Selfling Privacy Policy

1. Introduction

This Privacy Policy explains how Genetic Superintelligence Company, a Delaware Public Benefit Corporation ("Selfling," "we," "us," or "our"), collects, uses, shares, and protects your information when you use our website, platform, and services (collectively, the "Service").

Selfling exists to advance human understanding through the collective analysis of genomic and phenotypic data. Our corporate charter includes a binding legal commitment: identifiable individual data remains under individual control and is not sold or licensed for commercial use.

This is not a policy we chose. It is a constraint we built into our legal structure.

Geographic scope. This Privacy Policy applies to customers and website visitors wherever the Service is made available. Selfling is based in the United States, and information from customers outside the United States may be transferred to and processed in the United States or other countries where our service providers operate, as described in Section 8.

By using the Service, you acknowledge that you have read this Privacy Policy. Where applicable law requires consent for a particular use of information, we will ask for that consent separately.

2. Information We Collect

2.1 Information You Provide

Account Information

When you create an account, we collect:

• Name
• Email address
• Password (stored in encrypted form)
• Payment information (processed by third-party payment providers; we do not store full payment card details)
• Billing and delivery address, including country or region

Genetic Data

When you use the Service, genetic data is generated by:

• Ordering a sample kit and providing a biological sample, which is processed by our accredited laboratory partner to generate genomic data

Your genetic data includes raw genotype data (SNPs and other genetic variants) and any analysis or insights derived from that data.

Phenotypic Data

You may optionally provide information about your traits, lifestyle, and outcomes ("phenotypic data") to make your Selfling more personal and contribute to aggregated insights. This may include:

• Self-reported traits and characteristics
• Lifestyle and wellness information
• Responses to surveys or questionnaires
• Outcomes you choose to share

Communications

When you contact us, we collect the content of your messages and any information you choose to provide.

2.2 Information Collected Automatically

Usage Data

When you access the Service, we automatically collect:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and features used
• Date and time of access
• Referring website or source

Cookies and Similar Technologies

We use cookies and similar technologies to:

• Keep you logged in
• Remember your preferences
• Understand how you use the Service
• Improve the Service

You can control cookies through your browser settings. Disabling cookies may limit your ability to use certain features of the Service.

2.3 Availability and Waitlist Information

If you join a waitlist for a product or location where the Service is not yet available, we collect:

• Your email address
• Your country or region of residence
• Optionally, information about your interest in the Service

We use waitlist information only to notify you about availability and to understand demand for the Service. We do not share it with third parties except service providers who help us send waitlist communications, and we will delete it at your request.

3. How We Use Your Information

3.1 Genetic Data

We use your genetic data solely to:

• Build and improve your Selfling — Analyze patterns in your genetic architecture and translate them into relevant plain-language context.
• Power aggregated insights — Contribute to analyses that reveal patterns among people with similar biological architecture, in a form where individuals are not reasonably identifiable.
• Improve the Service — Develop better analytical methods and enhance the accuracy of insights.

We do not use your identifiable genetic data for:

• Advertising or marketing purposes
• Sale or licensing to third parties
• Sharing with insurers, employers, or law enforcement (except as required by law)

3.2 Account and Usage Information

We use your account and usage information to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Verify service availability, delivery details, and billing information
• Send administrative messages (account verification, security alerts, policy updates)
• Respond to your inquiries and provide support
• Analyze usage patterns to improve the Service
• Protect against fraud and unauthorized access

3.3 Communications

With your consent, we may send you:

• Updates about new features or services
• Research findings and insights relevant to your genetic architecture
• Research updates and aggregated insights

You can opt out of marketing communications at any time by clicking "unsubscribe" in any email or contacting us at hello@selfling.com.

3.4 Legal Bases Where Required

Where applicable law requires us to identify a legal basis for processing personal information, we rely on one or more of the following, as appropriate:

• Performance of a contract with you, including creating and delivering your Selfling
• Your consent, including explicit consent for genetic or other sensitive information where required
• Our legitimate interests in securing, operating, and improving the Service, where those interests are not overridden by your rights
• Compliance with legal obligations and the establishment, exercise, or defence of legal claims

We will provide any additional notice or request any additional consent required by the laws that apply to a particular processing activity.

4. How We Share Your Information

4.1 What We Never Do

We do not sell your data. This prohibition on the sale or licensing of identifiable individual data for commercial use is embedded in our corporate charter as a Public Benefit Corporation. It is legally binding and survives any change in ownership or leadership.

Specifically, we will never:

• Sell your identifiable genetic data to any third party
• License your identifiable genetic data for commercial use
• Sell, license, or commercially distribute aggregated or de-identified genetic datasets
• Share your genetic data with insurers or employers
• Provide your genetic data to data brokers or advertisers

4.2 Aggregated and De-Identified Data

We may use aggregated, de-identified data — in a form where individuals are not reasonably identifiable — to:

• Improve the Service and develop new features
• Improve our understanding of genetic architecture across populations
• Publish aggregate findings in scientific or research contexts, only where individuals are not reasonably identifiable

We do not sell, license, or commercially distribute aggregated or de-identified genetic datasets. We use industry-standard de-identification practices. We require any party with whom we share de-identified data to agree contractually not to attempt to re-identify individuals.

4.3 Service Providers

We share information with third-party service providers who help us operate the Service, including:

• Accredited laboratory partner
• Cloud hosting providers
• Payment processors
• Email service providers
• Analytics providers

These providers are contractually obligated to use your information only to provide services to us and to protect your information consistent with this Privacy Policy. A current named list of subprocessors is available on request to hello@selfling.com.

Laboratory partner specifically. Our accredited laboratory partner processes your biological sample to generate your genetic data. The laboratory may use de-identified data from samples they process only for internal quality assurance and method improvement, as is standard for accredited laboratories. They are contractually prohibited from selling, licensing, commercially distributing, or using your sample-derived data for unrelated research, product development, third-party data products, or any commercial purpose beyond the services they provide to Selfling.

4.4 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process, such as:

• A court order or subpoena
• A request from law enforcement with appropriate legal authority
• To protect the rights, property, or safety of Selfling, our users, or others

If we receive a legal demand for genetic data, we will:

• Notify you before disclosure unless legally prohibited from doing so
• Challenge overly broad or inappropriate requests where feasible
• Disclose only the minimum information required

4.5 Business Transfers

If Selfling is involved in a merger, acquisition, or sale of assets:

• Any acquiring entity must assume the data protection obligations in our corporate charter
• You will be notified before your information is transferred
• You will have the opportunity to request deletion of your data before any transfer

5. Your Rights and Choices

5.1 Access Your Data

You can access your genetic data and Selfling through your account at any time.

5.2 Correct Your Data

You can update your account information and phenotypic data through your account settings. If you believe your genetic data contains errors, contact us at hello@selfling.com.

5.3 Delete Your Data

You can request permanent deletion of your genetic data at any time by contacting us at hello@selfling.com. We will honor deletion requests within 30 days.

Upon deletion:

• Your genetic data will be permanently removed from our active systems
• Your Selfling will no longer be accessible
• Your contributions to previously generated aggregated analyses cannot be individually removed, because those analyses do not identify you and are not linked back to your account
• Backup copies will be purged according to our retention schedule (no longer than 90 days after deletion from active systems)

5.4 Sample Destruction

If you provided a biological sample through our sample kit, our accredited laboratory partner processes the sample to generate your genetic data. Samples are stored, destroyed, or returned according to the laboratory partner's policies and applicable law. Where legally available, you may request destruction of your biological sample by contacting us at hello@selfling.com. For California residents, sample destruction is available within 30 days of consent revocation in accordance with the California Genetic Information Privacy Act.

5.5 Download Your Data

You can request a copy of your genetic data in a standard format by contacting us at hello@selfling.com.

5.6 Restrict Processing

You can request that we stop processing your genetic data for aggregated insights while retaining your Selfling. Contact us at hello@selfling.com.

5.7 Withdraw Consent

Where we rely on your consent to process information, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Data Security

We implement technical and organizational measures to protect your information, including:

• Encryption of genetic data at rest and in transit
• Access controls limiting who can access genetic data
• Regular security assessments and monitoring
• Employee training on data protection

No system is perfectly secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. If we become aware of a security breach affecting your genetic data, we will notify you as required by law.

7. Data Retention

We retain your information as follows:

After you request deletion of your genetic data, backup copies are purged within 90 days.

8. Data Location

Selfling is based in the United States. We and our service providers may store and process personal information in the United States and other countries where we or they operate. Those countries may have privacy laws that differ from the laws where you live.

Where applicable law requires a recognised transfer mechanism or additional safeguards for an international transfer, we will put an appropriate mechanism or safeguard in place before making that transfer. Our commitments not to sell or license identifiable individual data apply regardless of where the data is processed.

9. Children's Privacy

The Service is not intended for anyone under 18 years of age. We do not knowingly collect genetic data or personal information from children under 18. The Service is not directed to or intended for children. We comply with the Children's Online Privacy Protection Act (COPPA), applicable US state laws, and applicable laws concerning children in countries where the Service is offered.

If you believe we have collected information from a child under 18, contact us immediately at hello@selfling.com and we will delete that information.

10. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services (such as DNA testing providers). This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before providing them with your information.

11. Updates to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:

• Email to the address associated with your account
• Prominent notice on the Service

The "Last Updated" date at the top of this policy indicates when it was most recently revised. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Where applicable law requires additional notice or consent for a material change, we will provide that notice or request that consent before the change applies to you.

12. State Privacy Rights

12.1 California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Genetic Information Privacy Act (GIPA):

• Right to Know: You can request information about the categories and specific pieces of personal information we have collected, the sources of that information, our purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information. Our corporate charter prohibits the sale or licensing of identifiable individual data for commercial use.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Genetic Data Specific Protections: Under California GIPA, we provide additional protections for genetic data including specific consent requirements, the right to revoke consent and have your biological sample destroyed within 30 days, and limitations on disclosure.

12.2 Other State Genetic Privacy and Comprehensive Privacy Rights

Residents of US states with applicable genetic privacy or comprehensive privacy laws have rights under their respective state laws. These rights generally include access to your personal information, correction of inaccurate information, deletion of your personal information, portability of your data, and opt-out from certain processing activities.

These rights are available, where applicable, to residents of California, Montana, Texas, Virginia, Utah, Tennessee, Arizona, Kentucky, Maryland, Wyoming, and other states with relevant privacy or genetic privacy laws. We honor all such rights to the extent required by applicable law.

To exercise any of these rights, contact us at hello@selfling.com. We will respond within the timeframe required by the applicable state law.

13. International Customers and Privacy Rights

We may offer the Service to customers outside the United States. Depending on where you live, applicable law may give you rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal information, and to withdraw consent where processing is based on consent.

You may also have the right to complain to a data-protection, privacy, or consumer-protection authority in your country or region. Nothing in this Privacy Policy limits rights that cannot lawfully be waived.

Service availability, laboratory processing, delivery, and specific privacy obligations may vary by location. If the Service is not available where you live, you may still browse our website or join an availability waitlist.

To exercise a privacy right or ask about international processing, contact hello@selfling.com. We may need to verify your identity before completing a request.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

Genetic Superintelligence Company
535 Mission Street, 14th floor
San Francisco, CA 94105
United States

Email: hello@selfling.com