Last updated: May 2026 · Version 1.0

1. Introduction

MYDNATLAS ("we", "us", "our") operates the mydnatlas.com website and associated services. This Privacy Policy explains how we collect, use, store, and protect your personal information, including genetic data, when you use our platform. We are committed to safeguarding your privacy and handling your data with full transparency.

2. Information We Collect

We collect the following categories of information:

Account Information: Email address, display name, and password (hashed) when you create an account.
DNA Files: Raw DNA data files you upload (e.g., from 23andMe, AncestryDNA, MyHeritage, or other providers) for the purpose of G25 coordinate conversion.
G25 Coordinates: The computed principal component coordinates derived from your DNA file, used for ancestry analysis.
Analysis Results: Ancestry composition breakdowns, population distances, admixture models, period breakdowns, and other analytical outputs generated from your G25 coordinates.
Payment Information: Subscription plan selection and payment details processed securely by Stripe. We do not store your full credit card number.
Usage Data: Pages visited, features used, timestamps, browser type, and device information collected through analytics.

3. How We Use Your Data

Your data is used exclusively for the following purposes:

Ancestry Analysis: Converting your raw DNA file into G25 coordinates and running ancestry composition, population distance, admixture, and related analyses.
Account Management: Maintaining your account, managing subscriptions, and providing customer support.
Service Improvement: Aggregated, anonymised usage statistics to improve platform performance and features. Individual genetic data is never used in aggregate analytics.
Communication: Sending essential service notifications such as analysis completion alerts and subscription updates. We do not send marketing emails without your explicit consent.

We do not sell, rent, lease, or share your personal or genetic data with any third party for marketing, research, pharmaceutical, or insurance purposes. Ever.

4. DNA File Handling

We apply strict data minimisation principles to your genetic data:

Raw DNA Files: Your uploaded raw DNA file is processed to extract G25 coordinates and is then permanently deleted from our servers. Raw files are not retained beyond the conversion process.
Temporary Backups: Encrypted backups of raw files may be retained for up to 7 days solely for recovery purposes in case of processing failure. After 7 days, these backups are permanently purged.
G25 Coordinates: Your computed G25 coordinates are stored in our database, encrypted at rest, and are used to generate your ancestry analyses. You may delete your G25 coordinates at any time from your account settings.
Analysis Results: All analysis outputs are stored in association with your account and are deleted when you delete your account or remove your DNA data.

5. Cookies and Tracking

We use a minimal set of cookies necessary for platform operation:

Session Cookies: Essential cookies that maintain your login session and authentication state. These are strictly necessary and cannot be disabled.
Analytics Cookies: We use privacy-respecting analytics to understand how users interact with the platform. No personally identifiable genetic data is included in analytics.
Preference Cookies: Cookies that remember your display preferences such as theme selection and dashboard layout.

We do not use third-party advertising cookies or tracking pixels.

6. Third-Party Services

We use the following third-party services to operate the platform:

Supabase: Database hosting, authentication, and file storage. Supabase processes your account data and encrypted G25 coordinates. Supabase does not have access to or use your data independently. Data is hosted in secure, SOC 2 compliant data centres.
Stripe: Payment processing for subscriptions. Stripe receives only the payment information necessary to process transactions. No DNA data, G25 coordinates, or analysis results are ever shared with Stripe.

No other third parties receive access to your personal or genetic data.

6a. Where Your Data Is Stored (Overseas Disclosure)

Database and file storage are hosted by Supabase on AWS in Singapore (ap-southeast-1). Your personal information, including your account details and your encrypted G25 coordinates, is therefore stored outside Australia, in Singapore.

We tell you this because genetic information is sensitive informationunder the Privacy Act 1988 (Cth), and Australian Privacy Principle 1.4(f) requires us to identify the countries your information is likely to be disclosed to. Under Australian Privacy Principle 8 we remain accountable for how our overseas hosting provider handles your information, and we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

Stripe processes payments and may handle your billing information in other jurisdictions, including the United States. No DNA data, G25 coordinates or analysis results are ever shared with Stripe.

7. Your Rights

Under the General Data Protection Regulation (GDPR) and applicable privacy laws, you have the following rights regarding your personal data:

Right of Access (Article 15): You may request a copy of all personal data we hold about you, including your G25 coordinates and analysis results.
Right to Rectification (Article 16): You may request correction of any inaccurate personal information.
Right to Erasure (Article 17): You may request complete deletion of your account, G25 coordinates, analysis results, and all associated data. Deletion is permanent and irreversible.
Right to Data Portability (Article 20): You may download your G25 coordinates and analysis results in standard formats from your account dashboard.
Right to Restrict Processing: You may request that we limit the processing of your data while a complaint or correction request is pending.
Right to Object: You may object to data processing based on our legitimate interests.

To exercise any of these rights, contact us at privacy@mydnatlas.com. We will respond to all requests within 30 days.

8. Data Security

We implement comprehensive security measures to protect your data:

All data is encrypted in transit using TLS 1.3.
G25 coordinates and analysis results are encrypted at rest in our database.
Passwords are hashed using bcrypt with industry-standard salt rounds.
Row-level security (RLS) policies ensure that users can only access their own data.
Administrative access is strictly limited and audited.
We conduct regular security reviews and apply patches promptly.

9. Data Retention

Account Data: Retained for the lifetime of your account. When you delete your account, all personal data is permanently removed within 30 days.
G25 Coordinates: Retained until you delete them or delete your account.
Analysis Results: Retained until you delete your DNA data or delete your account. All analysis results are permanently removed alongside the associated G25 coordinates.
Raw DNA Files: Deleted immediately after G25 conversion. Encrypted backups purged after 7 days.
Payment Records: Transaction records are retained as required by applicable tax and financial regulations.

10. Children's Privacy

MYDNATLAS is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal data, we will delete that data immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email notification and a prominent notice on the platform at least 30 days before they take effect. Continued use of the service after changes become effective constitutes acceptance of the updated policy.

12. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

MYDNATLAS Privacy
Email: privacy@mydnatlas.com