sell your personal information for money. We do not share it with data brokers, and we do not display third-party ad-network content on this site. We share limited measurement data with the providers named above to understand site use and measure BioForge's own advertising.

WHERE IT LIVES — SUB-PROCESSORS

BioForge is one person, so almost everything technical is run by service providers. Below is the complete list of sub-processors that can touch personal information, what each one does, and what it receives. Each processes data under its own data processing agreement or terms of service.

Cloudflare, Inc. (United States) — Website hosting, application logic, and the database that stores Decode sessions, delivered reports, and account history. Receives everything you submit through the site.

Shopify Inc. (Canada and United States) — Checkout and payment processing. Receives your name, email, billing and order details, and your payment-card number, which it processes directly. BioForge never receives or stores your full card number.

Anthropic PBC (United States) — Generates the ICP Decode report. Receives the aquarium chemistry values, tank details, and notes you submit. Anthropic's commercial API terms state that data submitted through the API is not used to train its models.

OpenAI, L.L.C. (United States) — Cross-checks the Decode report, and separately provides advertising measurement. Receives the same chemistry data for the report cross-check. OpenAI's API terms state that API data is not used to train its models by default.

Resend (United States) — Delivers transactional email: your Decode report, retest reminders, and account messages. Receives your email address and the message contents.

Intuit Mailchimp (United States) — Manages the waitlist and any marketing email. Receives your email address and subscription status.

Google LLC (United States) — Google Analytics 4 and Google Ads conversion measurement; Google Fonts serves typefaces. Receives page and event data, device and browser information, and cookie identifiers. Google Fonts receives your IP address as a technical consequence of serving the font files.

Meta Platforms, Inc. (United States) — Meta Pixel, used to measure whether BioForge's own Facebook and Instagram advertising leads to a checkout. Receives page and event data and cookie identifiers.

Microsoft Corporation (United States) — Microsoft Clarity, which records anonymized session activity so we can see where the site confuses people. Receives page interaction data, device and browser information, and cookie identifiers.

What is never sent to the advertising and analytics providers. Your ICP results, tank chemistry, notes, uploaded reports, and photographs are not sent to Google, Meta, Microsoft, or OpenAI Ads. Those providers receive page and event information only. The one exception is described above: for certain Decode conversions an email address may be sent as a one-way SHA-256 hash, never in readable form.

International transfers. These providers are based in the United States or Canada, so personal data of visitors in the EEA, the United Kingdom, and Switzerland is transferred there. Those transfers rely on the Standard Contractual Clauses incorporated into each provider's data processing terms and, where the provider is certified, the EU–US Data Privacy Framework and its UK and Swiss extensions.

Changes to this list. This list is current as of the "Last updated" date above. Email hello@bioforgesystems.com with the subject line "Sub-processor list" to ask for the current version or to be notified before a new sub-processor is added.

HOW LONG WE KEEP IT

Waitlist emails are kept until you unsubscribe or request deletion. Beta applications are kept for one year, or until you request deletion — whichever comes first. Direct correspondence may be archived after the conversation concludes. Temporary Decode checkout sessions expire after seven days; delivered reports and account history may be retained until you request deletion so the service can preserve your longitudinal record. Transaction records may be retained as required for accounting, fraud prevention, disputes, and legal obligations. Measurement providers apply their own retention periods.

ANALYTICS AND ADVERTISING MEASUREMENT

These measurement technologies may use cookies, local storage, pixels, and cookieless signals to recognize a browser or connect site activity with a campaign. Where consent is required by law — including the EEA, the United Kingdom, and Switzerland — nothing loads until you choose, and rejecting is offered as plainly as accepting. Elsewhere, including the United States, they load automatically. We honor the Global Privacy Control browser signal everywhere, treating it as a rejection. You can change your choice at any time using the measurement preferences control, and you can also limit tracking through your browser, device, content-blocking tools, or the privacy controls offered by each provider, although blocking cookies may not stop all cookieless measurement.

YOUR RIGHTS

You can request a copy of any personal data we hold about you, request that we delete it, or request that we correct it. Email hello@bioforgesystems.com with the subject line "Privacy request" and we will respond within 30 days.

These rights apply to everyone who asks, regardless of where you live. The two sections below describe the additional specifics that California and European law require us to publish.

CALIFORNIA PRIVACY RIGHTS (CCPA / CPRA)

This section applies to California residents and uses the categories defined by the California Consumer Privacy Act as amended by the CPRA.

Categories collected in the past 12 months. Identifiers (name, email address, IP address, cookie and device identifiers). Commercial information (Decode purchases and order history). Internet or other electronic network activity (pages viewed, events, session interaction). Approximate geolocation, inferred from IP address at country level only. Visual information, where you choose to upload a photograph of your tank. Professional information, where you volunteer it in a beta or commercial application. Inferences, in the form of the chemistry interpretation contained in your Decode report.

Categories we do not collect. Social Security or government identification numbers, driver's licence numbers, precise geolocation, biometric information, health information, financial account numbers, payment-card numbers, racial or ethnic origin, religious beliefs, union membership, genetic data, or the contents of your mail, email, or messages other than what you send us directly. We do not collect or process sensitive personal information for any purpose that would require a notice of limitation.

Sources. Directly from you. Automatically from your browser or device. From Shopify, when you complete a purchase. From the analytics and advertising providers named above.

Business purposes. Fulfilling and delivering ICP Decode. Preserving your account history so the service can track a tank over time. Responding to correspondence. Processing payment and preventing fraud. Keeping the site secure and working. Measuring whether BioForge's own advertising leads to a purchase. Meeting accounting and legal obligations.

Disclosure for a business purpose. In the past 12 months we disclosed the categories above to the sub-processors named in this policy, each for the purpose described beside its name. We disclose personal information to no one else, other than where legally compelled.

Selling and sharing. We have never sold personal information for money and we do not intend to. Separately, the CPRA defines "sharing" broadly enough that operating advertising measurement pixels — the Meta Pixel and Google Ads conversion tags described above — can be treated as sharing personal information for cross-context behavioral advertising. Rather than argue the point, we treat it as sharing and give you a switch: use the Do Not Sell or Share My Personal Information control to turn all measurement off. We also honor the Global Privacy Control browser signal automatically, everywhere, without you having to ask. We do not knowingly sell or share the personal information of anyone under 16.

Making a request. Email hello@bioforgesystems.com with the subject line "Privacy request". To verify you, we match the email address you write from against the records we hold; for a deletion or correction request tied to a purchase we may also ask for the order number. We do not ask for identity documents. An authorized agent may submit a request on your behalf with written permission signed by you, which we may ask to see.

No retaliation. Exercising any of these rights costs you nothing. We will not deny you service, charge you a different price, or give you a worse version of ICP Decode because you asked.

EEA, UK, AND SWISS PRIVACY RIGHTS (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, BioForge Living Systems is the controller of your personal data, and you have rights of access, rectification, erasure, restriction, objection, and portability. Use the same email address and subject line above.

Legal bases. Performance of a contract, for delivering an ICP Decode you paid for and preserving the account history that goes with it. Consent, for analytics and advertising measurement in your region and for marketing email, which you may withdraw at any time using the measurement preferences control or the unsubscribe link. Legitimate interests, for keeping the site secure, preventing fraud, and answering correspondence you initiate. Legal obligation, for tax and accounting records.

Withdrawing consent stops future processing. It does not make earlier processing unlawful, and it does not delete data already collected — for that, make an erasure request.

Complaints. You may lodge a complaint with the supervisory authority in your country of residence, work, or where you believe an infringement occurred. In the United Kingdom that is the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would rather you email us first, but you are not required to.

HOW YOUR REPORT IS GENERATED

Your ICP Decode report is written by large language models — Anthropic's Claude, cross-checked against OpenAI — working from the chemistry values and tank details you submit, inside a set of fixed safety rules that constrain what the report is allowed to recommend. No human reads your data as a matter of course.

This is automated processing, and you should know that. It produces husbandry information about an aquarium; it does not produce a decision with legal or similarly significant effects about you as a person, and it is not used to profile you, price you differently, or decide whether to serve you. If you want a human to look at your report, email hello@bioforgesystems.com and Carlos will read it himself and answer you directly.

HOW WE PROTECT IT

The site is served over HTTPS only. Application credentials are held as encrypted environment secrets in Cloudflare and are not stored in the site's code. Payment-card numbers never reach BioForge's systems — Shopify handles them end to end. Access to stored Decode data is limited to the site's own application code and to Carlos Mendiluze as sole operator.

No system is immune. If a breach ever affects your personal data, we will notify you and the relevant authorities as required by law, and we will tell you what was exposed rather than describing it vaguely.

CHILDREN

BioForge is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided information through this site, email us and we will delete it.

CHANGES

If we update this policy, the "Last updated" date at the top will change. Material changes will be announced to anyone on the waitlist before they take effect.

CONTACT

Questions about this policy go to hello@bioforgesystems.com.

Carlos Mendiluze · BioForge Living Systems · Hialeah, FL