g:Profiler Privacy Policy

About g:Profiler and this policy

This policy explains how g:Profiler handles information when you run an analysis, share a query, create a custom annotation database, contact the team or subscribe to announcements. It covers the g:GOSt, g:Convert, g:Orth and g:SNPense web tools and the analysis APIs, including requests made through the official R and Python clients.

g:Profiler is operated by the g:Profiler team at the University of Tartu, Estonia. The University of Tartu is the data controller responsible for personal data processed by the service.

• Controller: University of Tartu (Tartu Ülikool), registry code 74001073, Ülikooli 18, 50090 Tartu, Estonia.
• Service contact: biit.support@ut.ee.
• University data-protection contact: andmekaitse@ut.ee.

The University of Tartu data protection policy provides general institutional information about personal-data processing and data-protection rights.

If you access g:Profiler through another website or workflow service, that service's handling of your information is covered by its own privacy notice.

Running an analysis

We process the identifiers, query and background lists, organism selection and settings you submit to produce the requested results. Query and background lists are not retained as routine analysis records. Creating a short link saves those inputs, as described below.

We do not store application error logs or retain submitted input lists or upload content in slow-query logs. We retain technical usage and performance information separately.

Analysis requires the inputs and settings needed for the function you choose. Creating a short link, uploading custom annotations and subscribing to announcements are optional. You can use the analysis service without using those features.

Please avoid including names, email addresses, patient or sample identifiers, or other identifying details in query names, lists, filenames and annotation descriptions. Removing names alone may not make information derived from an individual's genome or health record anonymous.

Sharing analyses

Short links

Creating a short link saves the inputs and settings needed to reproduce an analysis. For g:GOSt, these include query and background lists, organism or custom-database identifier, annotation sources and analysis options. Other tools save the inputs and settings relevant to their function. The saved record also includes the link identifier, destination, data version and creation time.

The record stores inputs and settings rather than a result table. Opening the link loads the inputs and runs the analysis again.

Short-link records are retained indefinitely, with no scheduled expiry. Anyone with the link can retrieve the saved inputs without signing in. Share a link only with people who may access its contents.

Short links are created without identifying their creator. We do not offer deletion based solely on a claim to have created a link, because we cannot verify that claim. Possession of a link does not establish authorship. Requests concerning personal data in a link are handled separately under the data-protection rights section below.

Full query URLs

A full query URL contains inputs and settings directly in its address. Generating or copying it does not create a short-link record. Anyone who receives the URL can read the embedded inputs. When opened, it may also appear in browser history and technical logs that record URLs.

Custom annotation databases

We use uploaded GMT files to build custom annotation databases. The original file is not retained as an uploaded file. The generated database retains gene identifiers, annotation term identifiers and descriptions, gene-to-term relationships, and source names derived from filenames.

Generated custom databases are stored and accessible indefinitely, with no scheduled expiry. Anyone who obtains a custom-database identifier can use the database through g:Profiler. Sharing an analysis that uses it can disclose that identifier.

Avoid including personal identifiers or confidential information in filenames, term descriptions or other uploaded annotation content. Requests concerning personal data in a custom database can be made through the contacts above.

Technical information and network logs

We record technical usage information to understand service use and support its operation. This can include timestamps, browser or client software information, organism or custom-database identifier, selected sources and settings, input and result counts, processing duration and diagnostic timings.

The g:Profiler team's routine analysis records do not include IP addresses. University network administrators separately log IP addresses. There is no dedicated key linking an IP address to a query; this does not guarantee that records cannot be associated through other information, such as timestamps or shared-link addresses.

Browser storage

The website uses LocalStorage in your browser to remember which announcements you have dismissed. This preference has no fixed expiry and can be removed by clearing the site's browser storage.

LocalStorage also temporarily carries shared-analysis inputs and selected gene lists between pages or tools. The application normally removes these values after reading them. If that process is interrupted, they may remain until subsequent cleanup or until you clear the site's browser storage.

Contact and announcements

When you contact the team, we use the name, email address and message you provide to respond to your enquiry. The contact form sends these details to the g:Profiler support mailbox and to an external workplace messaging provider for internal support coordination.

The announcements mailing list is managed by the University of Tartu IT department. Subscription information is used to send service announcements. Contact us at biit.support@ut.ee for help with a subscription or to request that announcements stop.

Hosting and recipients

The analysis service, saved short links and custom annotation databases are hosted on University of Tartu infrastructure, managed by University IT.

The external workplace messaging provider receives the contact details and message contents described above. Access through shared links and custom-database identifiers is described in the corresponding sections of this policy.

Purposes and retention

We use submitted information to provide analysis, sharing and custom-annotation functions. Technical information supports service operation and our understanding of how the resource is used. Contact information is used to respond to enquiries and coordinate support, and subscription information is used to send announcements.

Information retained by g:Profiler is kept indefinitely, without scheduled expiry. This includes saved short-link records, custom annotation databases, technical usage and performance records, and retained support correspondence. University-managed network logs and mailing-list records form part of the retained service records.

Indefinite storage does not remove the rights described below. Requests concerning personal data are assessed under the applicable data-protection rules.

Your data-protection rights

Your rights concern personal data about you. Depending on the processing and applicable legal conditions, you may:

• Ask for access to your personal data and a copy, and ask for inaccurate data to be corrected.
• Request erasure or restriction of processing.
• Object to processing based on a public task or legitimate interests, on grounds relating to your situation.
• Request portability of personal data you have provided where processing is automated and based on consent or a contract.
• Withdraw consent at any time where consent is the legal basis. Withdrawal does not affect the lawfulness of processing before withdrawal.

Send requests to biit.support@ut.ee or andmekaitse@ut.ee. For information in a saved analysis or custom database, include the relevant link or database identifier and explain which personal data concerns you. We may need additional information to verify your identity or relate the request to that data. Being the creator of a scientific analysis and being the person whose personal data it contains are different things.

We will respond without undue delay and within one month of receiving your request. If the complexity or number of requests requires an extension permitted by the GDPR, we will notify you within the first month, explain why and state the extended deadline. If we cannot act on a request, we will explain why and how you can challenge the decision.

You may complain to the Estonian Data Protection Inspectorate or another competent supervisory authority, including in the EU country where you live or work.

Changes to this policy

We will update this policy when our data handling changes and display the date of the latest revision.