Privacy Policy

1. Who is responsible

WB Figure Studio is operated by Shen, an individual developer. Shen is responsible for the personal information described here and is its controller where the GDPR applies. The service website is wbfigure.top.

This policy covers the website, account and licensing services, and the desktop app’s connections to them. The literature and antibody site on the same domain shares the browser analytics choice; its content, comments and external links have separate notices. For privacy, account, refund or security matters, contact samskaras@163.com.

2. Experimental images and local projects

Imported images, complete source-image copies, band coordinates and annotations, figures, quantitative results, biological-replicate relationships, groups and statistics, the personal antibody library and usage snapshots, project relationships and exports are processed and stored locally. Normal account and licensing requests do not upload them. Signing in and local autosave do not provide cloud synchronization. We do not receive experimental images through licensing or use your experimental materials to train AI models.

Keep your originals and a separate .wbfig backup. Deleting a server account does not remotely delete projects on your computer; uninstalling the application should not be treated as erasing all local files. If you voluntarily email attachments, we receive what you send. Remove participant identifiers, sensitive unpublished results and unnecessary personal information first.

3. Information we process

Accounts: email address, random account ID, salted password hash, verification and account status, creation time and necessary permissions. Our server does not store plaintext passwords.

Licenses and devices: license type, start/expiry times, first-trial dates for accounts and devices, launch-offer eligibility, activation and renewal history, activation-code hashes and hint fragments, random device IDs, device-identification digests and their method, computer names, binding and last-sign-in times, and necessary manual-review reasons and results.

Device identification: The app converts identifiers supplied by the system or hardware locally into a product-specific digest for identifying the same device, checking trial eligibility and managing two regular desktop devices. When an upgrade or reinstall changes identification, a temporary recovery slot may be available. Its creation time, suggested review date and any temporary trial period are recorded. Raw hardware UUIDs, hardware serial numbers and experimental images are not sent to the licensing server. Digests can link different accounts using the same device; they are not anonymous information. Unlinking a device frees its binding slot without clearing records used to prevent repeated trials.

Service and support: secure session and one-time-link hashes; service-email recipients, purposes, status and times; and contact emails, feedback messages, times and handling status. Earlier account tickets may also contain subjects, software versions and replies. Historical trial-code records retain their original purpose. Guest feedback needs no account, is not public and cannot be looked up by email. Its email address is used for support, without creating an account or subscribing you to marketing.

Network and operations: servers may process IP addresses, request times, paths, response status and browser information. Rate limiting uses an IP digest. Section 5 explains public-page, download and desktop usage statistics.

Production delivery records in our website database do not include complete email bodies or verification links. The mail provider processes the messages being delivered. Guest feedback is visible only to authorized administrators; earlier account tickets are visible only to the relevant user and authorized administrators.

4. Purposes and grounds

Account creation, email verification, sign-in, licensing, device management, support and refunds provide the service you request or perform our contract. Device digests and trial history support licensing, repeated-trial prevention and anomaly review, not advertising profiles or analysis of experimental content. Contact support if a shared computer, repair or replacement causes an identification problem. An approved review restores only the original account’s remaining trial time.

A new account starts its trial when registration succeeds. The notification contains no trial activation code, does not confirm email ownership and does not change trial dates if delivery fails. Email verification, licensing, password recovery/change and necessary policy notices are service emails, not an advertising subscription.

Security auditing, rate limiting and troubleshooting protect accounts and the service. We also process necessary information to meet applicable regulatory, accounting and dispute-related obligations. Where the GDPR applies and law permits, proportionate security operations and account-unlinked site statistics may rely on the corresponding legitimate interests. Processing that requires consent depends on valid consent. Visit analytics follows the choices in section 5.

We do not use this information for unrelated advertising profiles, sell personal information or share it for cross-context behavioral advertising. Before introducing an optional purpose, we will explain the data, purpose and opt-out method and obtain separate consent where required.

5. Cookies, website analytics and desktop usage

Necessary sessions. The website sign-in cookie (__Host-wb-session) lasts up to seven days; clearing it signs you out. Desktop sessions last up to 30 days, email-verification links 24 hours and password-reset links 30 minutes. These records support secure sign-in, accounts, licensing and transactions.

Visit analytics is your choice. On your first visit, choose Accept, Reject or Settings. Optional visit analytics stays off before consent. Refusal does not affect downloads, examples, registration, licensing or purchases. The main website and literature site on the same domain share the choice; you can change it from either footer. Visit-analytics consent alone does not link ad sources. Version 2.0 advertising measurement requires a separate, explicit choice.

Your choice lasts up to 180 days. Necessary local storage remembers your choice and notice version, without ad-click identifiers or account sources. Browsing does not extend the expiry; expiry or a change in the stated purposes requires a new choice. Refusal also stores a necessary cookie (__Host-wb_measurement_disabled) for up to 180 days. It contains only the refusal value 1, without account, click or device identifiers.

Our website records. After consent, random visit and page IDs in sessionStorage support public-page categories, language, coarse device type, views and active time. A visit ID changes after 30 minutes of inactivity. These records stored by our website exclude account IDs, IP addresses, complete browser identifiers, query strings and form content. They do not link ad sources to accounts. Section 6 describes third-party processing.

Download campaign totals. Pages recognize only allowed source, medium and campaign names. A download may receive a short-lived random ticket to count Windows and Mac clicks, requests, complete transfers, partial transfers and failures, while excluding duplicates. It is not stored persistently in the browser or bound to an account or device. It contains no GCLID, GBRAID, WBRAID, email, experimental content or file path, and uses neither IP stitching nor device fingerprints. Download URLs may carry the ticket, not raw campaign parameters.

A download ticket can initiate or retry a download within 15 minutes. The temporary link between the first valid request and a trusted receipt lasts no more than 24 hours and is cleared when a complete-transfer receipt arrives. Deduplication hashes expire at the original ticket cutoff. Campaign-by-date totals are retained for 30 days by default under the production configuration. Historical source records expire under their existing rules, without new personal source links.

Campaign parameters can be supplied by anyone, so a channel marker does not prove a paid-ad click. A complete transfer does not prove installation or use. Unknown and unobservable sources remain separate, without inferring identity. Existing download statistics may estimate network region using the local DB-IP database, without sending IPs to DB-IP or collecting GPS. VPNs and proxies can affect this estimate.

Registrations and ad reports. New-account totals come from successful registrations. Measurement choices do not alter account or transaction records. Downloads from cloud drives or Xiaohongshu without reliable click evidence are not treated as Google conversions. Ad impressions, clicks and cost can still be imported from platform CSV reports.

Version 2.0 advertising measurement. After you enable this separate purpose, an allowed Google click identifier (GCLID, GBRAID or WBRAID) can be linked to this account’s registration, purchases and refunds and sent to Google Ads. Only click identifiers, random transaction identifiers, time, value and currency are sent. Emails, names, experimental materials, file paths and device-identification digests are excluded. Upgrade purchases report only the amount paid for the upgrade. Code redemption does not create a second revenue event. Source markers and API receipt do not establish final Google attribution.

Click identifiers and account links for new events last up to 30 days. Delivery records retained after that point serve only deduplication and refund adjustments, without the original click identifiers. An optional app transfer code expires after 15 minutes and can be used once; direct cloud-drive downloads need no code. Conversion delivery and deduplication records last up to 90 days, and browser choices up to 180 days. Earlier visit-analytics or app-usage consent does not enable advertising; the app has a separate advertising choice. Refusal, withdrawal or DNT/GPC stops further collection and uploads, clears source identifiers and cancels queued events. Necessary account and order records remain.

Limits on third-party tags. Public pages load Google Analytics or Baidu Analytics only after consent and while the service is enabled. Tags remain blocked before consent, after refusal or with browser DNT/GPC. Account, admin, email-verification, reset and payment-token pages do not load third-party analytics. Unknown or sensitive parameters and unknown fragments also block loading.

Ad-click identifiers are removed before permitted tags load. Page fields we actively send exclude complete query strings, fragments, emails, form text and account IDs. Google may receive the allowed google/cpc campaign name, not search terms or arbitrary campaign text. Advertising purposes for analytics tags stay denied. Remarketing and email hashing are not enabled. Separately consented conversions use the server route below; browser tags do not duplicate purchase conversions.

Desktop usage is a separate choice. Usage measurement in the app is initially off; browser consent does not enable it. Once enabled, it records only software usage events and predefined error codes. It does not collect experiment-related information or upload complete error logs or exception text.

Events include first observable launch, sample opening, first valid layout with bands, sample export, first actual export with your own materials, first source-data export, daily workspace activity and allowed error codes. Records also contain the event time, app version and build, platform and architecture, and whether materials are samples or your own; they contain no material content. Daily activity is recorded at most once per UTC day. A resettable random ID helps observe use during the retention period, without ad-source or account linking. ID counts do not equal people or a retention rate for all users.

Usage statistics exclude images, band coordinates, proteins, treatments, quantified results, figure contents, filenames, paths, projects and licensing device digests. Necessary registration, activation, payment, licensing and refund records remain subject to their original service purposes.

Change or withdraw. Withdrawal in the footer settings stops future optional sending and clears removable optional browser identifiers. Pages with third-party tags reload. The refusal marker and DNT/GPC also block campaign download tickets; ordinary downloads still work. The refusal marker is cleared only after renewed consent and server confirmation. The interface asks you to retry if withdrawal is unconfirmed or the browser cannot save the marker.

Historical ad-source links follow their existing retention and deletion rules, without reattribution or deletion of necessary accounts, orders or licenses. Withdrawal does not automatically erase data already received by a third party. Contact samskaras@163.com for applicable data requests.

Remembered sign-in. Desktop credentials and sessions use operating-system-supported encrypted storage, without a plaintext fallback when encryption is unavailable. This does not encrypt your experimental library or disk. Protect your computer account, storage and backups separately.

6. Providers and disclosures

Alibaba Cloud: hosts the website in Shanghai, China, including necessary account, licensing, support and operational data. NetEase 163 Mail: delivers account notices and receives messages sent to samskaras@163.com, processing addresses, content, attachments and mail-operation information. These services support the corresponding hosting, mail and support purposes.

Baidu Analytics and Google Analytics: measure public-page visits after you choose analytics and the service is enabled. We do not actively send account emails, activation codes, form text or ad-click identifiers to them. Google may process visit data outside China. Loading its service still sends network information such as your IP address to Google and may use cookies. This is separate from whether our own visit records store IP addresses. See the Baidu privacy policy, Google privacy policy and Google’s partner-site data explanation. The providers are Beijing Baidu Netcom Science Technology Co., Ltd. and Google LLC, respectively.

Authorized persons and providers process information only as needed for the service. Necessary disclosures may also respond to lawful regulatory requests, court orders, protection of legal rights or your explicit request. If the operator changes, we will identify the new responsible party and require continued applicable safeguards, seeking renewed consent where required.

7. Waffo Pancake and payment information

Viewing prices, registering for a trial or resending account notifications does not charge you. Transactions occur only when you create an order while signed in and confirm payment in Waffo checkout. Our website does not collect or store full card numbers, security codes or payment passwords.

When you use Waffo Pancake hosted checkout, its identified Merchant of Record/payment entity handles payment, tax and fraud-prevention data. We send your internal account identifier, pre-filled email, product, currency and internal order reference. Card and billing-address information goes directly to the payment provider and is not stored by us. We retain order/payment IDs, products, account associations, amounts, currencies, payment/refund status and times, and policy acceptance needed for licensing, reconciliation and support. Unneeded card digits, billing addresses and payer email are excluded from our webhook queue.

Before payment, review the payment entity, its privacy policy and relevant transfer information shown in checkout. Waffo manages its payment records under its applicable policy; we handle account and licensing records under the periods below.

8. Retention and deletion

Accounts and licenses: kept during the service relationship. Within 30 days after a verified account closure, records no longer needed are deleted or anonymized, including account, device and associated service records. License expiry does not automatically close an account. Closure currently uses the manual contact channel, not a one-click website feature.

Support and operation records: support and mail correspondence is kept for one year after resolution; account security-audit records for up to 180 days. Ordinary web logs typically rotate over about 14 days. Other system logs rotate by capacity, with a 180-day manual-cleanup limit. Existing site-operation statistics retain their cleanup mechanism. Campaign-by-date totals default to 30 days; temporary download links and deduplication hashes follow section 5.

Server backups: restricted backups expire within 90 days of creation. Residual data covered by a deletion request expires within that cycle and is not used for ordinary operations. Completed closure and deletion records are reapplied after disaster recovery. Local research projects and your own backups remain under your control and are outside these server periods.

Transactions: minimum order and license-delivery records are kept for three years after completion for reconciliation, refunds and disputes, then deleted or anonymized. Legal requirements, unresolved refunds or disputes, and lawful evidence preservation may extend retention of the minimum necessary data. Use remains restricted, with cleanup when the reason ends. Expiry handling uses manual procedures; checkout-session expiry does not delete transaction records.

9. Your rights and requests

Subject to applicable law, you may obtain information and access/copies, correct errors, request deletion or account closure, restrict or object to processing, request portability and withdraw consent-based permissions. Withdrawal does not invalidate earlier lawful processing. Information still necessary to provide the service or meet legal obligations is not automatically erased merely because consent is withdrawn.

Email samskaras@163.com from your account address and identify the request. Do not send passwords, complete activation codes or card numbers. We verify identity with the minimum necessary information and normally respond within 30 calendar days of receipt, or a shorter legally required period. If a lawful extension or refusal is necessary, we will explain the reasons, scope and available remedies.

Account closure and personal-data copies currently use this manual contact channel; there is no self-service closure button. You may also complain to the competent privacy/data-protection authority where you live. We do not discriminate for exercising lawful rights, although deleting information necessary for the service may prevent the relevant account or licensing service from continuing.

10. Security and incidents

Account connections use HTTPS and passwords use salted hashes. Server files and backups have access controls; administration is separate from ordinary accounts, with session revocation, rate limiting and audit records. Access controls do not mean every database or research file is encrypted, and no system can promise absolute security.

If a personal-data incident occurs, we will act promptly to contain and investigate it and notify affected users and authorities as required by applicable law. Where the GDPR supervisory-reporting obligation applies, a report will be made within 72 hours of awareness where feasible; user notifications follow applicable risk and timing requirements. Not every technical fault triggers the same notification deadline.

11. Locations and international processing

The website account service is currently hosted in Shanghai, China. For users elsewhere, necessary account and network information is transmitted to China. NetEase mail delivery and your chosen recipient-mail service may involve their respective infrastructure.

Waffo checkout, Google Analytics loaded only when allowed and chosen, and minimal Google Ads (Google LLC) conversion events sent by our server after separate consent may involve receipt or processing outside China. International processing remains subject to applicable notices, assessments and other prerequisites. This policy does not claim that standard contractual clauses, adequacy determinations or unverified procedures have been completed.

12. Age requirements and marketing

The service is intended for users aged 18 or above, is not directed to children and does not knowingly collect minors’ information. Guardians may contact us to investigate and delete information submitted by a minor. We currently send no marketing subscriptions. Optional marketing, if introduced, would require separate consent and a working unsubscribe method; opting out would not stop necessary account, security or transaction notices.

13. Policy changes

Material changes will normally be announced on the website or by account email at least 15 days in advance, with revision and effective dates. Where law or urgent security needs require faster action, we will explain why. Renewed consent will be obtained for changes of purpose, scope or legal basis where required. Previously effective versions will be retained for reference.

14. Contact Shen

Individual developer and privacy contact: Shen. Email: samskaras@163.com. See the Terms of Service for software-use and refund conditions.