Privacy Policy

Suttain LLC ("Suttain," "we," "us") operates the website suttain.com, the Suttain consumer tools, the Research Portal, and the Suttain Enterprise API. This policy explains what data we collect, how we use it, and the choices you have.

Account data

When you create an account, we store your name, email address, and password (hashed). If you purchase a paid plan, we also store billing details processed through our payment provider. We do not store full card numbers on our servers.

Usage data

We log the queries you run (chemical names, ingredient searches, scans), the tools you use, and aggregated interaction data for improving our models. Individual scan data is aggregated and never sold as personally identifiable records.

Technical data

IP address, browser type, device type, and session timestamps for security and performance monitoring.

API data

If you use the Enterprise API, we log request counts, endpoint usage, and API key identifiers for rate limiting and abuse prevention. We do not store the content of your API request payloads beyond the time needed to return a response.

• To provide and improve the Suttain platform and tools
• To process payments and manage subscriptions
• To improve our chemical safety models through aggregate, de-identified usage patterns
• To send service notifications, security alerts, and (with consent) product updates
• To enforce rate limits and prevent abuse

• We do not sell your personal data to third parties
• We do not share individual scan or query histories with advertisers
• We do not use your data to train third-party models without consent
• We do not retain payment card details on our infrastructure

We rely on these third-party services to operate the platform:

• PubChem, ChEMBL, EPA CompTox, RCSB PDB, and AlphaFold DB for chemical and protein data
• Google, Microsoft, or Apple for authentication (if you use social sign-in)
• Our payment processor for billing (card data never touches our servers)
• Open-Meteo for weather data (Suttain Farm, if applicable)
• USDA FoodData Central and OpenFoodFacts for nutrition data

Each third party has its own privacy policy. We recommend reviewing them.

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies. You can disable cookies in your browser, but some features may not work.

Account data is retained while your account is active. You can request deletion at any time. API request logs are retained for 90 days for security auditing, then automatically purged. Aggregate, de-identified usage data may be retained indefinitely for model improvement.

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your data in a machine-readable format
• Object to certain processing of your data

To exercise any of these rights, contact us at contact@suttain.com.

We use industry-standard practices including encrypted data transmission (TLS), hashed passwords, and access controls. No method of transmission or storage is 100% secure, but we work to protect your data.

Suttain is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe we have, contact us and we will delete it.

We may update this policy as our services evolve. Material changes will be posted on this page with an updated date. Continued use after changes constitutes acceptance.

Questions? Email contact@suttain.com or write to Suttain LLC, 8539 Alma Lily Dr, Richmond, TX 77469.