PORTRAIT
Contact
Privacy notice
Version 1.3 — last updated 28 September 2026 (notice
version 2026-09-28.1)
This notice explains how we process personal data in connection with the PORTRAIT website (portrait.bio), the registration and licensing of the PORTRAIT software, our relationship with users and customers, and our contacts with researchers. It is given under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree no. 196/2003 (“Italian Privacy Code”).
1. Controller
The controller is Portrait Project, Via Marco Celio 32, 40100 Bologna, Italy. For any matter concerning your data, write to [email protected]. We have not appointed a data protection officer, as the law does not require one for our activity.
2. What PORTRAIT does not collect
Your images, measurements, analyses, results and file names stay on your computer. The software has no function that sends them to us. If your laboratory connects PORTRAIT to its own database server, the data on that server is controlled by your laboratory; we have no access to it and are neither its controller nor its processor.
3. What we process, why, and on what legal basis
3.1 Registration and licence. Name, institution, email address, country, Licence Key, date of registration and licence history, acceptance of our terms (version, date and time). Purpose: issuing and managing your licence, sending you the key, recovering your account, providing support. Legal basis: performance of the contract with you, including the free first-year licence (Art. 6(1)(b) GDPR). Without these data we cannot issue a licence. If you ask for a licence and never confirm your address with the code we email you, the request is deleted within 48 hours.
3.2 Licence checks by the software. A code derived from the hardware of up to two of your computers (not the hardware serial numbers themselves), the Licence Key, the software version and the date of each contact. The software contacts our licence server only when the licence is activated or released, near and after its expiry, when you check for a renewal, when an account is created or a password is recovered, and at launch when the licence cannot be verified on your computer. Passwords never leave your computer. Legal basis: performance of the contract (Art. 6(1)(b) GDPR); these checks are strictly necessary to provide the licence you requested (Art. 122 Italian Privacy Code).
3.3 Basic diagnostics and crash reports. Technical events (software version, operating system, errors) and crash reports, linked to a random code our licence server assigns to your Licence Key. At the basic level we receive only: that the application started, with its version and operating system; that an error or a crash occurred; that an analysis finished; and that a file was exported, without its format or content. Counts and durations are received unless you switch off the optional usage data (section 3.13). They never include your images, measurements, results, file names or location, and our diagnostics provider discards IP addresses. Purpose: detecting and fixing errors and security vulnerabilities, including meeting our obligations as manufacturer under Regulation (EU) 2024/2847 (Cyber Resilience Act). Legal basis: our legitimate interest in keeping the software working and secure (Art. 6(1)(f) GDPR). They are on by default; this is stated on the first-launch screen, and you can switch them off there or at any time in Settings › Privacy, with no effect on your licence. Switching off also deletes events not yet sent.
3.4 Service emails. Your licence key, account recovery, notice of expiry and information necessary to use your licence. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
3.5 Tips and renewal offers. Occasional emails with tips on using PORTRAIT and offers to renew or upgrade your licence, about PORTRAIT only. Legal basis: Art. 130(4) Italian Privacy Code (use of an email address obtained in the context of the supply of our service, for similar services). You can refuse them at any time by replying to any of them or by writing to [email protected]; refusing does not affect your licence.
3.6 Release notice. If you ask only to be told when PORTRAIT or a new version is released, we use your email address for that purpose alone. Legal basis: your consent (Art. 6(1)(a) GDPR). We delete it after sending the notice or when you withdraw consent.
3.7 Payments and invoicing. From the second year: name, institution, billing address, VAT or tax code, purchase order and payment references. Card payments are processed by Stripe; we never receive your card details. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c) GDPR).
3.8 Customer relationship management. Registration, licence and correspondence data are kept in our customer management system to manage our relationship with you, answer your requests and plan our work. We use artificial-intelligence services, acting on our behalf, to help analyse and draft within that system; they do not make decisions about you and do not use your data to train their models. Legal basis: performance of the contract and our legitimate interest in running our business efficiently (Art. 6(1)(b) and (f) GDPR).
3.9 Security of registration. Your IP address and a check by Cloudflare Turnstile, to protect registration from automated abuse. Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).
3.10 After an erasure, or when you ask us to stop writing. We keep your email address on a do-not-contact list, and nothing else about you, so that no future campaign or message can reach you again — the one piece of data that makes your request effective. It is never used to contact you, and it is kept for as long as we send anything at all. Legal basis: our legitimate interest in honouring your own request (Art. 6(1)(f) GDPR), and Art. 17(3) GDPR for the records we must keep.
3.11 Defence of rights. Where necessary, the data above may be used to establish, exercise or defend legal claims. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
3.12 How the website is used. Which page was opened, and how a registration or a request for a key ended (for example: code sent, key issued, address already registered, security check failed), together with the technical information every web request carries — your browser and operating system, and the page you arrived from. Your IP address reaches our provider as part of the request; we have switched off the location lookup it would otherwise perform on it. These measurements are processed on our behalf by PostHog (European Union), configured to store nothing in your browser and to build no profile of you, and they never include your name, your institution, your email address, your licence key, or anything you typed into a form. Purpose: seeing how many people reach the site and how many complete a registration, so that we can fix what does not work. Legal basis: our legitimate interest in understanding and improving our own website (Art. 6(1)(f) GDPR). No consent is required under Art. 122 of the Italian Privacy Code, because nothing is stored in or read from your device.
3.13 Detailed usage data. How often each feature of the software is used, how long an analysis took, and how many organoids were measured — counts and durations only, linked to the same code. They never include your images, measurements, results or file names. Purpose: understanding which parts of PORTRAIT are used, and where they are slow or hard to use, so that we can improve the software. Legal basis: our legitimate interest in improving our software (Art. 6(1)(f) GDPR). They are on by default: the box on the first-launch screen is ticked. You can clear it there, or switch them off at any time in Settings › Privacy, with no effect on your licence.
4. Researchers we contact first (Art. 14 GDPR)
We may write individually to researchers whose work is relevant to PORTRAIT. Data: name, institution, role, professional contact details and research topics. Source: publicly accessible professional sources — scientific publications, institutional websites, conference programmes and professional directories. Purpose: to present PORTRAIT to researchers whose work it may support. Legal basis: our legitimate interest in making PORTRAIT known to the relevant scientific community (Art. 6(1)(f) GDPR); where the law requires your prior consent for a given channel, we do not use that channel without it. Retention: 24 months from our last contact, unless you register. You can object at any time, with no reason required, by replying to our message or writing to [email protected]; we will then stop contacting you and keep only what is needed to respect your objection.
5. How long we keep data
| Data | Retention |
|---|---|
| Registration, licence and account data | While the licence is active and for 24 months after it last expired |
| Diagnostics and crash reports | 24 months from collection, or earlier deletion with your registration or on your objection |
| Detailed usage data | 24 months from collection, or earlier deletion with your registration or on your objection |
| Emails you send us | As long as the registration or request they concern |
| Release notice address | Until the notice is sent or consent is withdrawn |
| Invoices and accounting records | 10 years, as required by Italian law (Art. 2220 Civil Code) |
| Email address on the do-not-contact list | For as long as we send anything at all — removing it would let a later campaign reach you again |
| Researchers contacted first | 24 months from last contact |
| IP addresses for registration security | At most 48 hours |
| Technical server logs | At most 7 days |
Data needed to establish or defend legal claims may be kept for longer, only for that purpose and for as long as necessary.
6. Who receives your data
We do not sell your data. It is processed on our behalf by the following providers, under their data processing terms (Art. 28 GDPR):
- Cloudflare — website, licence server, registration security;
- Amazon Web Services — delivery of service emails (Ireland);
- Infomaniak — our email (Switzerland);
- PostHog — diagnostics and website measurement (European Union);
- Anthropic — artificial-intelligence services used within our customer management system;
- Stripe — card payments, from the second year. Stripe also acts as an independent controller for its own fraud-prevention and legal obligations, under its own privacy notice.
Data may also be disclosed to our accountant and tax advisers, to our legal advisers, and to public authorities where the law requires it.
7. Transfers outside the European Economic Area
Some providers process data outside the European Economic Area. Transfers to Switzerland rely on the European Commission’s adequacy decision. Transfers to the United States rely on the EU–US Data Privacy Framework, where the provider is certified, or on the European Commission’s Standard Contractual Clauses. You can request a copy of the safeguards at [email protected].
8. Your rights
You can access your data, have it corrected or erased, restrict its processing, receive it in a portable format, and object at any time to processing based on our legitimate interest. You can withdraw your consent at any time, without affecting processing carried out before. Write to [email protected]; we reply within one month.
Erasure and your licence. Your registration data are necessary to provide your licence. If you ask us to erase them, we will first tell you that erasure ends your licence and that your images and results remain on your computer, and ask you to confirm. We will keep only what the law requires us to keep (such as invoices) and your email address on the do-not-contact list described in section 3.10, so that nothing of ours reaches you again.
Each person is entitled to one free year. If you ask us to erase your data, we keep a one-way code of your email address and of your licence key, plus the dates of that free year, so that a second free year cannot be claimed. Those codes cannot be turned back into your address or your key, and we use them for nothing else.
You also have the right to lodge a complaint with a supervisory authority; in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
9. Cookies
This website sets no cookies and shows no advertising. We measure how the site is used with PostHog, configured so that it stores nothing at all in your browser and cannot recognise you on a later visit; see section 3.12. On the registration pages, Cloudflare Turnstile stores one technical entry in your browser that is strictly necessary for the registration you request.
10. Automated decisions
We make no decisions about you based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.
11. Changes to this notice
If this notice changes, we update this page and its date. If a change substantially affects how we use your data, we also inform registered users by email. If PORTRAIT, or the agreement with you, is transferred to another company, your data will be transferred to it as part of that transfer, and we will inform you of the new controller before it takes effect (legal basis: our legitimate interest in the continuity of the business, Art. 6(1)(f) GDPR).